From bdaefc1be04febd9b5547f80c31756b712f68cbc Mon Sep 17 00:00:00 2001
From: Svetlin Ralchev <iamralch@users.noreply.github.com>
Date: Mon, 5 Oct 2026 10:44:33 +0400
Subject: [PATCH] ci: repair the vendorHash Dependabot bumps leave stale

Dependabot's Go module bumps change go.sum without the vendorHash in
flake.nix, so nix build fails on the pull request. A hash job in CI runs
nixos-contrib/nix-update-hash on those pull requests and pushes the
corrected hash with the App token; the CI run that push triggers cancels
the stale one through the existing concurrency group.

Pinned to @main until the action's first release.
---
 .github/workflows/ci.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 08e1596..c0482dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,36 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  # Dependabot bumps go.sum but not the vendorHash in flake.nix. This pushes
+  # the new one with the App token, and the run that push triggers cancels
+  # this one through the concurrency group above. Workflows Dependabot
+  # triggers read Dependabot secrets only, so both values live there.
+  hash:
+    if: startsWith(github.head_ref, 'dependabot/go_modules/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    timeout-minutes: 30
+    steps:
+      - name: Generate App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.head_ref }}
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v23
+
+      - name: Update Dependency Hash
+        uses: nixos-contrib/nix-update-hash@main
+
   test:
     runs-on: ubuntu-latest
     permissions: