update-scripts: move update logic from CI to dedicated script

update-scripts/default.nix

@@ -9,6 +9,8 @@ lib.fix (self: {
   default = self.generate;
   generate = lib.callPackageWith (pkgs // self) ./generate.nix { };
 
+  update = lib.callPackageWith (pkgs // self) ./update.nix { };
+
   # A shell that has the generate script
   shell = pkgs.mkShell { nativeBuildInputs = [ self.generate ]; };
 

update-scripts/update.nix

@@ -0,0 +1,65 @@
+{
+  nix,
+  writeShellApplication,
+}:
+writeShellApplication {
+  name = "update";
+
+  runtimeInputs = [
+    nix
+  ];
+
+  text = ''
+    commit=
+    use_github_output=
+    while [ $# -gt 0 ]; do
+      case "$1" in
+      --commit) commit=1
+        ;;
+      --github-output) use_github_output=1
+        ;;
+      --*) echo "unknown option $1"
+        ;;
+      *) echo "unexpected argument $1"
+        ;;
+      esac
+      shift
+    done
+
+    update_args=( )
+    if [ -n "$commit" ]; then
+      update_args+=( "--commit-lock-file" )
+    fi
+
+    writeGitHubOutput() {
+      if [ -n "$use_github_output" ]; then
+        (
+          echo "$1<<EOF"
+          git show --no-patch --format=%b
+          echo "EOF"
+        ) >> "$GITHUB_OUTPUT"
+      fi
+    }
+
+    # Update the root lockfile
+    old=$(git show --no-patch --format=%h)
+    echo "Updating root lockfile"
+    nix flake update "''${update_args[@]}"
+    new=$(git show --no-patch --format=%h)
+    if [ "$old" != "$new" ]; then
+      writeGitHubOutput root_lock_body
+    fi
+
+    # Update the dev lockfile
+    root_nixpkgs=$(nix eval --raw --file . 'inputs.nixpkgs.rev')
+    old=$(git show --no-patch --format=%h)
+    echo "Updating dev lockfile"
+    nix flake update "''${update_args[@]}" \
+        --override-input 'dev-nixpkgs' "github:NixOS/nixpkgs/$root_nixpkgs" \
+        --flake './flake/dev'
+    new=$(git show --no-patch --format=%h)
+    if [ "$old" != "$new" ]; then
+      writeGitHubOutput dev_lock_body
+    fi
+  '';
+}