ci: add renovate-post

.github/scripts/render-dhall-changes.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for file in .github/workflows/*.dhall; do
+  nix shell nixpkgs#dhall-yaml -c dhall-to-yaml-ng --file "$file" >"${file%.dhall}.yml"
+done

.github/workflows/renovate-post.dhall

@@ -0,0 +1,51 @@
+let GithubActions =
+      https://github.com/nekowinston/github-actions-dhall/raw/8a03c493dddfa0d59f616212554168ce0242f0dd/package.dhall
+        sha256:6b3f0ee0347ec029dd350e2a7cc42d2990f8387d83faa71d3e78bdece67ee2c4
+
+let permissions =
+      Some
+        [ { mapKey = GithubActions.types.Permission.contents
+          , mapValue = GithubActions.types.PermissionAccess.write
+          }
+        , { mapKey = GithubActions.types.Permission.workflows
+          , mapValue = GithubActions.types.PermissionAccess.write
+          }
+        ]
+
+let steps =
+      [ GithubActions.Step::{ uses = Some "actions/checkout@v4" }
+      , GithubActions.Step::{
+        , uses = Some "DeterminateSystems/nix-installer-action@v11"
+        }
+      , GithubActions.Step::{
+        , run = Some ../scripts/render-dhall-changes.sh as Text
+        }
+      , GithubActions.Step::{
+        , uses = Some "EndBug/add-and-commit@v9.1.4"
+        , `with` = Some
+            ( toMap
+                { message = "Render Dhall changes"
+                , author_name = "renovate[bot]"
+                , author_email =
+                    "<29139614+renovate[bot]@users.noreply.github.com>"
+                }
+            )
+        }
+      ]
+
+let render_dhall_changes =
+      GithubActions.Job::{
+      , name = Some "Render Dhall changes"
+      , runs-on = GithubActions.RunsOn.Type.ubuntu-latest
+      , `if` = Some "\${{github.actor == 'renovate[bot]'}}"
+      , permissions
+      , steps
+      }
+
+in  GithubActions.Workflow::{
+    , name = "renovate-post"
+    , on = GithubActions.On::{
+      , push = Some GithubActions.Push::{ branches = Some [ "renovate/*" ] }
+      }
+    , jobs = toMap { render_dhall_changes }
+    }

.github/workflows/renovate-post.yml

@@ -0,0 +1,28 @@
+jobs:
+  render_dhall_changes:
+    if: "${{github.actor == 'renovate[bot]'}}"
+    name: Render Dhall changes
+    permissions:
+      contents: write
+      workflows: write
+    "runs-on": "ubuntu-latest"
+    steps:
+    - uses: "actions/checkout@v4"
+    - uses: "DeterminateSystems/nix-installer-action@v11"
+    - run: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+
+        for file in .github/workflows/*.dhall; do
+          nix shell nixpkgs#dhall-yaml -c dhall-to-yaml-ng --file "$file" >"${file%.dhall}.yml"
+        done
+    - uses: "EndBug/add-and-commit@v9.1.4"
+      with:
+        author_email: "<29139614+renovate[bot]@users.noreply.github.com>"
+        author_name: "renovate[bot]"
+        message: Render Dhall changes
+name: "renovate-post"
+'on':
+  push:
+    branches:
+    - "renovate/*"