ci: add update workflow

.github/workflows/build.yaml

@@ -13,15 +13,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v27
+      - uses: DeterminateSystems/nix-installer-action@main
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          extra-conf: |
             accept-flake-config = true
-      - uses: DeterminateSystems/magic-nix-cache-action@v7
-      - uses: cachix/cachix-action@v15
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: cachix/cachix-action@master
         with:
           name: sunziping2016
           # Create a personal auth token from https://app.cachix.org/personal-auth-tokens,
@@ -34,13 +32,3 @@ jobs:
         run: nix flake show --all-systems
       - name: Run nix flake check
         run: nix flake check --all-systems
-      - name: Run nix build
-        run: |
-          set -euo pipefail
-          IFS=$'\n'
-          system="$(nix eval --impure --raw  --expr "builtins.currentSystem")"
-          checks="$(nix eval --json ".#checks.\"$system\"" --apply builtins.attrNames)"
-          for check in $(echo "$checks" | jq -r '.[]'); do
-            echo "> Building .#checks.\"$system\".\"$check\""
-            nix build -L ".#checks.\"$system\".\"$check\""
-          done

.github/workflows/update-flake.yaml

@@ -0,0 +1,23 @@
+name: "Update flake.lock"
+on:
+  workflow_dispatch:
+  schedule:
+    # every day 00:00 +08:00
+    - cron: "0 16 * * *"
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          extra-conf: |
+            accept-flake-config = true
+      - name: Update flake.lock
+        uses: DeterminateSystems/update-flake-lock@main
+        with:
+          pr-title: "Update flake.lock"
+          pr-labels: dependencies
+            automated