From d0e8e8beefeae53effc6263a063f3756554d7bd0 Mon Sep 17 00:00:00 2001 From: archivr-qa Date: Sun, 23 Aug 2026 19:21:06 +0200 Subject: [PATCH] ci: bump yt-dlp from upstream releases, not nixpkgs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The flake no longer takes yt-dlp from nixpkgs; a dedicated `ytDlp` derivation fetches the upstream release binary directly and pins both `version` and an SRI `hash`. That makes the previous workflow inert: it ran `nix flake update nixpkgs` and compared `nixpkgs#yt-dlp.version` before and after, so it could churn the lockfile forever without ever moving the version we actually ship. The workflow now reads the pinned version straight out of the `ytDlp` block in flake.nix, asks the GitHub API for yt-dlp's latest release tag, short-circuits when they already match, downloads the new release to recompute its SRI hash (required — the hash is part of the derivation's identity, so the URL cannot be changed alone), and rewrites the three pinned fields under a sed range address scoped to that block so sibling pins like ublockLite and isdcac are untouched. It asserts only flake.nix changed and that the new version appears exactly twice before opening the PR. --- .github/workflows/update-ytdlp.yml | 131 ++++++++++++++++++++++++----- 1 file changed, 109 insertions(+), 22 deletions(-) diff --git a/.github/workflows/update-ytdlp.yml b/.github/workflows/update-ytdlp.yml index 3b9a921..624e566 100644 --- a/.github/workflows/update-ytdlp.yml +++ b/.github/workflows/update-ytdlp.yml @@ -13,39 +13,126 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v4 + - name: Check out repository + uses: actions/checkout@v4 - - uses: DeterminateSystems/nix-installer-action@main + - name: Install Nix + uses: DeterminateSystems/nix-installer-action@main - - uses: DeterminateSystems/magic-nix-cache-action@main + - name: Enable Nix cache + uses: DeterminateSystems/magic-nix-cache-action@main - - name: Get current yt-dlp version - id: before + - name: Read currently pinned yt-dlp version + id: current run: | - rev=$(jq -r '.nodes.nixpkgs.locked.rev' flake.lock) - version=$(nix eval --raw "github:nixos/nixpkgs/${rev}#yt-dlp.version") - echo "version=${version}" >> "$GITHUB_OUTPUT" + set -euo pipefail + current=$(sed -n '/ytDlp = pkgs.stdenv.mkDerivation/,/^ };$/{ s/^ *version = "\([^"]*\)";/\1/p; }' flake.nix | head -1) + if [ -z "$current" ]; then + echo "::error::Could not read the pinned yt-dlp version from flake.nix. Did the ytDlp derivation move or get renamed?" + exit 1 + fi + echo "Currently pinned yt-dlp: $current" + echo "version=${current}" >> "$GITHUB_OUTPUT" - - name: Update nixpkgs - run: nix flake update nixpkgs - - - name: Get new yt-dlp version - id: after + - name: Query latest yt-dlp release + id: latest + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - rev=$(jq -r '.nodes.nixpkgs.locked.rev' flake.lock) - version=$(nix eval --raw "github:nixos/nixpkgs/${rev}#yt-dlp.version") - echo "version=${version}" >> "$GITHUB_OUTPUT" + set -euo pipefail + latest=$(curl -sSL \ + -H "Authorization: Bearer $GITHUB_TOKEN" \ + -H "Accept: application/vnd.github+json" \ + https://api.github.com/repos/yt-dlp/yt-dlp/releases/latest | jq -r .tag_name) + if [ -z "$latest" ] || [ "$latest" = "null" ]; then + echo "::error::Could not determine the latest yt-dlp release tag from the GitHub API." + exit 1 + fi + echo "Latest yt-dlp release: $latest" + echo "version=${latest}" >> "$GITHUB_OUTPUT" - - name: Open PR if yt-dlp was updated - if: steps.before.outputs.version != steps.after.outputs.version + - name: Decide whether an update is needed + id: check + env: + CURRENT: ${{ steps.current.outputs.version }} + LATEST: ${{ steps.latest.outputs.version }} + run: | + set -euo pipefail + if [ "$CURRENT" = "$LATEST" ]; then + echo "Already at $CURRENT" + echo "changed=false" >> "$GITHUB_OUTPUT" + else + echo "Update available: $CURRENT -> $LATEST" + echo "changed=true" >> "$GITHUB_OUTPUT" + fi + + - name: Compute SRI hash of the new release + id: hash + if: steps.check.outputs.changed == 'true' + env: + LATEST: ${{ steps.latest.outputs.version }} + run: | + set -euo pipefail + curl -sSL --fail \ + "https://github.com/yt-dlp/yt-dlp/releases/download/${LATEST}/yt-dlp" \ + -o /tmp/yt-dlp + hash=$(nix hash file --sri --type sha256 /tmp/yt-dlp) + case "$hash" in + sha256-*) ;; + *) + echo "::error::Computed hash '${hash}' is not an SRI sha256 hash." + exit 1 + ;; + esac + echo "SRI hash: $hash" + echo "hash=${hash}" >> "$GITHUB_OUTPUT" + + - name: Rewrite the yt-dlp pin in flake.nix + if: steps.check.outputs.changed == 'true' + env: + CURRENT: ${{ steps.current.outputs.version }} + LATEST: ${{ steps.latest.outputs.version }} + HASH: ${{ steps.hash.outputs.hash }} + run: | + set -euo pipefail + sed -i \ + -e "/ytDlp = pkgs.stdenv.mkDerivation/,/^ };\$/{ s|^\( *version = \"\)[^\"]*\(\";\)|\1${LATEST}\2|; }" \ + -e "/ytDlp = pkgs.stdenv.mkDerivation/,/^ };\$/{ s|\(url = \"https://github.com/yt-dlp/yt-dlp/releases/download/\)[^/]*\(/yt-dlp\";\)|\1${LATEST}\2|; }" \ + -e "/ytDlp = pkgs.stdenv.mkDerivation/,/^ };\$/{ s|^\( *hash = \"\)sha256-[^\"]*\(\";\)|\1${HASH}\2|; }" \ + flake.nix + + echo "--- git diff --stat ---" + git diff --stat flake.nix + + changed_files=$(git diff --name-only) + if [ "$changed_files" != "flake.nix" ]; then + echo "::error::Expected only flake.nix to change, got: ${changed_files}" + exit 1 + fi + + occurrences=$(grep -c "$LATEST" flake.nix || true) + if [ "$occurrences" -ne 2 ]; then + echo "::error::Expected the new version ${LATEST} to appear twice in flake.nix (version line + URL), found ${occurrences}." + exit 1 + fi + + if ! grep -q "$HASH" flake.nix; then + echo "::error::New SRI hash was not written into flake.nix." + exit 1 + fi + + echo "Rewrote yt-dlp pin: ${CURRENT} -> ${LATEST}" + + - name: Open pull request + if: steps.check.outputs.changed == 'true' uses: peter-evans/create-pull-request@v6 with: branch: auto/yt-dlp-update delete-branch: true - commit-message: "chore: yt-dlp ${{ steps.before.outputs.version }} → ${{ steps.after.outputs.version }}" - title: "chore: yt-dlp ${{ steps.before.outputs.version }} → ${{ steps.after.outputs.version }}" + commit-message: "chore(nix): yt-dlp ${{ steps.current.outputs.version }} → ${{ steps.latest.outputs.version }}" + title: "chore(nix): yt-dlp ${{ steps.current.outputs.version }} → ${{ steps.latest.outputs.version }}" body: | - Automated `flake.lock` update. yt-dlp bumped from `${{ steps.before.outputs.version }}` to `${{ steps.after.outputs.version }}`. + Automated bump of the pinned yt-dlp release. Old: `${{ steps.current.outputs.version }}`. New: `${{ steps.latest.outputs.version }}`. SRI hash: `${{ steps.hash.outputs.hash }}`. - Triggered by the weekly nixpkgs check. + Upstream release: https://github.com/yt-dlp/yt-dlp/releases/tag/${{ steps.latest.outputs.version }} labels: dependencies