Merge pull request #224 from aykhans/dependabot/go_modules/charm.land/bubbles/v2-2.2.1

build(deps): bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1

.github/workflows/nix.yaml

@@ -21,16 +21,152 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: nix-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  # Keyed on the PR author, which is stable across the fix-up push, so the run
+  # started by that push cannot cancel the run that made it.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]' }}
+
+env:
+  SELF_HOSTED_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
+  IS_DEPENDABOT: ${{ github.actor == 'dependabot[bot]' }}
+
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
+    permissions:
+      # The only write is git push, which authenticates with the PAT that
+      # checkout persists, not with GITHUB_TOKEN.
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: ${{ inputs.ref || github.ref }}
+          # head.sha, not the merge ref: the hash is computed for the tree that
+          # gets pushed, and the run that verifies it must build that same tree.
+          ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.ref }}
+          token: ${{ (env.IS_DEPENDABOT == 'true' && secrets.DEPENDABOT) || secrets.GITHUB_TOKEN }}
+
       - uses: cachix/install-nix-action@v31
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: nix build
+        id: build
+        continue-on-error: ${{ env.SELF_HOSTED_PR == 'true' }}
         run: nix build .#default --no-link --print-build-logs
+
+      - name: Recompute vendorHash
+        id: hash
+        if: steps.build.outcome == 'failure' && env.SELF_HOSTED_PR == 'true'
+        run: |
+          nix run nixpkgs#nix-update -- --flake --version=skip --no-src default
+
+          # An unchanged hash means the build broke for some other reason. Say
+          # nothing and let the job fail on the real error.
+          if git diff --quiet -- nix/package.nix; then
+            echo "stale=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "stale=true" >> "$GITHUB_OUTPUT"
+          sed -n 's/^[[:space:]]*vendorHash = "\([^"]*\)".*/hash=\1/p' nix/package.nix >> "$GITHUB_OUTPUT"
+
+      - name: Push vendorHash fix
+        if: steps.hash.outputs.stale == 'true' && env.IS_DEPENDABOT == 'true'
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+          PUSH_TOKEN: ${{ secrets.DEPENDABOT }}
+        run: |
+          if [ -z "$PUSH_TOKEN" ]; then
+            echo "::error::the DEPENDABOT push token is missing from the Dependabot secret store"
+            exit 1
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add nix/package.nix
+          git commit -m "fix(nix): update vendorHash [dependabot skip]"
+          git push origin "HEAD:refs/heads/$HEAD_REF"
+          echo "::notice::vendorHash updated and pushed; the run on the new commit decides this PR"
+
+      - name: Comment stale vendorHash
+        if: steps.hash.outputs.stale == 'true' && env.IS_DEPENDABOT != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          HASH: ${{ steps.hash.outputs.hash }}
+        run: |
+          marker='<!-- vendorhash-bot -->'
+          body=$(cat <<EOF
+          $marker
+          ### \`nix/package.nix\` vendorHash is stale
+
+          This branch changes the Go dependencies, so the vendor derivation no longer matches the pinned hash and \`nix build\` fails.
+
+          \`\`\`nix
+          vendorHash = "$HASH";
+          \`\`\`
+
+          Run \`task nix-hash\` locally and commit the result, or paste the hash above.
+          EOF
+          )
+
+          # Keep one sticky comment instead of a new one on every push. Without
+          # the explicit check a failed lookup reads as "no comment yet" and
+          # posts a duplicate; piping into head would hide the exit status.
+          if ! matches=$(gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR/comments?per_page=100" \
+                           --jq ".[] | select(.user.login == \"github-actions[bot]\" and ((.body // \"\") | contains(\"$marker\"))) | .id"); then
+            echo "::error::could not list the pull request comments"
+            exit 1
+          fi
+          id=$(printf '%s\n' "$matches" | head -n 1)
+          if [ -n "$id" ]; then
+            gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -f body="$body" >/dev/null
+          else
+            gh pr comment "$PR" --body "$body"
+          fi
+
+      # Once the hash is fixed the build passes and the step above stops running,
+      # so without this the comment keeps claiming the branch is broken under a
+      # green check.
+      - name: Resolve stale vendorHash comment
+        # Gated on the hash rather than the build: a later push can fix the hash
+        # while the build still fails for an unrelated reason, and the comment
+        # must stop blaming the vendor derivation either way. Skipped when the
+        # recompute itself errored, since then we do not know.
+        if: ${{ !cancelled() && env.SELF_HOSTED_PR == 'true' && steps.hash.outputs.stale != 'true' && steps.hash.outcome != 'failure' }}
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          BUILD: ${{ steps.build.outcome }}
+        run: |
+          marker='<!-- vendorhash-bot -->'
+          if ! matches=$(gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR/comments?per_page=100" \
+                           --jq ".[] | select(.user.login == \"github-actions[bot]\" and ((.body // \"\") | contains(\"$marker\"))) | .id"); then
+            echo "::error::could not list the pull request comments"
+            exit 1
+          fi
+          id=$(printf '%s\n' "$matches" | head -n 1)
+          [ -n "$id" ] || exit 0
+
+          if [ "$BUILD" = "success" ]; then
+            detail='`nix build` passes on this branch.'
+          else
+            detail='The build is failing for another reason; see the workflow log.'
+          fi
+          body=$(cat <<EOF
+          $marker
+          ### \`nix/package.nix\` vendorHash is up to date
+
+          $detail
+          EOF
+          )
+          gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -f body="$body" >/dev/null
+
+      - name: Report build failure
+        if: ${{ !cancelled() && steps.build.outcome == 'failure' && !(env.IS_DEPENDABOT == 'true' && steps.hash.outputs.stale == 'true') }}
+        run: |
+          echo "::error file=nix/package.nix::nix build failed; see the log above"
+          exit 1

.github/workflows/release.yaml

@@ -24,6 +24,9 @@ jobs:
   nix:
     name: Verify Nix package
     uses: ./.github/workflows/nix.yaml
+    permissions:
+      contents: read
+      pull-requests: write
     with:
       ref: ${{ inputs.tag || github.ref }}
 

Taskfile.yaml

@@ -39,6 +39,11 @@ tasks:
     cmds:
       - "{{.GOLANGCI}} run"
 
+  nix-hash:
+    desc: Recompute nix/package.nix vendorHash after a dependency change.
+    cmds:
+      - nix run nixpkgs#nix-update -- --flake --version=skip --no-src default
+
   test:
     desc: Run Go tests.
     cmds:

go.mod

@@ -3,11 +3,11 @@ module go.aykhans.me/sarin
 go 1.26.5
 
 require (
-	charm.land/bubbles/v2 v2.1.1
-	charm.land/bubbletea/v2 v2.0.8
+	charm.land/bubbles/v2 v2.2.1
+	charm.land/bubbletea/v2 v2.0.9
 	charm.land/glamour/v2 v2.0.1
 	charm.land/lipgloss/v2 v2.0.6
-	github.com/brianvoe/gofakeit/v7 v7.15.0
+	github.com/brianvoe/gofakeit/v7 v7.16.0
 	github.com/charmbracelet/x/term v0.2.2
 	github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6
 	github.com/joho/godotenv v1.5.1

go.sum

@@ -1,7 +1,7 @@
-charm.land/bubbles/v2 v2.1.1 h1:7r55WzBxpo/R3z98hGmY7KKPd3ET6vsf0Fb9sDHOV60=
-charm.land/bubbles/v2 v2.1.1/go.mod h1:GE6M31gaWZVXzGw73OeuTTgy4lX+OtkH0E5ymnNsHxo=
-charm.land/bubbletea/v2 v2.0.8 h1:SxTJMhCAI3lbPmy4SgX5LWZ24AdINr4I6UEqzZvYJuY=
-charm.land/bubbletea/v2 v2.0.8/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
+charm.land/bubbles/v2 v2.2.1 h1:Fq1+qm5hV6GkvzLQDhCBpXXE5tLgvh1PRriCLwSvIQU=
+charm.land/bubbles/v2 v2.2.1/go.mod h1:wdMgn+sje1KNXdwFizIWjbf328fIUBxqEmJ/vYPo8yc=
+charm.land/bubbletea/v2 v2.0.9 h1:DpJCMWKgzQK8SJv4zbKKFHAI10ymWy/evClPFk0k0f8=
+charm.land/bubbletea/v2 v2.0.9/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
 charm.land/glamour/v2 v2.0.1 h1:xl+r00A4aJWU0z8fgwKd9fQQ4rsphqGUzuEiXZP5n+c=
 charm.land/glamour/v2 v2.0.1/go.mod h1:jo9z8XqVKPeEFMVdvCRLGk++RyJ3CdUwgNr7EvXLw3k=
 charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
@@ -20,8 +20,8 @@ github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/brianvoe/gofakeit/v7 v7.15.0 h1:kGLYAWN8tnmxq2PelKVK6zwpM7kMxdz9SGPH31mFkNs=
-github.com/brianvoe/gofakeit/v7 v7.15.0/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
+github.com/brianvoe/gofakeit/v7 v7.16.0 h1:LXNcvT4Klw72/hqpLNNdEWFIcP7G0VFPNsqvEIGONBE=
+github.com/brianvoe/gofakeit/v7 v7.16.0/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
 github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
 github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=

nix/package.nix

@@ -11,7 +11,7 @@
 
   src = lib.cleanSource ../.;
 
-  vendorHash = "sha256-hGrS/drQiBOcqwloi15vqOdiTbweo0Oya+fF9SLM3so=";
+  vendorHash = "sha256-Yn1d2NbPYhlXzoJl4QbmZ/K7/UdwheWLj2mLyegRPvM=";
 
   subPackages = [ "cmd/cli" ];
 
@@ -29,7 +29,6 @@
     ldflags+=("-X 'go.aykhans.me/sarin/internal/version.GoVersion=$(go version)'")
   '';
 
-  # cmd/cli produces a binary named "cli"; rename it to "sarin".
   postInstall = ''
     mv $out/bin/cli $out/bin/sarin
   '';