PR --> Build --> Merge --> Deploy #102
5 changed files with 57 additions and 34 deletions
|
@ -1,6 +1,8 @@
|
|||
name: "Build"
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
||||
name: "Build on PR"
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
push:
|
||||
branches: ["main"]
|
||||
paths:
|
||||
|
@ -30,11 +32,9 @@ jobs:
|
|||
if: ${{ !github.event.pull_request.head.repo.fork }}
|
||||
with:
|
||||
name: hsndev
|
||||
# If you chose API tokens for write access OR if you have a private cache
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
- name: Garbage collect build dependencies
|
||||
run: nix-collect-garbage
|
||||
|
||||
- name: Build new ${{ matrix.system }} system and push to cachix
|
||||
id: "build"
|
||||
shell: bash
|
||||
|
@ -49,10 +49,3 @@ jobs:
|
|||
CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||
run: |
|
||||
echo $DRVOUT | cachix push hsndev
|
||||
- name: Deploy ${{ matrix.system }} runners
|
||||
id: "deploy"
|
||||
if: success()
|
||||
env:
|
||||
CACHIX_ACTIVATE_TOKEN: ${{ secrets.CACHIX_ACTIVATE_TOKEN }}
|
||||
run: |
|
||||
cachix deploy activate $DRVOUT
|
47
.forgejo/workflows/deploy.yaml
Normal file
47
.forgejo/workflows/deploy.yaml
Normal file
|
@ -0,0 +1,47 @@
|
|||
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
||||
name: "Deploy on PR Merge"
|
||||
on:
|
||||
pull_request:
|
||||
types: [closed]
|
||||
|
||||
jobs:
|
||||
if_merged:
|
||||
if: github.event.pull_request.merged == true
|
||||
strategy:
|
||||
matrix:
|
||||
include:
|
||||
- name: fj-hetzner-aarch64-01
|
||||
system: aarch64-linux
|
||||
os: native-aarch64
|
||||
- name: fj-shadowfax-01
|
||||
system: x86_64-linux
|
||||
os: native-x86_64
|
||||
runs-on: ${{ matrix.os }}
|
||||
env:
|
||||
PATH: ${{ format('{0}:{1}', '/run/current-system/sw/bin', env.PATH) }}
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: https://github.com/actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- uses: https://github.com/cachix/cachix-action@v15
|
||||
if: ${{ !github.event.pull_request.head.repo.fork }}
|
||||
with:
|
||||
name: hsndev
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
- name: Garbage collect build dependencies
|
||||
run: nix-collect-garbage
|
||||
- name: Build new ${{ matrix.system }} system and push to cachix
|
||||
id: "build"
|
||||
shell: bash
|
||||
run: |
|
||||
set -o pipefail
|
||||
DRVOUT=$(nix build .#deploy-json.${{ matrix.system }} --print-out-paths)
|
||||
echo "DRVOUT=$DRVOUT" >> $GITHUB_ENV
|
||||
- name: Deploy ${{ matrix.system }} runners
|
||||
id: "deploy"
|
||||
if: success()
|
||||
env:
|
||||
CACHIX_ACTIVATE_TOKEN: ${{ secrets.CACHIX_ACTIVATE_TOKEN }}
|
||||
run: |
|
||||
cachix deploy activate $DRVOUT
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, config, lib, ... }:
|
||||
{ pkgs, config, ... }:
|
||||
{
|
||||
imports = [
|
||||
../cachix.nix
|
||||
|
|
|
@ -108,7 +108,7 @@
|
|||
# Cachix deploy for automated deployments
|
||||
packages.aarch64-linux.default =
|
||||
let
|
||||
inherit (common "aarch64-linux") cachix-deploy-lib pkgs;
|
||||
inherit (common "aarch64-linux") cachix-deploy-lib;
|
||||
in
|
||||
cachix-deploy-lib.nixos {
|
||||
# system = "aarch64-linux";
|
||||
|
@ -116,7 +116,7 @@
|
|||
};
|
||||
packages.x86_64-linux.default =
|
||||
let
|
||||
inherit (common "x86_64-linux") cachix-deploy-lib pkgs;
|
||||
inherit (common "x86_64-linux") cachix-deploy-lib;
|
||||
in
|
||||
cachix-deploy-lib.nixos {
|
||||
imports = x86_64-linux-modules;
|
||||
|
@ -136,7 +136,7 @@
|
|||
agents = {
|
||||
"fj-hetzner-aarch64-01" =
|
||||
let
|
||||
inherit (common "aarch64-linux") cachix-deploy-lib pkgs;
|
||||
inherit (common "aarch64-linux") cachix-deploy-lib;
|
||||
in
|
||||
cachix-deploy-lib.nixos {
|
||||
# system = "aarch64-linux";
|
||||
|
@ -153,7 +153,7 @@
|
|||
agents = {
|
||||
"fj-shadowfax-01" =
|
||||
let
|
||||
inherit (common "x86_64-linux") cachix-deploy-lib pkgs;
|
||||
inherit (common "x86_64-linux") cachix-deploy-lib;
|
||||
in
|
||||
cachix-deploy-lib.nixos {
|
||||
imports = x86_64-linux-modules;
|
||||
|
|
21
shell.nix
21
shell.nix
|
@ -1,32 +1,15 @@
|
|||
# Shell for bootstrapping flake-enabled nix and home-manager
|
||||
{ pkgs ? let
|
||||
# If pkgs is not defined, instantiate nixpkgs from locked commit
|
||||
lock = (builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked;
|
||||
nixpkgs = fetchTarball {
|
||||
url = "https://github.com/nixos/nixpkgs/archive/${lock.rev}.tar.gz";
|
||||
sha256 = lock.narHash;
|
||||
};
|
||||
system = builtins.currentSystem;
|
||||
overlays = [ ]; # Explicit blank overlay to avoid interference
|
||||
in
|
||||
import nixpkgs { inherit system overlays; }
|
||||
, ...
|
||||
}:
|
||||
let
|
||||
in
|
||||
{ pkgs ? import <nixpkgs> {} }:
|
||||
pkgs.mkShell {
|
||||
# Enable experimental features without having to specify the argument
|
||||
NIX_CONFIG = "experimental-features = nix-command flakes";
|
||||
|
||||
nativeBuildInputs = with pkgs; [
|
||||
nix
|
||||
home-manager
|
||||
git
|
||||
nil
|
||||
nixpkgs-fmt
|
||||
go-task
|
||||
sops
|
||||
pre-commit
|
||||
gitleaks
|
||||
statix
|
||||
];
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue