Merge pull request 'PR --> Build --> Merge --> Deploy' (#102) from add-lix into main
Reviewed-on: #102
This commit is contained in:
commit
8fcf7167fa
5 changed files with 57 additions and 34 deletions
|
@ -1,6 +1,8 @@
|
||||||
name: "Build"
|
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
||||||
|
name: "Build on PR"
|
||||||
on:
|
on:
|
||||||
pull_request:
|
pull_request:
|
||||||
|
types: [opened, synchronize]
|
||||||
push:
|
push:
|
||||||
branches: ["main"]
|
branches: ["main"]
|
||||||
paths:
|
paths:
|
||||||
|
@ -30,11 +32,9 @@ jobs:
|
||||||
if: ${{ !github.event.pull_request.head.repo.fork }}
|
if: ${{ !github.event.pull_request.head.repo.fork }}
|
||||||
with:
|
with:
|
||||||
name: hsndev
|
name: hsndev
|
||||||
# If you chose API tokens for write access OR if you have a private cache
|
|
||||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||||
- name: Garbage collect build dependencies
|
- name: Garbage collect build dependencies
|
||||||
run: nix-collect-garbage
|
run: nix-collect-garbage
|
||||||
|
|
||||||
- name: Build new ${{ matrix.system }} system and push to cachix
|
- name: Build new ${{ matrix.system }} system and push to cachix
|
||||||
id: "build"
|
id: "build"
|
||||||
shell: bash
|
shell: bash
|
||||||
|
@ -49,10 +49,3 @@ jobs:
|
||||||
CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||||
run: |
|
run: |
|
||||||
echo $DRVOUT | cachix push hsndev
|
echo $DRVOUT | cachix push hsndev
|
||||||
- name: Deploy ${{ matrix.system }} runners
|
|
||||||
id: "deploy"
|
|
||||||
if: success()
|
|
||||||
env:
|
|
||||||
CACHIX_ACTIVATE_TOKEN: ${{ secrets.CACHIX_ACTIVATE_TOKEN }}
|
|
||||||
run: |
|
|
||||||
cachix deploy activate $DRVOUT
|
|
47
.forgejo/workflows/deploy.yaml
Normal file
47
.forgejo/workflows/deploy.yaml
Normal file
|
@ -0,0 +1,47 @@
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
||||||
|
name: "Deploy on PR Merge"
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
types: [closed]
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
if_merged:
|
||||||
|
if: github.event.pull_request.merged == true
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
include:
|
||||||
|
- name: fj-hetzner-aarch64-01
|
||||||
|
system: aarch64-linux
|
||||||
|
os: native-aarch64
|
||||||
|
- name: fj-shadowfax-01
|
||||||
|
system: x86_64-linux
|
||||||
|
os: native-x86_64
|
||||||
|
runs-on: ${{ matrix.os }}
|
||||||
|
env:
|
||||||
|
PATH: ${{ format('{0}:{1}', '/run/current-system/sw/bin', env.PATH) }}
|
||||||
|
steps:
|
||||||
|
- name: Checkout repository
|
||||||
|
uses: https://github.com/actions/checkout@v4
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
- uses: https://github.com/cachix/cachix-action@v15
|
||||||
|
if: ${{ !github.event.pull_request.head.repo.fork }}
|
||||||
|
with:
|
||||||
|
name: hsndev
|
||||||
|
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||||
|
- name: Garbage collect build dependencies
|
||||||
|
run: nix-collect-garbage
|
||||||
|
- name: Build new ${{ matrix.system }} system and push to cachix
|
||||||
|
id: "build"
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
set -o pipefail
|
||||||
|
DRVOUT=$(nix build .#deploy-json.${{ matrix.system }} --print-out-paths)
|
||||||
|
echo "DRVOUT=$DRVOUT" >> $GITHUB_ENV
|
||||||
|
- name: Deploy ${{ matrix.system }} runners
|
||||||
|
id: "deploy"
|
||||||
|
if: success()
|
||||||
|
env:
|
||||||
|
CACHIX_ACTIVATE_TOKEN: ${{ secrets.CACHIX_ACTIVATE_TOKEN }}
|
||||||
|
run: |
|
||||||
|
cachix deploy activate $DRVOUT
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, config, lib, ... }:
|
{ pkgs, config, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
../cachix.nix
|
../cachix.nix
|
||||||
|
|
|
@ -108,7 +108,7 @@
|
||||||
# Cachix deploy for automated deployments
|
# Cachix deploy for automated deployments
|
||||||
packages.aarch64-linux.default =
|
packages.aarch64-linux.default =
|
||||||
let
|
let
|
||||||
inherit (common "aarch64-linux") cachix-deploy-lib pkgs;
|
inherit (common "aarch64-linux") cachix-deploy-lib;
|
||||||
in
|
in
|
||||||
cachix-deploy-lib.nixos {
|
cachix-deploy-lib.nixos {
|
||||||
# system = "aarch64-linux";
|
# system = "aarch64-linux";
|
||||||
|
@ -116,7 +116,7 @@
|
||||||
};
|
};
|
||||||
packages.x86_64-linux.default =
|
packages.x86_64-linux.default =
|
||||||
let
|
let
|
||||||
inherit (common "x86_64-linux") cachix-deploy-lib pkgs;
|
inherit (common "x86_64-linux") cachix-deploy-lib;
|
||||||
in
|
in
|
||||||
cachix-deploy-lib.nixos {
|
cachix-deploy-lib.nixos {
|
||||||
imports = x86_64-linux-modules;
|
imports = x86_64-linux-modules;
|
||||||
|
@ -136,7 +136,7 @@
|
||||||
agents = {
|
agents = {
|
||||||
"fj-hetzner-aarch64-01" =
|
"fj-hetzner-aarch64-01" =
|
||||||
let
|
let
|
||||||
inherit (common "aarch64-linux") cachix-deploy-lib pkgs;
|
inherit (common "aarch64-linux") cachix-deploy-lib;
|
||||||
in
|
in
|
||||||
cachix-deploy-lib.nixos {
|
cachix-deploy-lib.nixos {
|
||||||
# system = "aarch64-linux";
|
# system = "aarch64-linux";
|
||||||
|
@ -153,7 +153,7 @@
|
||||||
agents = {
|
agents = {
|
||||||
"fj-shadowfax-01" =
|
"fj-shadowfax-01" =
|
||||||
let
|
let
|
||||||
inherit (common "x86_64-linux") cachix-deploy-lib pkgs;
|
inherit (common "x86_64-linux") cachix-deploy-lib;
|
||||||
in
|
in
|
||||||
cachix-deploy-lib.nixos {
|
cachix-deploy-lib.nixos {
|
||||||
imports = x86_64-linux-modules;
|
imports = x86_64-linux-modules;
|
||||||
|
|
21
shell.nix
21
shell.nix
|
@ -1,32 +1,15 @@
|
||||||
# Shell for bootstrapping flake-enabled nix and home-manager
|
# Shell for bootstrapping flake-enabled nix and home-manager
|
||||||
{ pkgs ? let
|
{ pkgs ? import <nixpkgs> {} }:
|
||||||
# If pkgs is not defined, instantiate nixpkgs from locked commit
|
|
||||||
lock = (builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked;
|
|
||||||
nixpkgs = fetchTarball {
|
|
||||||
url = "https://github.com/nixos/nixpkgs/archive/${lock.rev}.tar.gz";
|
|
||||||
sha256 = lock.narHash;
|
|
||||||
};
|
|
||||||
system = builtins.currentSystem;
|
|
||||||
overlays = [ ]; # Explicit blank overlay to avoid interference
|
|
||||||
in
|
|
||||||
import nixpkgs { inherit system overlays; }
|
|
||||||
, ...
|
|
||||||
}:
|
|
||||||
let
|
|
||||||
in
|
|
||||||
pkgs.mkShell {
|
pkgs.mkShell {
|
||||||
# Enable experimental features without having to specify the argument
|
# Enable experimental features without having to specify the argument
|
||||||
NIX_CONFIG = "experimental-features = nix-command flakes";
|
NIX_CONFIG = "experimental-features = nix-command flakes";
|
||||||
|
|
||||||
nativeBuildInputs = with pkgs; [
|
nativeBuildInputs = with pkgs; [
|
||||||
nix
|
|
||||||
home-manager
|
|
||||||
git
|
git
|
||||||
nil
|
|
||||||
nixpkgs-fmt
|
|
||||||
go-task
|
go-task
|
||||||
sops
|
sops
|
||||||
pre-commit
|
pre-commit
|
||||||
gitleaks
|
gitleaks
|
||||||
|
statix
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue