m3tam3re
8d9b0cf742
n8n 2.32 replaced the sheetjs-CDN xlsx@0.20.2 tarball (which lacked an integrity checksum and had to be patched into pnpm-lock.yaml) with the regular npm package @e965/xlsx@0.20.3, which already carries an integrity field. The patchXlsxLockfile workaround is therefore obsolete and actively harmful: substituteInPlace --replace-fail no longer matches, making fetchPnpmDeps fail with a build error (not a hash mismatch), which left the fake-hash sentinel behind in n8n.nix on update. - overlays/mods/n8n.nix: remove xlsx workaround; bump to 2.32.6 with real src (sha256-wWm6...) and pnpmDeps (sha256-QzUJCF+...) hashes. - tests/n8n-overlay-test.nix: update expectations to 2.32.6; drop the obsolete checkXlsxIntegrityPatch. - overlays/mods/update.sh: use a literal SRI sentinel instead of lib.fakeHash (lib is not in scope inside the {prev}: overlay); add a snapshot-based EXIT trap that restores n8n.nix on any failure (error/SIGINT/SIGTERM/killed build) while preserving pre-existing working-tree edits; surface a clearer message when fetchPnpmDeps fails for a non-hash reason.
173 lines
7.1 KiB
Bash
Executable File
173 lines
7.1 KiB
Bash
Executable File
#!/usr/bin/env nix-shell
|
|
#!nix-shell --pure -i bash -p bash curl jq nix nix-prefetch cacert git
|
|
# shellcheck shell=bash
|
|
set -euo pipefail
|
|
|
|
# Update the n8n overlay (overlays/mods/n8n.nix) to the latest stable GitHub
|
|
# release of n8n-io/n8n.
|
|
#
|
|
# This is a self-contained updater (not nix-update), because the overlay file
|
|
# is a `prev.n8n.overrideAttrs` form rather than a standalone derivation and
|
|
# the test suite (tests/n8n-overlay-test.nix) explicitly forbids exporting a
|
|
# local n8n package. The CI workflow discovers and runs this script directly.
|
|
#
|
|
# What it does, in order:
|
|
# 1. Fetch latest stable (non-prerelease) tag from the GitHub API
|
|
# 2. Strip the `n8n@` prefix → version
|
|
# 3. Compare to the version pinned in overlays/mods/n8n.nix
|
|
# 4. Compute new src hash (fetchFromGitHub tarball) via nix-prefetch-url
|
|
# 5. Compute new pnpmDeps hash via the fake-hash trick
|
|
# 6. Commit
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
NIX_FILE="$SCRIPT_DIR/n8n.nix"
|
|
NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
|
|
|
|
# Snapshot the current n8n.nix so we can restore it if anything goes wrong
|
|
# (error, SIGINT, SIGTERM, or a killed build) — otherwise a failed/aborted run
|
|
# leaves a stale version bump and/or the fake-hash sentinel behind. Restoring
|
|
# from the snapshot (rather than `git checkout`) also preserves any
|
|
# pre-existing working-tree edits the user may have made. The trap is disarmed
|
|
# once we reach a successful commit.
|
|
RESTORE_FILE="$(mktemp)"
|
|
cp "$NIX_FILE" "$RESTORE_FILE"
|
|
restore_on_failure() {
|
|
if [[ -z "${UPDATE_SUCCEEDED:-}" ]]; then
|
|
cp -f "$RESTORE_FILE" "$NIX_FILE" 2>/dev/null || true
|
|
fi
|
|
rm -f "$RESTORE_FILE"
|
|
}
|
|
trap restore_on_failure EXIT
|
|
|
|
REPO="n8n-io/n8n"
|
|
TAG_PREFIX="n8n@"
|
|
|
|
# ── 1. Latest stable release ───────────────────────────────────────────────
|
|
echo "Fetching latest stable release of $REPO ..."
|
|
LATEST_TAG=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" |
|
|
jq -r 'select(.prerelease == false) | .tag_name')
|
|
|
|
if [[ -z "$LATEST_TAG" ]]; then
|
|
echo "ERROR: No stable release found for $REPO" >&2
|
|
exit 1
|
|
fi
|
|
|
|
VERSION="${LATEST_TAG#"${TAG_PREFIX}"}"
|
|
echo "Latest version: $VERSION"
|
|
|
|
# ── 2. Current version from the nix file ───────────────────────────────────
|
|
CURRENT=$(awk '
|
|
/^[[:space:]]*version = "/ {
|
|
gsub(/^[[:space:]]*version = "/, "")
|
|
gsub(/".*/, "")
|
|
print
|
|
exit
|
|
}
|
|
' "$NIX_FILE")
|
|
echo "Current version: $CURRENT"
|
|
|
|
if [[ "$VERSION" == "$CURRENT" ]]; then
|
|
echo "Already at latest version, nothing to do."
|
|
exit 0
|
|
fi
|
|
|
|
echo "==> Updating n8n $CURRENT -> $VERSION"
|
|
|
|
# ── 3. Bump version in the file ────────────────────────────────────────────
|
|
sed -i "s|^\([[:space:]]*\)version = \"[^\"]*\";|\1version = \"$VERSION\";|" "$NIX_FILE"
|
|
|
|
# ── 4. Compute and apply src hash ──────────────────────────────────────────
|
|
echo "==> Computing src hash ..."
|
|
SRC_URL="https://github.com/$REPO/archive/refs/tags/${TAG_PREFIX}${VERSION}.tar.gz"
|
|
# `--name n8n-source` works around the `@` in the upstream tag name
|
|
# (nix-prefetch-url refuses filenames containing `@`).
|
|
SRC_HASH=$(nix-prefetch-url --unpack --type sha256 --name n8n-source "$SRC_URL" 2>/dev/null)
|
|
SRC_SRI=$(nix hash convert --hash-algo sha256 --to sri "$SRC_HASH")
|
|
echo " src hash: $SRC_SRI"
|
|
|
|
# Replace the FIRST `hash = "sha256-...";` occurrence (the src block sits above pnpmDeps)
|
|
awk -v sri="$SRC_SRI" '
|
|
!src_done && /^[[:space:]]*hash = "sha256-/ {
|
|
sub(/"sha256-[A-Za-z0-9+/=]+"/, "\"" sri "\"")
|
|
src_done = 1
|
|
}
|
|
{ print }
|
|
' "$NIX_FILE" >"$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
|
|
|
|
# ── 5. Compute pnpmDeps hash via the fake-hash trick ───────────────────────
|
|
echo "==> Computing pnpmDeps hash (this may take a while) ..."
|
|
|
|
# A literal SRI sentinel (equal to lib.fakeHash). We write the literal rather
|
|
# than `lib.fakeHash` so we don't depend on `lib` being in scope inside
|
|
# n8n.nix — the overlay is imported with just `{ prev = pkgs; }`, so `lib`
|
|
# is not bound there.
|
|
FAKE_HASH='sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
|
|
|
|
# 5a. Temporarily set the pnpmDeps hash to the fake sentinel.
|
|
awk -v fake="\"$FAKE_HASH\"" '
|
|
!pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
|
|
pnpm_started && !pnpm_done && /^[[:space:]]*hash = "sha256-/ {
|
|
sub(/"sha256-[A-Za-z0-9+/=]+"/, fake)
|
|
pnpm_done = 1
|
|
}
|
|
{ print }
|
|
' "$NIX_FILE" >"$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
|
|
|
|
# 5b. Evaluate n8nModified.pnpmDeps — fixed-output derivation with a wrong hash
|
|
# will fail and print the correct hash in the "got:" line.
|
|
NIX_EXPR="(let
|
|
flake = builtins.getFlake (toString ./.);
|
|
pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
|
|
n8nModified = import ./overlays/mods/n8n.nix { prev = pkgs; };
|
|
in n8nModified.pnpmDeps)"
|
|
|
|
BUILD_OUTPUT=$(nix build --impure --no-link --expr "$NIX_EXPR" 2>&1 || true)
|
|
|
|
# Hash mismatch errors list two sha256 values: the fake sentinel (all A's) as
|
|
# "specified"/"Expected" and the correct one as "got:"/"Got:". Different nix
|
|
# versions label/capitalise differently, so filter out the sentinel and take
|
|
# whatever real sha256 remains.
|
|
PNPM_HASH=$(echo "$BUILD_OUTPUT" |
|
|
grep -oE 'sha256-[A-Za-z0-9+/=]+' |
|
|
grep -v 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' |
|
|
tail -1)
|
|
|
|
if [[ -z "$PNPM_HASH" ]]; then
|
|
echo "ERROR: could not extract a pnpmDeps hash from the build output." >&2
|
|
echo " This usually means fetchPnpmDeps failed for a reason OTHER than" >&2
|
|
echo " a hash mismatch (e.g. a pnpm-lock patch in n8n.nix no longer applies," >&2
|
|
echo " a tarball vanished, or the build was interrupted). Full output:" >&2
|
|
echo "$BUILD_OUTPUT" >&2
|
|
echo "Restoring n8n.nix via the EXIT trap." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo " pnpmDeps hash: $PNPM_HASH"
|
|
|
|
# 5c. Replace the fake sentinel with the real hash. The sentinel only appears
|
|
# in the pnpmDeps block (the src hash was already updated in step 4), so a
|
|
# plain literal substitution is sufficient.
|
|
sed -i "s|$FAKE_HASH|$PNPM_HASH|" "$NIX_FILE"
|
|
|
|
# ── 6. Verify the file parses and commit ───────────────────────────────────
|
|
echo "==> Verifying nix evaluation ..."
|
|
if ! nix eval --impure --expr "
|
|
let
|
|
flake = builtins.getFlake (toString ./.);
|
|
pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
|
|
in (import ./overlays/mods/n8n.nix { prev = pkgs; }).version
|
|
" >/dev/null 2>&1; then
|
|
echo "ERROR: nix evaluation failed after update; restoring n8n.nix via the EXIT trap." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -n "$NIXPKGS_ROOT" ]] &&
|
|
[[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
|
|
git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
|
|
git -C "$NIXPKGS_ROOT" commit -m "n8n: $CURRENT -> $VERSION"
|
|
echo "==> Committed"
|
|
fi
|
|
|
|
UPDATE_SUCCEEDED=1
|
|
echo "==> Done"
|