Update ci workflow to regenerate dotnet sdk hashes.

.github/workflows/ci.yml

@@ -9,16 +9,106 @@ permissions:
   contents: read
 
 jobs:
-  nix-deps:
-    name: Regenerate Nix dependency metadata
+  nix-deps-changes:
+    name: Detect Nix dependency changes
     if: |
       github.event_name == 'pull_request' &&
       github.event.pull_request.user.login == 'renovate[bot]' &&
       github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    outputs:
+      dotnet_sdk: ${{ steps.changes.outputs.dotnet_sdk }}
+      nuget: ${{ steps.changes.outputs.nuget }}
+      npm: ${{ steps.changes.outputs.npm }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Determine changed paths
+        id: changes
+        run: |
+          base="${{ github.event.pull_request.base.sha }}"
+          changed_paths="$(git diff --name-only "$base"...HEAD)"
+
+          if grep -qx 'global.json' <<< "$changed_paths"; then
+            echo "dotnet_sdk=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          if grep -qE '(Directory\.Packages\.props|\.csproj$)' <<< "$changed_paths"; then
+            echo "nuget=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          if grep -q 'package-lock.json' <<< "$changed_paths"; then
+            echo "npm=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  dotnet-sdk-hashes:
+    name: Regenerate .NET SDK hash (${{ matrix.system }})
+    needs: [nix-deps-changes]
+    if: needs.nix-deps-changes.outputs.dotnet_sdk == 'true'
+    strategy:
+      matrix:
+        include:
+          - system: x86_64-linux
+            runner: ubuntu-latest
+          - system: aarch64-darwin
+            runner: macos-14
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+
+      - name: Calculate .NET SDK hash
+        env:
+          NIX_SYSTEM: ${{ matrix.system }}
+        run: |
+          set +e
+          nix build ".#devShells.$NIX_SYSTEM.default" --no-link 2>&1 | tee /tmp/dotnet-sdk-build.log
+          build_status="${PIPESTATUS[0]}"
+          set -e
+
+          sdk_hash="$(sed -n 's/.*got:[[:space:]]*\(sha256-[^[:space:]]*\).*/\1/p' /tmp/dotnet-sdk-build.log | tail -1)"
+          if [ -z "$sdk_hash" ] && [ "$build_status" -eq 0 ]; then
+            sdk_hash="$(sed -n "s/.*$NIX_SYSTEM = \"\([^\"]*\)\";.*/\1/p" flake.nix)"
+          fi
+
+          if [ -z "$sdk_hash" ]; then
+            echo "Unable to determine the .NET SDK hash for $NIX_SYSTEM (build exited $build_status)" >&2
+            exit 1
+          fi
+
+          mkdir -p /tmp/dotnet-sdk-hash
+          printf '%s\n' "$sdk_hash" > "/tmp/dotnet-sdk-hash/$NIX_SYSTEM.hash"
+
+      - name: Upload .NET SDK hash
+        uses: actions/upload-artifact@v7
+        with:
+          name: dotnet-sdk-hash-${{ matrix.system }}
+          path: /tmp/dotnet-sdk-hash/*.hash
+
+  nix-deps:
+    name: Regenerate Nix dependency metadata
+    needs: [nix-deps-changes, dotnet-sdk-hashes]
+    if: |
+      always() &&
+      needs.nix-deps-changes.result == 'success'
+    runs-on: ubuntu-latest
     outputs:
       updated: ${{ steps.commit.outputs.updated || 'false' }}
     steps:
+      - name: Verify .NET SDK hash generation
+        if: |
+          needs.nix-deps-changes.outputs.dotnet_sdk == 'true' &&
+          needs.dotnet-sdk-hashes.result != 'success'
+        run: |
+          echo ".NET SDK hash generation did not succeed" >&2
+          exit 1
+
       - name: Generate GitHub App token
         id: not-adam
         uses: adampoit/not-adam@v1
@@ -38,25 +128,29 @@ jobs:
       - name: Enable Nix cache
         uses: DeterminateSystems/magic-nix-cache-action@v14
 
-      - name: Determine changed paths
-        id: changes
-        run: |
-          base="${{ github.event.pull_request.base.sha }}"
-
-          if git diff --name-only "$base"...HEAD | grep -qE '(Directory\.Packages\.props|\.csproj$)'; then
-            echo "nuget=true" >> "$GITHUB_OUTPUT"
-          fi
+      - name: Download .NET SDK hashes
+        if: needs.nix-deps-changes.outputs.dotnet_sdk == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          pattern: dotnet-sdk-hash-*
+          path: /tmp/dotnet-sdk-hashes
+          merge-multiple: true
 
-          if git diff --name-only "$base"...HEAD | grep -q 'package-lock.json'; then
-            echo "npm=true" >> "$GITHUB_OUTPUT"
-          fi
+      - name: Update .NET SDK hashes
+        if: needs.nix-deps-changes.outputs.dotnet_sdk == 'true'
+        run: |
+          for hash_file in /tmp/dotnet-sdk-hashes/*.hash; do
+            system="$(basename "$hash_file" .hash)"
+            sdk_hash="$(cat "$hash_file")"
+            sed -i "s|$system = \"[^\"]*\"|$system = \"$sdk_hash\"|" flake.nix
+          done
 
       - name: Regenerate NuGet dependency hashes
-        if: steps.changes.outputs.nuget == 'true'
+        if: needs.nix-deps-changes.outputs.nuget == 'true'
         run: nix run .#fetch-deps -- ./nix/nuget-deps.json
 
       - name: Regenerate npm dependency hash
-        if: steps.changes.outputs.npm == 'true'
+        if: needs.nix-deps-changes.outputs.npm == 'true'
         run: |
           npm_deps_hash="$(nix run nixpkgs#prefetch-npm-deps -- ./src/MPlusKeybot.Web/package-lock.json)"
           if [ -n "$npm_deps_hash" ]; then
@@ -66,18 +160,19 @@ jobs:
       - name: Commit regenerated dependency metadata
         id: commit
         if: |
-          steps.changes.outputs.nuget == 'true' ||
-          steps.changes.outputs.npm == 'true'
+          needs.nix-deps-changes.outputs.dotnet_sdk == 'true' ||
+          needs.nix-deps-changes.outputs.nuget == 'true' ||
+          needs.nix-deps-changes.outputs.npm == 'true'
         run: |
-          if git diff --quiet -- nix/nuget-deps.json nix/package.nix; then
+          if git diff --quiet -- flake.nix nix/nuget-deps.json nix/package.nix; then
             echo "Nix dependency metadata is already up to date"
             echo "updated=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
           git config user.name "renovate[bot]"
           git config user.email "29139614+renovate[bot]@users.noreply.github.com"
-          git add nix/nuget-deps.json nix/package.nix
+          git add flake.nix nix/nuget-deps.json nix/package.nix
           git commit -m "Regenerate Nix dependency metadata"
           git push
           echo "updated=true" >> "$GITHUB_OUTPUT"