Merge pull request #43 from DeterminateSystems/graham/fh-634-spaghett…

…i-deploy

nix: propose-release workflow, production release

.github/workflows/build-publish.yml

@@ -5,14 +5,15 @@ on:
   push:
     branches:
       - main
-    tags:
-      - "v*.*.*"
   pull_request:
     types:
       - opened
       - reopened
       - synchronize
       - labeled
+  release:
+    types:
+      - released
 
 jobs:
   test-closures:
@@ -75,6 +76,7 @@ jobs:
 
   publish:
     needs: [test-closures, test-modules, build-versions-nix]
+    environment: ${{ github.event_name == 'release' && 'production' || '' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/propose-release.yml

@@ -0,0 +1,31 @@
+on:
+  workflow_dispatch:
+    inputs:
+      reference-id:
+        type: string
+        required: true
+      version:
+        type: string
+        required: true
+      nix-version:
+        type: string
+        required: true
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  propose-release:
+    uses: DeterminateSystems/propose-release/.github/workflows/workflow.yml@main
+    permissions:
+      id-token: "write"
+      contents: "write"
+      pull-requests: write
+    with:
+      reference-id: ${{ inputs.reference-id }}
+      version: ${{ inputs.version }}
+      extra-commands-early: |
+        sed -i 's#https://flakehub.com/f/NixOS/nix/=.*";#https://flakehub.com/f/NixOS/nix/=${{ inputs.nix-version }}";#' ./flake.nix
+        git add flake.nix
+        git commit -m "Update Nix release to ${{ inputs.nix-version }}" || true