diff options
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/autobot.yaml | 9 | ||||
| -rw-r--r-- | .github/workflows/ci.yaml | 118 | ||||
| -rw-r--r-- | .github/workflows/update-inputs.yaml | 6 | ||||
| -rw-r--r-- | .github/workflows/update-lock.yaml | 8 | ||||
| -rw-r--r-- | .github/workflows/update-nixpkgs.yaml | 6 |
5 files changed, 133 insertions, 14 deletions
diff --git a/.github/workflows/autobot.yaml b/.github/workflows/autobot.yaml index 0982f30..9401d45 100644 --- a/.github/workflows/autobot.yaml +++ b/.github/workflows/autobot.yaml @@ -2,13 +2,14 @@ name: auto-merge dependabot on: pull_request -permissions: - contents: write - pull-requests: write - jobs: automerge: runs-on: ubuntu-latest + + permissions: + contents: write + pull-requests: write + if: github.actor == 'dependabot[bot]' steps: - uses: dependabot/fetch-metadata@v1 diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml new file mode 100644 index 0000000..6a30315 --- /dev/null +++ b/.github/workflows/ci.yaml @@ -0,0 +1,118 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +jobs: + eval: + runs-on: ubuntu-latest + + outputs: + matrix: ${{ steps.generate.outputs.matrix }} + + steps: + - uses: actions/checkout@v4 + + - name: install nix + uses: DeterminateSystems/nix-installer-action@v6 + + - name: setup cachix + uses: cachix/cachix-action@master + with: + name: getchoo + authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} + skipAddingSubstituter: 'true' + + - name: generate matrix + id: generate + run: | + set -Eeu + echo "matrix=$(nix eval --accept-flake-config --show-trace --json .#githubWorkflow.matrix)" >> "$GITHUB_OUTPUT" + + build: + needs: eval + + strategy: + fail-fast: false + matrix: ${{ fromJSON(needs.eval.outputs.matrix) }} + + runs-on: ${{ matrix.os }} + + name: build (${{matrix.attr}}) + + steps: + - uses: actions/checkout@v4 + + - name: setup qemu + if: matrix.arch == 'aarch64' + run: | + sudo apt update -y + sudo apt install -y qemu-user-static + + - name: install nix + if: matrix.arch != 'aarch64' + uses: DeterminateSystems/nix-installer-action@v6 + + - name: install nix (with aarch64) + if: matrix.arch == 'aarch64' + uses: DeterminateSystems/nix-installer-action@v6 + with: + extra-conf: "extra-platforms = aarch64-linux arm-linux" + + - name: setup cachix + uses: cachix/cachix-action@master + with: + name: getchoo + authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} + skipAddingSubstituter: 'true' + + - name: build ${{ matrix.attr }} + run: nix build -L --accept-flake-config --fallback .#${{ matrix.attr }} + + check: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: install nix + uses: DeterminateSystems/nix-installer-action@v6 + + - name: setup cachix + uses: cachix/cachix-action@master + with: + name: getchoo + authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} + skipAddingSubstituter: 'true' + + - name: setup cachix + uses: cachix/cachix-action@v12 + with: + name: getchoo + authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} + skipAddingSubstituter: 'true' + + - name: run check + run: nix flake check --accept-flake-config --show-trace + + # https://github.com/orgs/community/discussions/26822#discussioncomment-3305794 + gate: + needs: [build, check] + runs-on: ubuntu-latest + + if: always() + + steps: + - name: exit with result + run: | + buildResult="${{ needs.build.result }}" + checkResult="${{ needs.check.result }}" + + results=("$buildResult" "$checkResult") + + for result in "${results[@]}"; do [ "$result" != "success" ] && exit 1; done + + exit 0 diff --git a/.github/workflows/update-inputs.yaml b/.github/workflows/update-inputs.yaml index a18c59d..8d795dc 100644 --- a/.github/workflows/update-inputs.yaml +++ b/.github/workflows/update-inputs.yaml @@ -6,12 +6,10 @@ on: - cron: "0 0 * * 6" workflow_dispatch: -permissions: - contents: write - pull-requests: write - jobs: update: uses: ./.github/workflows/update-lock.yaml with: commit-msg: "flake: update all inputs" + secrets: + token: ${{ secrets.MERGE_TOKEN }} diff --git a/.github/workflows/update-lock.yaml b/.github/workflows/update-lock.yaml index 0bf8b1d..cb70c94 100644 --- a/.github/workflows/update-lock.yaml +++ b/.github/workflows/update-lock.yaml @@ -12,6 +12,10 @@ on: required: false default: "" type: string + secrets: + token: + description: PAT for creating creating/merging the PR + required: true jobs: update: @@ -27,11 +31,11 @@ jobs: commit-msg: ${{ inputs.commit-msg }} inputs: ${{ inputs.inputs }} pr-title: ${{ inputs.commit-msg }} - token: ${{ github.token }} + token: ${{ secrets.token }} - name: enable auto-merge shell: bash run: gh pr merge --auto --rebase "$PR_ID" env: - GITHUB_TOKEN: ${{ github.token }} + GITHUB_TOKEN: ${{ secrets.token }} PR_ID: ${{ steps.update.outputs.pull-request-number }} diff --git a/.github/workflows/update-nixpkgs.yaml b/.github/workflows/update-nixpkgs.yaml index 734bf2a..c8cccdf 100644 --- a/.github/workflows/update-nixpkgs.yaml +++ b/.github/workflows/update-nixpkgs.yaml @@ -6,13 +6,11 @@ on: - cron: "0 0 * * *" workflow_dispatch: -permissions: - contents: write - pull-requests: write - jobs: update: uses: ./.github/workflows/update-lock.yaml with: commit-msg: "flake: update nixpkgs" inputs: "nixpkgs nixpkgs-stable" + secrets: + token: ${{ secrets.MERGE_TOKEN }} |