update.yml

name: Update Lean toolchain and pinned deps

on:
  schedule:
    - cron: "0 12 * * *"
      timezone: America/New_York
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  update:
    runs-on: ubuntu-latest
    steps:
      # create-pull-request takes its base from the checked-out branch, and the
      # action passes no `base` of its own, so this is what points the update PR
      # at `dev`. `dev` is already the default branch; naming it keeps the PR
      # off `master`, which only mirrors digama0/lean4lean (see repo-sync.yml)
      # and would discard the commit on its next force-sync.
      - uses: actions/checkout@v7
        with:
          ref: dev

      # `update_lean4_nix` below runs `nix flake update`
      - uses: cachix/install-nix-action@v31
        with:
          github_access_token: ${{ github.token }}

      # `dev` carries the fork's bump_mode/release_channel support and the
      # lean4-nix gating; `main` only mirrors upstream, which silently ignores
      # these inputs. `pinned-tags` suits this package: batteries is pinned to
      # a Lean version tag rather than tracking a branch, so its `rev` moves
      # with the toolchain; a dependency pinned to a commit hash is reported
      # and left alone. A PR is opened on an update/lean-{release} branch
      # whether or not the build passes, so an incompatible release shows up
      # as a failing PR to review -- expected here, where a toolchain bump can
      # break the kernel internals this package mirrors.
      #
      # flake.nix resolves the toolchain from `lean-toolchain` through
      # lean4-nix's vendored release table, so nix.yml fails at evaluation on
      # a release that table has not recorded yet. `update_lean4_nix` defers
      # the update until lean4-nix's default branch carries the release, then
      # bumps the `lean4-nix` flake input in the same PR.
      #
      # The PR is opened with `GITHUB_TOKEN`, so it does not start CI on its
      # own; push to it or close and reopen it to run the checks.
      - uses: argumentcomputer/lean-update@dev
        with:
          bump_mode: pinned-tags
          on_update_fails: pr
          update_lean4_nix: true