nixpkgs/overlays/mods/update.sh

#!/usr/bin/env nix-shell
#!nix-shell --pure -i bash -p bash curl jq nix nix-prefetch cacert git
# shellcheck shell=bash
set -euo pipefail

# Update the n8n overlay (overlays/mods/n8n.nix) to the latest stable GitHub
# release of n8n-io/n8n.
#
# This is a self-contained updater (not nix-update), because the overlay file
# is a `prev.n8n.overrideAttrs` form rather than a standalone derivation and
# the test suite (tests/n8n-overlay-test.nix) explicitly forbids exporting a
# local n8n package. The CI workflow discovers and runs this script directly.
#
# What it does, in order:
#   1. Fetch latest stable (non-prerelease) tag from the GitHub API
#   2. Strip the `n8n@` prefix → version
#   3. Compare to the version pinned in overlays/mods/n8n.nix
#   4. Compute new src hash (fetchFromGitHub tarball) via nix-prefetch-url
#   5. Compute new pnpmDeps hash via the fake-hash trick
#   6. Sync tests/n8n-overlay-test.nix expectations (version + both hashes)
#   7. Verify evaluation + test expectations, then commit

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
NIX_FILE="$SCRIPT_DIR/n8n.nix"
TEST_FILE="$SCRIPT_DIR/../../tests/n8n-overlay-test.nix"
NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)

# A literal SRI sentinel (equal to lib.fakeHash). We write the literal rather
# than `lib.fakeHash` so we don't depend on `lib` being in scope inside
# n8n.nix — the overlay is imported with just `{ prev = pkgs; }`, so `lib`
# is not bound there.
FAKE_HASH='sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='

if [[ -z "$NIXPKGS_ROOT" ]]; then
	echo "ERROR: could not locate the git checkout root from $SCRIPT_DIR." >&2
	echo "       The updater needs the flake context (flake.lock nixpkgs pin)." >&2
	exit 1
fi

# The `nix build/eval --expr` calls below resolve `./` against the current
# working directory, not against this script — always run from the repo root.
cd "$NIXPKGS_ROOT"

# Snapshot the current n8n.nix (and the test expectations) so we can restore
# them if anything goes wrong (error, SIGINT, SIGTERM, or a killed build) —
# otherwise a failed/aborted run leaves a stale version bump and/or the
# fake-hash sentinel behind. Restoring from the snapshots (rather than
# `git checkout`) also preserves any pre-existing working-tree edits the user
# may have made. The trap is disarmed once we reach a successful commit.
RESTORE_FILE="$(mktemp)"
TEST_RESTORE_FILE="$(mktemp)"
cp "$NIX_FILE" "$RESTORE_FILE"
if [[ -f "$TEST_FILE" ]]; then
	cp "$TEST_FILE" "$TEST_RESTORE_FILE"
else
	: >"$TEST_RESTORE_FILE"
fi
restore_on_failure() {
	if [[ -z "${UPDATE_SUCCEEDED:-}" ]]; then
		cp -f "$RESTORE_FILE" "$NIX_FILE" 2>/dev/null || true
		if [[ -s "$TEST_RESTORE_FILE" ]]; then
			cp -f "$TEST_RESTORE_FILE" "$TEST_FILE" 2>/dev/null || true
		fi
	fi
	rm -f "$RESTORE_FILE" "$TEST_RESTORE_FILE"
}
trap restore_on_failure EXIT

REPO="n8n-io/n8n"
TAG_PREFIX="n8n@"

# ── 1. Latest stable release ───────────────────────────────────────────────
echo "Fetching latest stable release of $REPO ..."
LATEST_TAG=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" |
	jq -r 'select(.prerelease == false) | .tag_name')

if [[ -z "$LATEST_TAG" ]]; then
	echo "ERROR: No stable release found for $REPO" >&2
	exit 1
fi

VERSION="${LATEST_TAG#"${TAG_PREFIX}"}"
echo "Latest version: $VERSION"

# ── 2. Current version from the nix file ───────────────────────────────────
CURRENT=$(awk '
  /^[[:space:]]*version = "/ {
    gsub(/^[[:space:]]*version = "/, "")
    gsub(/".*/, "")
    print
    exit
  }
' "$NIX_FILE")
echo "Current version: $CURRENT"

if grep -q "$FAKE_HASH" "$NIX_FILE"; then
	echo "ERROR: $NIX_FILE already contains the fake-hash sentinel." >&2
	echo "       A previous update run was interrupted before it could restore." >&2
	echo "       Fix up the file first (git diff / git checkout -- overlays/mods/n8n.nix)." >&2
	exit 1
fi

if [[ "$VERSION" == "$CURRENT" ]]; then
	echo "Already at latest version, nothing to do."
	exit 0
fi

echo "==> Updating n8n $CURRENT -> $VERSION"

# ── 3. Bump version in the file ────────────────────────────────────────────
sed -i "s|^\([[:space:]]*\)version = \"[^\"]*\";|\1version = \"$VERSION\";|" "$NIX_FILE"

# ── 4. Compute and apply src hash ──────────────────────────────────────────
echo "==> Computing src hash ..."
SRC_URL="https://github.com/$REPO/archive/refs/tags/${TAG_PREFIX}${VERSION}.tar.gz"
# `--name n8n-source` works around the `@` in the upstream tag name
# (nix-prefetch-url refuses filenames containing `@`).
SRC_HASH=$(nix-prefetch-url --unpack --type sha256 --name n8n-source "$SRC_URL" 2>/dev/null)
SRC_SRI=$(nix hash convert --hash-algo sha256 --to sri "$SRC_HASH")
echo "    src hash: $SRC_SRI"

# Replace the FIRST `hash = "sha256-...";` occurrence (the src block sits above pnpmDeps)
awk -v sri="$SRC_SRI" '
  !src_done && /^[[:space:]]*hash = "sha256-/ {
    sub(/"sha256-[A-Za-z0-9+/=]+"/, "\"" sri "\"")
    src_done = 1
  }
  { print }
' "$NIX_FILE" >"$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"

# ── 5. Compute pnpmDeps hash via the fake-hash trick ───────────────────────
echo "==> Computing pnpmDeps hash (this may take a while) ..."

# 5a. Temporarily set the pnpmDeps hash to the fake sentinel.
awk -v fake="\"$FAKE_HASH\"" '
  !pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
  pnpm_started && !pnpm_done && /^[[:space:]]*hash = "sha256-/ {
    sub(/"sha256-[A-Za-z0-9+/=]+"/, fake)
    pnpm_done = 1
  }
  { print }
' "$NIX_FILE" >"$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"

# 5b. Evaluate n8nModified.pnpmDeps — fixed-output derivation with a wrong hash
#     will fail and print the correct hash in the "got:" line.
NIX_EXPR="(let
    flake = builtins.getFlake (toString ./.);
    pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
    n8nModified = import ./overlays/mods/n8n.nix { prev = pkgs; };
  in n8nModified.pnpmDeps)"

BUILD_OUTPUT=$(nix build --impure --no-link --expr "$NIX_EXPR" 2>&1 || true)

# Hash mismatch errors list two sha256 values: the fake sentinel (all A's) as
# "specified"/"Expected" and the correct one as "got:"/"Got:". Different nix
# versions label/capitalise differently, so filter out the sentinel and take
# whatever real sha256 remains.
PNPM_HASH=$(echo "$BUILD_OUTPUT" |
	grep -oE 'sha256-[A-Za-z0-9+/=]+' |
	grep -v 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' |
	tail -1)

if [[ -z "$PNPM_HASH" ]]; then
	echo "ERROR: could not extract a pnpmDeps hash from the build output." >&2
	if grep -q 'ERR_PNPM_UNSUPPORTED_ENGINE' <<<"$BUILD_OUTPUT"; then
		echo "       Cause: upstream n8n demands a newer pnpm than the pinned nixpkgs" >&2
		echo "       ships (engines.pnpm gate). Check the relaxPnpmEngine workaround," >&2
		echo "       the pnpm major and fetcherVersion in $NIX_FILE." >&2
	elif grep -q 'ERR_PNPM_LOCKFILE_CONFIG_MISMATCH' <<<"$BUILD_OUTPUT"; then
		echo "       Cause: the pinned pnpm cannot parse upstream's pnpm-lock.yaml" >&2
		echo "       anymore (lockfile serialisation changed across pnpm majors)." >&2
		echo "       Bump the pnpm major and fetcherVersion in $NIX_FILE." >&2
	else
		echo "       This usually means fetchPnpmDeps failed for a reason OTHER than" >&2
		echo "       a hash mismatch (e.g. a pnpm-lock patch in n8n.nix no longer applies," >&2
		echo "       a tarball vanished, or the build was interrupted). Full output:" >&2
	fi
	echo "$BUILD_OUTPUT" >&2
	echo "Restoring n8n.nix via the EXIT trap." >&2
	exit 1
fi

echo "    pnpmDeps hash: $PNPM_HASH"

# 5c. Replace the fake sentinel with the real hash. The sentinel only appears
#     in the pnpmDeps block (the src hash was already updated in step 4), so a
#     plain literal substitution is sufficient.
sed -i "s|$FAKE_HASH|$PNPM_HASH|" "$NIX_FILE"

# 5d. Keep the overlay test expectations (tests/n8n-overlay-test.nix) in sync —
#     they pin version + both hashes and are evaluated by `nix flake check`.
if [[ -f "$TEST_FILE" ]]; then
	sed -i \
		-e "s|expectedVersion = \"[^\"]*\"|expectedVersion = \"$VERSION\"|" \
		-e "s|expectedSrcHash = \"sha256-[A-Za-z0-9+/=]*\"|expectedSrcHash = \"$SRC_SRI\"|" \
		-e "s|expectedPnpmHash = \"sha256-[A-Za-z0-9+/=]*\"|expectedPnpmHash = \"$PNPM_HASH\"|" \
		"$TEST_FILE"
fi

# ── 6. Verify the file parses and commit ───────────────────────────────────
echo "==> Verifying nix evaluation ..."
if ! nix eval --impure --expr "
  let
    flake = builtins.getFlake (toString ./.);
    pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
  in (import ./overlays/mods/n8n.nix { prev = pkgs; }).version
" >/dev/null 2>&1; then
	echo "ERROR: nix evaluation failed after update; restoring n8n.nix via the EXIT trap." >&2
	exit 1
fi

# The overlay test pins version + hashes and runs as part of `nix flake check`;
# make sure its expectations actually match the updated overlay before committing.
if [[ -f "$TEST_FILE" ]] &&
	! nix eval --impure --no-warn-dirty --expr "
  let
    flake = builtins.getFlake (toString ./.);
    check = flake.checks.\${builtins.currentSystem}.n8n-overlay or null;
  in if check == null then null else check.drvPath
" >/dev/null 2>&1; then
	echo "ERROR: tests/n8n-overlay-test.nix expectations do not match the updated" >&2
	echo "       overlay — restoring files via the EXIT trap." >&2
	exit 1
fi

if [[ -n "$NIXPKGS_ROOT" ]] &&
	[[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE" "$TEST_FILE")" ]]; then
	git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
	[[ -f "$TEST_FILE" ]] && git -C "$NIXPKGS_ROOT" add "$TEST_FILE"
	git -C "$NIXPKGS_ROOT" commit -m "n8n: $CURRENT -> $VERSION"
	echo "==> Committed"
fi

UPDATE_SUCCEEDED=1
echo "==> Done"