PR --> Build --> Merge --> Deploy #102

Merged
jahanson merged 3 commits from add-lix into main 2024-08-07 20:11:36 -05:00
5 changed files with 57 additions and 34 deletions

View file

@ -1,6 +1,8 @@
name: "Build" # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Build on PR"
on: on:
pull_request: pull_request:
types: [opened, synchronize]
push: push:
branches: ["main"] branches: ["main"]
paths: paths:
@ -30,11 +32,9 @@ jobs:
if: ${{ !github.event.pull_request.head.repo.fork }} if: ${{ !github.event.pull_request.head.repo.fork }}
with: with:
name: hsndev name: hsndev
# If you chose API tokens for write access OR if you have a private cache
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
- name: Garbage collect build dependencies - name: Garbage collect build dependencies
run: nix-collect-garbage run: nix-collect-garbage
- name: Build new ${{ matrix.system }} system and push to cachix - name: Build new ${{ matrix.system }} system and push to cachix
id: "build" id: "build"
shell: bash shell: bash
@ -49,10 +49,3 @@ jobs:
CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
run: | run: |
echo $DRVOUT | cachix push hsndev echo $DRVOUT | cachix push hsndev
- name: Deploy ${{ matrix.system }} runners
id: "deploy"
if: success()
env:
CACHIX_ACTIVATE_TOKEN: ${{ secrets.CACHIX_ACTIVATE_TOKEN }}
run: |
cachix deploy activate $DRVOUT

View file

@ -0,0 +1,47 @@
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Deploy on PR Merge"
on:
pull_request:
types: [closed]
jobs:
if_merged:
if: github.event.pull_request.merged == true
strategy:
matrix:
include:
- name: fj-hetzner-aarch64-01
system: aarch64-linux
os: native-aarch64
- name: fj-shadowfax-01
system: x86_64-linux
os: native-x86_64
runs-on: ${{ matrix.os }}
env:
PATH: ${{ format('{0}:{1}', '/run/current-system/sw/bin', env.PATH) }}
steps:
- name: Checkout repository
uses: https://github.com/actions/checkout@v4
with:
fetch-depth: 0
- uses: https://github.com/cachix/cachix-action@v15
if: ${{ !github.event.pull_request.head.repo.fork }}
with:
name: hsndev
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
- name: Garbage collect build dependencies
run: nix-collect-garbage
- name: Build new ${{ matrix.system }} system and push to cachix
id: "build"
shell: bash
run: |
set -o pipefail
DRVOUT=$(nix build .#deploy-json.${{ matrix.system }} --print-out-paths)
echo "DRVOUT=$DRVOUT" >> $GITHUB_ENV
- name: Deploy ${{ matrix.system }} runners
id: "deploy"
if: success()
env:
CACHIX_ACTIVATE_TOKEN: ${{ secrets.CACHIX_ACTIVATE_TOKEN }}
run: |
cachix deploy activate $DRVOUT

View file

@ -1,4 +1,4 @@
{ pkgs, config, lib, ... }: { pkgs, config, ... }:
{ {
imports = [ imports = [
../cachix.nix ../cachix.nix

View file

@ -108,7 +108,7 @@
# Cachix deploy for automated deployments # Cachix deploy for automated deployments
packages.aarch64-linux.default = packages.aarch64-linux.default =
let let
inherit (common "aarch64-linux") cachix-deploy-lib pkgs; inherit (common "aarch64-linux") cachix-deploy-lib;
in in
cachix-deploy-lib.nixos { cachix-deploy-lib.nixos {
# system = "aarch64-linux"; # system = "aarch64-linux";
@ -116,7 +116,7 @@
}; };
packages.x86_64-linux.default = packages.x86_64-linux.default =
let let
inherit (common "x86_64-linux") cachix-deploy-lib pkgs; inherit (common "x86_64-linux") cachix-deploy-lib;
in in
cachix-deploy-lib.nixos { cachix-deploy-lib.nixos {
imports = x86_64-linux-modules; imports = x86_64-linux-modules;
@ -136,7 +136,7 @@
agents = { agents = {
"fj-hetzner-aarch64-01" = "fj-hetzner-aarch64-01" =
let let
inherit (common "aarch64-linux") cachix-deploy-lib pkgs; inherit (common "aarch64-linux") cachix-deploy-lib;
in in
cachix-deploy-lib.nixos { cachix-deploy-lib.nixos {
# system = "aarch64-linux"; # system = "aarch64-linux";
@ -153,7 +153,7 @@
agents = { agents = {
"fj-shadowfax-01" = "fj-shadowfax-01" =
let let
inherit (common "x86_64-linux") cachix-deploy-lib pkgs; inherit (common "x86_64-linux") cachix-deploy-lib;
in in
cachix-deploy-lib.nixos { cachix-deploy-lib.nixos {
imports = x86_64-linux-modules; imports = x86_64-linux-modules;

View file

@ -1,32 +1,15 @@
# Shell for bootstrapping flake-enabled nix and home-manager # Shell for bootstrapping flake-enabled nix and home-manager
{ pkgs ? let { pkgs ? import <nixpkgs> {} }:
# If pkgs is not defined, instantiate nixpkgs from locked commit
lock = (builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked;
nixpkgs = fetchTarball {
url = "https://github.com/nixos/nixpkgs/archive/${lock.rev}.tar.gz";
sha256 = lock.narHash;
};
system = builtins.currentSystem;
overlays = [ ]; # Explicit blank overlay to avoid interference
in
import nixpkgs { inherit system overlays; }
, ...
}:
let
in
pkgs.mkShell { pkgs.mkShell {
# Enable experimental features without having to specify the argument # Enable experimental features without having to specify the argument
NIX_CONFIG = "experimental-features = nix-command flakes"; NIX_CONFIG = "experimental-features = nix-command flakes";
nativeBuildInputs = with pkgs; [ nativeBuildInputs = with pkgs; [
nix
home-manager
git git
nil
nixpkgs-fmt
go-task go-task
sops sops
pre-commit pre-commit
gitleaks gitleaks
statix
]; ];
} }