From 63498970aa68db136ac73150edcb1e547ed4a3e2 Mon Sep 17 00:00:00 2001 From: seth Date: Thu, 14 Dec 2023 04:38:36 -0500 Subject: ci: garnix -> gha + attic --- .github/workflows/autobot.yaml | 4 +- .github/workflows/ci.yaml | 121 +++++++++++++++++++++++++++++++ .github/workflows/flakehub-publish.yaml | 9 ++- .github/workflows/staging-automerge.yaml | 33 ++++----- .github/workflows/update-lock.yaml | 16 ++-- README.md | 14 ++-- flake.nix | 64 +++++++++------- garnix.yaml | 9 --- 8 files changed, 195 insertions(+), 75 deletions(-) create mode 100644 .github/workflows/ci.yaml delete mode 100644 garnix.yaml diff --git a/.github/workflows/autobot.yaml b/.github/workflows/autobot.yaml index ddc70d4..d18cda6 100644 --- a/.github/workflows/autobot.yaml +++ b/.github/workflows/autobot.yaml @@ -1,4 +1,4 @@ -name: auto-merge dependabot +name: Auto-merge Dependabot on: pull_request @@ -18,7 +18,7 @@ jobs: with: github-token: ${{ github.token }} - - name: enable auto-merge + - name: Enable auto-merge if: steps.metadata.outputs.update-type == 'version-update:semver-patch' run: gh pr merge --auto --rebase "$PR" env: diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml new file mode 100644 index 0000000..bfc7cf4 --- /dev/null +++ b/.github/workflows/ci.yaml @@ -0,0 +1,121 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +jobs: + eval: + name: Evaluate flake + runs-on: ubuntu-latest + + outputs: + matrix: ${{ steps.evaluate.outputs.matrix }} + + steps: + - uses: actions/checkout@v4 + + - name: Install Nix + uses: DeterminateSystems/nix-installer-action@v9 + + - name: Evaluate matrix + id: evaluate + run: | + set -eu + echo "matrix=$(nix eval --show-trace --json .#githubWorkflow.matrix)" >> "$GITHUB_OUTPUT" + + build: + needs: eval + + strategy: + fail-fast: false + matrix: ${{ fromJSON(needs.eval.outputs.matrix) }} + + name: Build (${{ matrix.attr }}) + runs-on: ${{ matrix.os }} + + steps: + - uses: actions/checkout@v4 + + - name: Setup QEMU + if: matrix.arch == 'aarch64' + uses: docker/setup-qemu-action@v3 + with: + platforms: "arm64" + + - name: Install Nix + if: matrix.arch != 'aarch64' + uses: DeterminateSystems/nix-installer-action@v9 + + - name: Install Nix (with aarch64) + if: matrix.arch == 'aarch64' + uses: DeterminateSystems/nix-installer-action@v9 + with: + extra-conf: "extra-platforms = aarch64-linux arm-linux" + + - name: Setup local Nix cache + uses: DeterminateSystems/magic-nix-cache-action@v2 + + - name: Setup Attic cache + uses: ryanccn/attic-action@v0 + with: + endpoint: https://cache.mydadleft.me + cache: nix-exprs + token: ${{ secrets.ATTIC_TOKEN }} + skip-push: ${{ github.event_name == 'pull_request' }} + + - name: Run build + run: | + nix build -L --accept-flake-config .#${{ matrix.attr }} + + check: + strategy: + fail-fast: false + matrix: + os: [ubuntu-latest, macos-latest] + + name: Check flake (${{ matrix.os }}) + runs-on: ${{ matrix.os }} + + steps: + - uses: actions/checkout@v4 + + - name: Install Nix + uses: DeterminateSystems/nix-installer-action@v9 + + - name: Setup local Nix cache + uses: DeterminateSystems/magic-nix-cache-action@v2 + + - name: Setup Attic cache + uses: ryanccn/attic-action@v0 + with: + endpoint: https://cache.mydadleft.me + cache: nix-exprs + token: ${{ secrets.ATTIC_TOKEN }} + skip-push: ${{ github.event_name == 'pull_request' }} + + - name: Run check + run: nix flake check --show-trace --accept-flake-config + + # https://github.com/orgs/community/discussions/26822#discussioncomment-3305794 + gate: + needs: [build, check] + + name: CI Gate + runs-on: ubuntu-latest + + if: always() + + steps: + - name: Exit with result + run: | + build_result="${{ needs.build.result }}" + check_result="${{ needs.check.result }}" + + results=("$build_result" "$check_result") + + for result in "${results[@]}"; do [ "$result" != "success" ] && exit 1; done + + exit 0 diff --git a/.github/workflows/flakehub-publish.yaml b/.github/workflows/flakehub-publish.yaml index 89a82d2..7ceaefd 100644 --- a/.github/workflows/flakehub-publish.yaml +++ b/.github/workflows/flakehub-publish.yaml @@ -1,4 +1,4 @@ -name: flakehub publish +name: Flakehub publish on: push: @@ -7,6 +7,7 @@ on: jobs: publish: runs-on: ubuntu-latest + permissions: id-token: write contents: read @@ -14,10 +15,10 @@ jobs: steps: - uses: actions/checkout@v4 - - name: install nix - uses: nixbuild/nix-quick-install-action@v26 + - name: Install Nix + uses: DeterminateSystems/nix-installer-action@v9 - - name: push to flakehub + - name: Push to Flakehub uses: DeterminateSystems/flakehub-push@v3 with: visibility: "public" diff --git a/.github/workflows/staging-automerge.yaml b/.github/workflows/staging-automerge.yaml index 2dd3502..9998584 100644 --- a/.github/workflows/staging-automerge.yaml +++ b/.github/workflows/staging-automerge.yaml @@ -1,4 +1,4 @@ -name: auto-merge staging +name: Auto-merge staging on: push: @@ -7,25 +7,22 @@ on: jobs: automerge: + name: Auto-merge runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write - steps: - - name: check if pr exists + - name: Check if PR exists id: check run: | - prs=$(gh pr list \ - --repo ${{ github.repository }} \ - --head staging \ - --json state \ - --jq 'map(select(.state == "OPEN")) | length') + prs=$(gh pr list \ + --repo ${{ github.repository }} \ + --head staging \ + --json state \ + --jq 'map(select(.state == "OPEN")) | length') - if (( prs > 0 )); then - echo "skip=true" >> "$GITHUB_OUTPUT" - fi + if (( prs > 0 )); then + echo "skip=true" >> "$GITHUB_OUTPUT" + fi env: GH_TOKEN: ${{ github.token }} @@ -35,7 +32,7 @@ jobs: with: fetch-depth: 0 - - name: create pr + - name: Create PR if: ${{ !steps.check.outputs.skip }} run: | gh pr create \ @@ -44,10 +41,10 @@ jobs: --title "auto-merge: ${{ github.ref_name }} -> main" \ --fill env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ secrets.MERGE_TOKEN }} - - name: enable auto-merge + - name: Enable auto-merge if: ${{ !steps.check.outputs.skip }} run: gh pr merge --auto --rebase --match-head-commit ${{ github.sha }} env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ secrets.MERGE_TOKEN }} diff --git a/.github/workflows/update-lock.yaml b/.github/workflows/update-lock.yaml index e735b81..98af4ef 100644 --- a/.github/workflows/update-lock.yaml +++ b/.github/workflows/update-lock.yaml @@ -10,27 +10,23 @@ jobs: update: runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write - steps: - uses: actions/checkout@v4 - - name: install nix - uses: nixbuild/nix-quick-install-action@v26 + - name: Install Nix + uses: DeterminateSystems/nix-installer-action@v9 - - name: update lockfile + - name: Update lockfile & make PR uses: DeterminateSystems/update-flake-lock@v20 id: update with: commit-msg: "flake: update inputs" pr-title: "flake: update inputs" - token: ${{ github.token }} + token: ${{ secrets.MERGE_TOKEN }} - - name: enable auto-merge + - name: Enable auto-merge shell: bash run: gh pr merge --auto --rebase "$PR_ID" env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ secrets.MERGE_TOKEN }} PR_ID: ${{ steps.update.outputs.pull-request-number }} diff --git a/README.md b/README.md index 9947674..f36076c 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,15 @@ # nix-exprs -[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgetchoo%2Fnix-exprs)](https://garnix.io) +[![Build status](https://img.shields.io/github/actions/workflow/status/getchoo/nix-exprs/ci.yaml?style=flat-square&logo=github&label=Build%20status&color=5277c3)](https://github.com/getchoo/nix-exprs/actions/workflows/ci.yaml) ## how to use ### enabling the binary cache -all packages are built with [garnix](https://garnix.io/), and cached on their servers. you can use this -yourself by following the instructions [here](https://garnix.io/docs/caching). i would also recommend -[donating](https://opencollective.com/garnix_io) if you can! +all packages are cached in my own [attic](https://github.com/zhaofengli/attic) instance. you can use this +yourself by following the instructions [here](https://docs.attic.rs/user-guide/index.html), with the endpoint +being `https://cache.mydadleft.me` and no token required. the binary cache endpoint `https://cache.mydadleft.me/nix-exprs` +may also be used in the `nixConfig` attribute of flakes or a system configuration.
example @@ -16,9 +17,8 @@ yourself by following the instructions [here](https://garnix.io/docs/caching). i ```nix {pkgs, ...}: { nix.settings = { - trusted-substituters = ["https://cache.garnix.io"]; - - trusted-public-keys = ["cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="]; + trusted-substituters = ["https://cache.mydadleft.me/nix-exprs"]; + trusted-public-keys = ["nix-exprs:mLifiLXlGVkkuFpIbqcrCWkIxKn2GyCkrxOuE7fwLxQ="]; }; } ``` diff --git a/flake.nix b/flake.nix index ee44603..bf6d68b 100644 --- a/flake.nix +++ b/flake.nix @@ -2,8 +2,8 @@ description = "getchoo's nix expressions"; nixConfig = { - extra-substituters = ["https://cache.garnix.io"]; - extra-trusted-public-keys = ["cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="]; + extra-substituters = ["https://cache.mydadleft.me/nix-exprs"]; + extra-trusted-public-keys = ["nix-exprs:mLifiLXlGVkkuFpIbqcrCWkIxKn2GyCkrxOuE7fwLxQ="]; }; inputs.nixpkgs.url = "nixpkgs/nixos-unstable"; @@ -24,29 +24,6 @@ forAllSystems = fn: lib.genAttrs systems (sys: fn nixpkgs.legacyPackages.${sys}); in { - checks = forAllSystems (pkgs: { - ciGate = let - inherit (pkgs) system; - pkgs' = self.packages.${system}; - requirements = { - # all packages on linux are built - "x86_64-linux" = lib.mapAttrsToList (_: v: v.pname or v.name) pkgs'; - "aarch64-linux" = requirements."x86_64-linux"; - - # but not for macos - "aarch64-darwin" = []; - - # garnix also doesn't support intel macs :( - "x86_64-darwin" = []; - }; - in - pkgs.runCommand "ci-gate" { - nativeBuildInputs = - builtins.filter (v: builtins.elem (v.pname or v.name) requirements.${system}) - (builtins.attrValues pkgs'); - } "touch $out"; - }); - packages = forAllSystems ( pkgs: let overlay = lib.fix (final: self.overlays.default final pkgs); @@ -84,5 +61,42 @@ full = "big template for complex flakes (using flake-parts)"; nixos = "minimal boilerplate for flake-based nixos configuration"; }; + + githubWorkflow.matrix = let + ciSystems = [ + "x86_64-linux" + "aarch64-linux" + "x86_64-darwin" + ]; + + platforms = { + "x86_64-linux" = { + arch = "x64"; + os = "ubuntu-latest"; + }; + + "aarch64-linux" = { + arch = "aarch64"; + os = "ubuntu-latest"; + }; + + "x86_64-darwin" = { + arch = "x64"; + os = "macos-latest"; + }; + }; + in { + include = lib.pipe ciSystems [ + (systems: lib.getAttrs systems self.packages) + + (lib.mapAttrsToList (system: + lib.mapAttrsToList (attr: _: { + inherit (platforms.${system}) os arch; + attr = "packages.${system}.${attr}"; + }))) + + lib.flatten + ]; + }; }; } diff --git a/garnix.yaml b/garnix.yaml deleted file mode 100644 index f4b963e..0000000 --- a/garnix.yaml +++ /dev/null @@ -1,9 +0,0 @@ -builds: - exclude: - - "*.x86_64-darwin.*" - include: - - "checks.*.*" - - "packages.x86_64-linux.*" - - "packages.aarch64-linux.*" - - "packages.aarch64-darwin.modrinth-app" - - "packages.aarch64-darwin.modrinth-app-unwrapped" -- cgit v1.2.3