mirror of
https://github.com/DeterminateSystems/magic-nix-cache-action.git
synced 2024-12-27 01:30:35 +01:00
9ab3ce70d6
* Update `detsys-ts` for: `Merge pull request #67 from DeterminateSystems/allow-obliterating-id-token-privs` (`4280bc94c9545f31ccf08001cc16f20ccb91b770`) * Update the defaults / docs on the use-flakehub and use-gha-cache options * Support the MNC trinary, to allow GHA cache to turn off if FHC is enabled * let's go? * arg, you can't parameterize the permissions * don't fail fast * Maybe if we bust the token sooner..? * Clearer job names * Debug... * ? * ...? * ? * fancy it up * more seed * Test against determinate too * ... * derp, obliterate * Identify the failed-to-setup FHC as not being enabled * Don't fail on github if the cache is throttled * derp * Add a success job for the ci workflow --------- Co-authored-by: grahamc <76716+grahamc@users.noreply.github.com>
139 lines
4.3 KiB
YAML
139 lines
4.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
merge_group:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
name: Build
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Nix
|
|
uses: DeterminateSystems/nix-installer-action@main
|
|
- uses: DeterminateSystems/magic-nix-cache-action@main
|
|
- name: Check shell scripts
|
|
run: |
|
|
nix develop --command shellcheck ./.github/workflows/cache-test.sh
|
|
- uses: DeterminateSystems/nix-installer-action@main
|
|
- name: Install pnpm dependencies
|
|
run: nix develop --command pnpm install
|
|
- name: Check formatting
|
|
run: nix develop --command pnpm run check-fmt
|
|
- name: Lint
|
|
run: nix develop --command pnpm run lint
|
|
- name: Build
|
|
run: nix develop --command pnpm run build
|
|
- name: Package
|
|
run: nix develop --command pnpm run package
|
|
- run: git status --porcelain=v1
|
|
- run: git diff --exit-code
|
|
|
|
test-no-nix:
|
|
needs: build
|
|
name: "Test: Nix not installed"
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
id-token: "write"
|
|
contents: "read"
|
|
env:
|
|
ACTIONS_STEP_DEBUG: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Cache the store
|
|
uses: ./
|
|
with:
|
|
_internal-strict-mode: true
|
|
|
|
run-x86_64-linux-untrusted:
|
|
needs: build
|
|
name: Run x86_64-linux, Untrusted
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
id-token: "write"
|
|
contents: "read"
|
|
env:
|
|
ACTIONS_STEP_DEBUG: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Nix
|
|
uses: DeterminateSystems/nix-installer-action@main
|
|
with:
|
|
flakehub: true
|
|
extra-conf: |
|
|
narinfo-cache-negative-ttl = 0
|
|
trusted-users = root
|
|
- name: Cache the store
|
|
uses: ./
|
|
with:
|
|
_internal-strict-mode: true
|
|
|
|
run-systems:
|
|
if: github.event_name == 'merge_group'
|
|
needs: build
|
|
name: "Test: ${{ matrix.systems.nix-system }} gha:${{matrix.use-gha-cache}},fhc:${{matrix.use-flakehub}},id:${{matrix.id-token}},determinate:${{matrix.determinate}}"
|
|
runs-on: "${{ matrix.systems.runner }}"
|
|
permissions:
|
|
id-token: "write"
|
|
contents: "read"
|
|
env:
|
|
ACTIONS_STEP_DEBUG: true
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
determinate: [true, false]
|
|
use-gha-cache: ["disabled", "no-preference", "enabled"]
|
|
use-flakehub: ["disabled", "no-preference", "enabled"]
|
|
id-token: ["write", "none"]
|
|
systems:
|
|
- nix-system: "aarch64-darwin"
|
|
runner: "macos-latest"
|
|
- nix-system: "x86_64-darwin"
|
|
runner: "macos-13"
|
|
- nix-system: "aarch64-linux"
|
|
runner: "namespace-profile-default-arm64"
|
|
- nix-system: "x86_64-linux"
|
|
runner: "ubuntu-22.04"
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Nix on ${{ matrix.systems.nix-system }} system
|
|
uses: DeterminateSystems/nix-installer-action@main
|
|
with:
|
|
_internal-obliterate-actions-id-token-request-variables: ${{ matrix.id-token == 'none' }}
|
|
determinate: ${{ matrix.determinate }}
|
|
extra-conf: |
|
|
narinfo-cache-negative-ttl = 0
|
|
- name: Cache the store
|
|
uses: ./
|
|
with:
|
|
_internal-strict-mode: true
|
|
_internal-obliterate-actions-id-token-request-variables: ${{ matrix.id-token == 'none' }}
|
|
use-gha-cache: ${{ matrix.use-gha-cache }}
|
|
use-flakehub: ${{ matrix.use-flakehub }}
|
|
- name: Check the cache for liveness
|
|
env:
|
|
EXPECT_FLAKEHUB: ${{ toJson(matrix.use-flakehub != 'disabled' && matrix.id-token == 'write') }}
|
|
EXPECT_GITHUB_CACHE: ${{ toJson(
|
|
(matrix.use-gha-cache != 'disabled')
|
|
&& (
|
|
(!(matrix.use-flakehub != 'disabled' && matrix.id-token == 'write'))
|
|
|| (matrix.use-gha-cache == 'enabled')
|
|
)
|
|
) }}
|
|
run: |
|
|
.github/workflows/cache-test.sh
|
|
|
|
success:
|
|
runs-on: ubuntu-latest
|
|
needs: run-systems
|
|
steps:
|
|
- run: "true"
|
|
- run: |
|
|
echo "A dependent in the build matrix failed."
|
|
exit 1
|
|
if: |
|
|
contains(needs.*.result, 'failure') ||
|
|
contains(needs.*.result, 'cancelled')
|