From 1f0ceec9e2f42805e6fb76f7caaf62b89c8ea57a Mon Sep 17 00:00:00 2001 From: Truxnell <9149206+truxnell@users.noreply.github.com> Date: Tue, 26 Mar 2024 21:52:02 +1100 Subject: [PATCH 1/4] feat: add diff --- .github/workflows/diff-pr.yaml | 129 +++++++++++++++++++++++++++++++++ 1 file changed, 129 insertions(+) create mode 100644 .github/workflows/diff-pr.yaml diff --git a/.github/workflows/diff-pr.yaml b/.github/workflows/diff-pr.yaml new file mode 100644 index 0000000..6874af0 --- /dev/null +++ b/.github/workflows/diff-pr.yaml @@ -0,0 +1,129 @@ +name: Pull Request +permissions: + pull-requests: write +on: + pull_request: + paths: + - .github/workflows/** + - "**.nix" + - "flake.lock" + +jobs: + build: + if: github.event.pull_request.draft == false + name: "Build ${{ matrix.target }}" + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + include: + - os: ubuntu-latest + target: pride + - os: ubuntu-latest + target: sloth + - os: ubuntu-latest + target: eden + - os: ubuntu-latest + target: wrath + + steps: + - name: Create nix mount point + if: contains(matrix.os, 'ubuntu') + run: sudo mkdir /nix + + - name: Maximize build space + uses: easimon/maximize-build-space@v10 + if: contains(matrix.os, 'ubuntu') + with: + root-reserve-mb: 512 + swap-size-mb: 1024 + build-mount-path: "/nix" + remove-dotnet: true + remove-android: true + remove-haskell: true + remove-docker-images: true + remove-codeql: true + overprovision-lvm: true + + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Install nix + uses: cachix/install-nix-action@v25 + with: + extra_nix_config: | + experimental-features = nix-command flakes + access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} + + - uses: cachix/cachix-action@v14 + with: + name: edeneast + skipPush: true + extraPullNames: nix-community + + - name: Garbage collect build dependencies + run: nix-collect-garbage + + - name: Fetch old system profile + run: nix build github:EdenEast/nyx#top.${{ matrix.target }} -v --log-format raw --profile ./profile + + - name: Add new system to profile + run: | + set -o pipefail + nix build .#top.${{ matrix.target }} --profile ./profile --show-trace --fallback -v --log-format raw > >(tee stdout.log) 2> >(tee /tmp/nix-build-err.log >&2) + + - name: Output build failure + if: failure() + run: | + drv=$(grep "For full logs, run" /tmp/nix-build-err.log | grep -oE "/nix/store/.*.drv") + if [ -n $drv ]; then + nix log $drv + echo $drv + fi + exit 1 + + - name: Diff profile + id: diff + run: | + nix profile diff-closures --profile ./profile + delimiter="$(openssl rand -hex 16)" + echo "diff<<${delimiter}" >> "${GITHUB_OUTPUT}" + nix profile diff-closures --profile ./profile | perl -pe 's/\e\[[0-9;]*m(?:\e\[K)?//g' >> "${GITHUB_OUTPUT}" + echo "${delimiter}" >> "${GITHUB_OUTPUT}" + + - name: Scan for security issues + id: security + run: | + nix run nixpkgs/nixos-unstable#vulnix -- -w https://raw.githubusercontent.com/ckauhaus/nixos-vulnerability-roundup/master/whitelists/nixos-unstable.toml ./profile | tee /tmp/security.txt + OUTPUT_SECURITY="$(cat /tmp/security.txt)" + OUTPUT_SECURITY="${OUTPUT_SECURITY//'%'/'%25'}" + OUTPUT_SECURITY="${OUTPUT_SECURITY//$'\n'/'%0A'}" + OUTPUT_SECURITY="${OUTPUT_SECURITY//$'\r'/'%0D'}" + echo "$OUTPUT_SECURITY" + + delimiter="$(openssl rand -hex 16)" + echo "security<<${delimiter}" >> "${GITHUB_OUTPUT}" + echo "$OUTPUT_SECURITY" >> "${GITHUB_OUTPUT}" + echo "${delimiter}" >> "${GITHUB_OUTPUT}" + + - name: Comment report in pr + uses: marocchino/sticky-pull-request-comment@v2 + if: ${{ !startswith(github.ref, 'dependabot') }} + with: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + header: ".#top.${{ matrix.target }}" + message: | + ### Report for `${{ matrix.target }}` + +
+ Version changes
+ 
 ${{ steps.diff.outputs.diff }}
+
+ +
+ Security vulnerability report
+ 
 ${{ steps.security.outputs.security }}
+
+ +# Liberated from edeneast's github \ No newline at end of file From 38dbb56c597c1764a729839d5b2038c8c1f2dbb5 Mon Sep 17 00:00:00 2001 From: truxnell <19149206+truxnell@users.noreply.github.com> Date: Tue, 26 Mar 2024 22:11:11 +1100 Subject: [PATCH 2/4] fix readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d79bf0a..8955f1f 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ [![NixOS](https://img.shields.io/badge/NIXOS-5277C3.svg?style=for-the-badge&logo=NixOS&logoColor=white)](https://nixos.org) [![NixOS](https://img.shields.io/badge/NixOS-23.11-blue?style=flat&logo=nixos&logoColor=white)](https://nixos.org) [![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Ftruxnell%2Fnix-config%3Fbranch%3Dmain)](https://garnix.io) -[![MIT License](https://img.shields.io/github/license/truxnell/nix-config)][mit] +[![MIT License](https://img.shields.io/github/license/truxnell/nix-config)](https://github.com/truxnell/nix-config/blob/ci/LICENSE) Leveraging nix, nix-os to apply machine and home configurations From 75752792add35d357824d2f0469489eb3d829c32 Mon Sep 17 00:00:00 2001 From: truxnell <19149206+truxnell@users.noreply.github.com> Date: Tue, 26 Mar 2024 22:21:39 +1100 Subject: [PATCH 3/4] fix doc --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 8955f1f..df90fe3 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,10 @@ # Truxnell's homelab [![NixOS](https://img.shields.io/badge/NIXOS-5277C3.svg?style=for-the-badge&logo=NixOS&logoColor=white)](https://nixos.org) -[![NixOS](https://img.shields.io/badge/NixOS-23.11-blue?style=flat&logo=nixos&logoColor=white)](https://nixos.org) +[![NixOS](https://img.shields.io/badge/NixOS-23.11-blue?style=for-the-badge&logo=nixos&logoColor=white)](https://nixos.org) +[![MIT License](https://img.shields.io/github/license/truxnell/nix-config?style=for-the-badge)](https://github.com/truxnell/nix-config/blob/ci/LICENSE) + [![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Ftruxnell%2Fnix-config%3Fbranch%3Dmain)](https://garnix.io) -[![MIT License](https://img.shields.io/github/license/truxnell/nix-config)](https://github.com/truxnell/nix-config/blob/ci/LICENSE) Leveraging nix, nix-os to apply machine and home configurations From 2110750d7bd6243cb40d37d7cf56daf31ee24928 Mon Sep 17 00:00:00 2001 From: truxnell <19149206+truxnell@users.noreply.github.com> Date: Tue, 26 Mar 2024 22:36:56 +1100 Subject: [PATCH 4/4] feat: add renovate --- .github/renovate.json | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .github/renovate.json diff --git a/.github/renovate.json b/.github/renovate.json new file mode 100644 index 0000000..eb02204 --- /dev/null +++ b/.github/renovate.json @@ -0,0 +1,24 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "github>truxnell/renovate-config", + "github>truxnell/renovate-config:automerge-github-actions", + "github>aquaproj/aqua-renovate-config#2.2.0", + "github>aquaproj/aqua-renovate-config:installer-script#2.2.0(install-aqua\\.sh)", + "github>aquaproj/aqua-renovate-config:file#2.2.0(^aqua/.*\\.ya?ml$)" + ], + "platform": "github", + "username": "trux-bot[bot]", + "gitAuthor": "Trux-Bot <19149206+trux-bot[bot]@users.noreply.github.com>", + "repositories": ["truxnell/nix-config"], + "ignoreTests": false, + + // TODO remove once out of beta? + // https://docs.renovatebot.com/modules/manager/nix/ + "nix": { + "enabled": true + }, + "lockFileMaintenance": { + "enabled": true + }, + } \ No newline at end of file