From aa5bdb87470b2a1e4b62845123f024e1fe55a2bd Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Mon, 26 May 2025 12:43:52 -0700
Subject: [PATCH] dependabot-cli: add update script which updates the
 withDockerImages variant

---
 pkgs/by-name/de/dependabot-cli/package.nix |  2 +
 pkgs/by-name/de/dependabot-cli/update.sh   | 48 ++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100755 pkgs/by-name/de/dependabot-cli/update.sh

diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix
index 4d04b29dd1b2..f7d225bd8004 100644
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@@ -79,6 +79,8 @@ buildGoModule {
     $out/bin/dependabot --help
   '';
 
+  passthru.updateScript = ./update.sh;
+
   passthru.withDockerImages = symlinkJoin {
     name = "dependabot-cli-with-docker-images";
     paths = [ dependabot-cli ];
diff --git a/pkgs/by-name/de/dependabot-cli/update.sh b/pkgs/by-name/de/dependabot-cli/update.sh
new file mode 100755
index 000000000000..a01d0accfa32
--- /dev/null
+++ b/pkgs/by-name/de/dependabot-cli/update.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep gnused jq gh nix-prefetch-docker nix gitMinimal
+
+set -x -eu -o pipefail
+
+cd $(dirname "${BASH_SOURCE[0]}")
+
+NIXPKGS_PATH="$(git rev-parse --show-toplevel)"
+
+temp_dir=$(mktemp -d)
+trap 'rm -rf "$temp_dir"' EXIT
+
+gh api repos/dependabot/cli/releases/latest > "$temp_dir/latest.json"
+
+VERSION="$(jq -r .tag_name "$temp_dir/latest.json" | sed 's/^v//')"
+OLD_VERSION="$(grep -m1 'version = "' ./package.nix | cut -d'"' -f2)"
+
+if [ "$OLD_VERSION" = "$VERSION" ]; then
+  echo "dependabot is already up-to-date at $OLD_VERSION"
+  exit 0
+fi
+
+SHA256="$(nix-prefetch-url --quiet --unpack https://github.com/dependabot/cli/archive/refs/tags/v${VERSION}.tar.gz)"
+HASH="$(nix hash convert --hash-algo sha256 --to sri "$SHA256")"
+
+nix-prefetch-docker --json --quiet --final-image-name dependabot-update-job-proxy --final-image-tag "nixpkgs-dependabot-cli-$VERSION" ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy latest > "$temp_dir/dependabot-update-job-proxy.json"
+
+nix-prefetch-docker --json --quiet --final-image-name dependabot-updater-github-actions --final-image-tag "nixpkgs-dependabot-cli-$VERSION" ghcr.io/dependabot/dependabot-updater-github-actions latest > "$temp_dir/dependabot-updater-github-actions.json"
+
+setKV () {
+    sed -i "s,$1 = \"[^v].*\",$1 = \"${2:-}\"," ./package.nix
+}
+
+setKV version "${VERSION}"
+setKV hash "${HASH}"
+setKV updateJobProxy.imageDigest "$(jq -r .imageDigest "$temp_dir/dependabot-update-job-proxy.json")"
+setKV updateJobProxy.hash "$(jq -r .hash "$temp_dir/dependabot-update-job-proxy.json")"
+setKV updaterGitHubActions.imageDigest "$(jq -r .imageDigest "$temp_dir/dependabot-updater-github-actions.json")"
+setKV updaterGitHubActions.hash "$(jq -r .hash "$temp_dir/dependabot-updater-github-actions.json")"
+
+# We need to figure out the vendorHash for this new version, so we initially set it to `lib.fakeHash`
+FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+setKV vendorHash "$FAKE_HASH"
+
+set +e
+VENDOR_HASH="$(nix-build --no-out-link --log-format internal-json -A dependabot-cli "$NIXPKGS_PATH" 2>&1 >/dev/null | grep "$FAKE_HASH" | grep -o "sha256-[^\\]*" | tail -1)"
+set -e
+setKV vendorHash "$VENDOR_HASH"