Merge remote-tracking branch 'upstream/main'

.github/workflows/bump.yaml

@@ -0,0 +1,29 @@
+name: bump
+on:
+  workflow_dispatch:
+  schedule:
+  - cron: '45 6 * * 6'
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+jobs:
+  bump-pr:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: DeterminateSystems/nix-installer-action@main
+      with:
+        extra-conf: |
+          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+    - uses: DeterminateSystems/magic-nix-cache-action@main
+    - uses: cachix/cachix-action@v14
+      with:
+        name: tek
+        signingKey: ${{ secrets.CACHIX_SIGNING_KEY }}
+    - id: bounds
+      run: nix run .#bump -- --output=ga-pr --build-timeout=3600
+    - name: pr
+      if: steps.bounds.outputs.commit-message
+      uses: peter-evans/create-pull-request@v5
+      with: ${{ steps.bounds.outputs }}

.github/workflows/check.yaml

@@ -0,0 +1,22 @@
+name: Flake checks
+on: [push, pull_request]
+permissions:
+  contents: read
+  id-token: write
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            extra-substituters = https://tek.cachix.org
+            extra-trusted-public-keys = tek.cachix.org-1:+sdc73WFq8aEKnrVv5j/kuhmnW2hQJuqdPJF5SnaCBk=
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: cachix/cachix-action@v14
+        with:
+          name: tek
+          signingKey: ${{ secrets.CACHIX_SIGNING_KEY }}
+      - run: nix flake check

.github/workflows/lower-init.yaml

@@ -0,0 +1,26 @@
+name: lower-init
+on: workflow_dispatch
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+jobs:
+  lower-pr:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: DeterminateSystems/nix-installer-action@main
+      with:
+        extra-conf: |
+          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+    - uses: DeterminateSystems/magic-nix-cache-action@main
+    - uses: cachix/cachix-action@v14
+      with:
+        name: tek
+        signingKey: ${{ secrets.CACHIX_SIGNING_KEY }}
+    - id: bounds
+      run: nix run .#lower.init -- --output=ga-pr --build-timeout=3600
+    - name: pr
+      if: steps.bounds.outputs.commit-message
+      uses: peter-evans/create-pull-request@v5
+      with: ${{ steps.bounds.outputs }}

.github/workflows/lower-optimize.yaml

@@ -0,0 +1,26 @@
+name: lower-optimize
+on: workflow_dispatch
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+jobs:
+  lower-pr:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: DeterminateSystems/nix-installer-action@main
+      with:
+        extra-conf: |
+          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+    - uses: DeterminateSystems/magic-nix-cache-action@main
+    - uses: cachix/cachix-action@v14
+      with:
+        name: tek
+        signingKey: ${{ secrets.CACHIX_SIGNING_KEY }}
+    - id: bounds
+      run: nix run .#lower.optimize -- --output=ga-pr --build-timeout=3600
+    - name: pr
+      if: steps.bounds.outputs.commit-message
+      uses: peter-evans/create-pull-request@v5
+      with: ${{ steps.bounds.outputs }}

.github/workflows/lower.yaml

@@ -0,0 +1,26 @@
+name: lower
+on: [workflow_dispatch, pull_request, push]
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+jobs:
+  lower-pr:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: DeterminateSystems/nix-installer-action@main
+      with:
+        extra-conf: |
+          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+    - uses: DeterminateSystems/magic-nix-cache-action@main
+    - uses: cachix/cachix-action@v14
+      with:
+        name: tek
+        signingKey: ${{ secrets.CACHIX_SIGNING_KEY }}
+    - id: bounds
+      run: nix run .#lower -- --output=ga-pr --build-timeout=3600
+    - name: pr
+      if: steps.bounds.outputs.commit-message
+      uses: peter-evans/create-pull-request@v5
+      with: ${{ steps.bounds.outputs }}