Files
neovim/.github/workflows/vim_patches.yml
Daniel Hast 755087f8ef ci: set default permissions for workflows
The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions
2026-03-09 21:36:20 -04:00

63 lines
1.9 KiB
YAML

name: vim-patches
on:
schedule:
- cron: '3 3 * * *'
workflow_dispatch:
permissions: {}
jobs:
update-vim-patches:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
env:
VIM_SOURCE_DIR: ${{ github.workspace }}/vim-src
VERSION_BRANCH: marvim/ci-version-update
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/checkout@v6
with:
repository: vim/vim
path: ${{ env.VIM_SOURCE_DIR }}
fetch-depth: 0
persist-credentials: false
- run: sudo apt-get install libfuse2
- run: |
gh release download -R neovim/neovim -p nvim-linux-x86_64.appimage
chmod a+x nvim-linux-x86_64.appimage
mkdir -p $HOME/.local/bin
mv nvim-linux-x86_64.appimage $HOME/.local/bin/nvim
printf '%s\n' "$HOME/.local/bin" >> $GITHUB_PATH
- name: Set up git config
run: |
git config --global user.name 'marvim'
git config --global user.email 'marvim@users.noreply.github.com'
- name: Update src/version.c
id: update-version
run: |
git checkout -b ${VERSION_BRANCH}
nvim -l scripts/vimpatch.lua
printf 'NEW_PATCHES=%s\n' $([ -z "$(git diff)" ]; echo $?) >> $GITHUB_OUTPUT
- name: Automatic PR
if: ${{ steps.update-version.outputs.NEW_PATCHES != 0 }}
run: |
git add -u
TMP_FILE=$(mktemp)
printf 'docs: update version.c\n\n' > ${TMP_FILE}
bash scripts/vim-patch.sh -n >> ${TMP_FILE}
git commit -F ${TMP_FILE}
git push --force https://${GITHUB_ACTOR}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY} ${VERSION_BRANCH}
gh pr create --draft --fill --label vim-patch --base ${GITHUB_REF#refs/heads/} --head ${VERSION_BRANCH} || true