ci: summarizing the differences of nix packages between flake.lock

.github/workflows/pr.yml

@@ -0,0 +1,86 @@
+name: Pull Request
+permissions:
+  pull-requests: write
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/**
+      - "**.nix"
+      - "flake.lock"
+
+jobs:
+  build:
+    if: github.event.pull_request.draft == false
+    name: "Build ${{ matrix.target }}"
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: william
+          - os: ubuntu-latest
+            target: synopc
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install nix
+        uses: cachix/install-nix-action@v25
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.17.1/install
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            accept-flake-config = true
+
+      - uses: cachix/cachix-action@v14
+        with:
+          name: edeneast
+          skipPush: true
+          extraPullNames: nix-community
+
+      - name: Garbage collect build dependencies
+        run: nix-collect-garbage
+
+      - name: Fetch old system profile
+        run: nix build github:WilliamHsieh/dotfiles#top.${{ matrix.target }} -v --log-format raw --profile ./old-profile
+
+      - name: Add new system to profile
+        run: |
+          set -o pipefail
+          nix build .#top.${{ matrix.target }} --profile ./new-profile --show-trace --fallback -v --log-format raw > >(tee stdout.log) 2> >(tee /tmp/nix-build-err.log >&2)
+
+      - name: Output build failure
+        if: failure()
+        run: |
+          drv=$(grep "For full logs, run" /tmp/nix-build-err.log | grep -oE "/nix/store/.*.drv")
+          if [ -n $drv ]; then
+            nix log $drv
+            echo $drv
+          fi
+          exit 1
+
+      - name: Diff profile
+        id: diff
+        run: |
+          echo "diff<<EOF" >> "${GITHUB_OUTPUT}"
+          nix run nixpkgs#nvd diff ./old-profile ./new-profile >> "${GITHUB_OUTPUT}"
+          echo "EOF" >> "${GITHUB_OUTPUT}"
+
+      - name: Comment report in pr
+        uses: marocchino/sticky-pull-request-comment@v2
+        if: ${{ !startswith(github.ref, 'dependabot') }}
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          header: ".#top.${{ matrix.target }}"
+          message: |
+            ### Report for `${{ matrix.target }}`
+
+            <details>
+            <summary> Version changes </summary> <br>
+            <pre> ${{ steps.diff.outputs.diff }} </pre>
+            </details>