feat(ci): check for barcodebuddy updates

ci/flake-cron.nix

@@ -6,6 +6,7 @@
 }:
 with lib; let
   gitBranch = "main";
+  pkgs = channels.nixpkgs;
 in {
   name = "flake-update";
 
@@ -67,7 +68,49 @@ in {
     nixpkgs.path = "${channels.nixfiles.inputs.nixpkgs}";
   };
 
-  jobs.flake-update = {
+  jobs = {
+    flake-update = {
+    };
+    barcodebuddy-update = {
+      ci.gh-actions.name = "barcodebuddy update check";
+      tasks.check = let
+        barcodebuddy-check = let
+          lock = importJSON ../flake.lock;
+          inherit (lock.nodes) barcodebuddy;
+          inherit (barcodebuddy.original) ref;
+          impure = toString builtins.currentTime or channels.nixfiles.inputs.sourceInfo.lastModified;
+          outputHashAlgo = "sha256";
+          outputHash = builtins.hashString outputHashAlgo "${ref}!${impure}\n";
+        in pkgs.runCommand "barcodebuddy-check-${ref}" {
+          inherit outputHash outputHashAlgo impure ref;
+          outputHashMode = "flat";
+          preferLocalBuild = true;
+          allowSubstitutes = false;
+          impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_CURL_FLAGS" ];
+          nativeBuildInputs = with pkgs.buildPackages; [ curl jq ];
+          inherit (barcodebuddy.original) owner repo;
+          query = "sort_by(.tag_name) | [.[]|select(.prerelease==false and .draft==false)] | .[-1].tag_name";
+          meta.displayName = "barcodebuddy ${ref} outdated";
+        } ''
+          BB_RELEASES=$(curl \
+            --insecure \
+            -fSsL \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/repos/$owner/$repo/releases"
+          )
+          BB_LATEST=$(jq -r "$query" - <<< "$BB_RELEASES")
+          if [[ $BB_LATEST = $ref ]]; then
+            echo "barcodebuddy-$ref up-to-date" >&2
+          else
+            echo "barcodebuddy-$ref out of date, found version $BB_LATEST" >&2
+          fi
+          printf '%s!%s\n' "$BB_LATEST" "$impure" > $out
+        '';
+      in {
+        inputs = [ barcodebuddy-check ];
+        cache.enable = false;
+      };
+    };
   };
 
   ci.gh-actions.checkoutOptions = {