ci: refresh Flatpak dependency sources automatically

.github/workflows/nix-package-check.yml

@@ -1,4 +1,4 @@
-name: Nix package check
+name: Nix check and Flatpak refresh
 
 on:
   schedule:
@@ -45,3 +45,40 @@ jobs:
           nix --accept-flake-config build \
             .#packages.x86_64-linux.canary.pnpmDeps \
             --rebuild --no-link --print-build-logs
+
+  refresh-flatpak:
+    name: refresh-flatpak-sources
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout dev
+        uses: actions/checkout@v4
+        with:
+          ref: dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v10.0.0
+        with:
+          version: latest-known
+
+      - name: Generate Flatpak dependency sources
+        run: bash packaging/flatpak/generate-sources.sh
+
+      - name: Commit updated dependency sources
+        run: |
+          git add packaging/flatpak/cargo-sources.json packaging/flatpak/pnpm-sources.json
+          if git diff --cached --quiet; then
+            exit 0
+          fi
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git commit -m "chore(flatpak): refresh dependency sources"
+          git push origin HEAD:dev

.github/workflows/pr-quality-gate.yml

@@ -59,16 +59,16 @@ jobs:
 
       - name: Setup uv
         if: runner.os == 'Linux'
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        uses: astral-sh/setup-uv@v10.0.0
         with:
           version: latest-known
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Verify generated Flatpak dependency sources
+      - name: Verify Flatpak dependency source generation
         if: runner.os == 'Linux'
-        run: pnpm run flatpak:sources:check
+        run: pnpm run flatpak:sources
 
       - name: Run checks and tests
         run: pnpm run check

packaging/flatpak/README.md

@@ -35,15 +35,17 @@ current commit exactly.
 ## Dependency manifests
 
 `pnpm-sources.json` and `cargo-sources.json` are generated from the repository
-lockfiles with a pinned revision of `flatpak-builder-tools`. Regenerate them
-after either lockfile changes:
+lockfiles with a pinned revision of `flatpak-builder-tools`. The Nix check and
+Flatpak refresh workflow regenerates and commits changes to `dev` daily, or
+when manually dispatched. PR checks verify generation without requiring these
+generated files in dependency updates. To refresh them locally before a build:
 
 ```bash
 pnpm run flatpak:sources
 ```
 
-Generation requires `git` and `uv`. CI can verify that committed manifests are
-current with `pnpm run flatpak:sources:check`.
+Generation requires `git`, Node.js, and `uv`. Verify that committed manifests
+are current with `pnpm run flatpak:sources:check`.
 
 ## Sandbox