ci: improve update-flake job to handle retriggering ci and human authors

matifali · matifali · commit c15cf47b9b1a · 2024-07-30T11:24:47.000+03:00
Improves #14046 Solved the CI stuck issue exhibited in - #14039 - #14040 - #14041 - #14044
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -121,26 +121,31 @@ jobs:
     needs: changes
     if: needs.changes.outputs.gomod == 'true'
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
-    permissions:
-      # Give the default GITHUB_TOKEN write permission to commit and push the changed files back to the repository.
-      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          token: ${{ secrets.CDRCI_GITHUB_TOKEN }}
 
       - name: Setup Go
         uses: ./.github/actions/setup-go
 
       - name: Update Nix Flake SRI Hash
         run: ./scripts/update-flake.sh
 
+        # auto update flake for dependabot
       - uses: stefanzweifel/git-auto-commit-action@v5
+        if: github.actor == 'dependabot[bot]'
         with:
           # Allows dependabot to still rebase!
           commit_message: "[dependabot skip] Update Nix Flake SRI Hash"
 
+        # check for other PRs
+      - name: Ensure No Changes
+        if: github.actor != 'dependabot[bot]'
+        run: git diff --exit-code
+
   lint:
     needs: changes
     if: needs.changes.outputs.offlinedocs-only == 'false' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
