chore: enable CI #1
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: "push: build and cache devShells" | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| jobs: | |
| artifacts: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| id-token: write | |
| contents: write | |
| strategy: | |
| matrix: | |
| platform: | |
| - aarch64 | |
| fail-fast: true | |
| steps: | |
| - name: "Check out repository" | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ inputs.GIT_REF }} | |
| token: ${{ secrets.GIT_TOKEN }} | |
| submodules: true | |
| - name: Configure aws | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: arn:aws:iam::${{ secrets.AWS_PRODUCTION_CORE_ACCOUNT_ID }}:role/github-actions-nhost-${{ github.event.repository.name }} | |
| aws-region: eu-central-1 | |
| - uses: nixbuild/nix-quick-install-action@v26 | |
| with: | |
| nix_version: 2.16.2 | |
| nix_conf: | | |
| experimental-features = nix-command flakes | |
| sandbox = false | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| substituters = https://cache.nixos.org/?priority=40 s3://nhost-nix-cache?region=eu-central-1&priority=50 | |
| trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= ${{ secrets.NIX_CACHE_PUB_KEY }} | |
| builders-use-substitutes = true | |
| - name: "Setup nix-remote-builder" | |
| uses: dbarrosop/[email protected] | |
| id: nix-remote-builder | |
| with: | |
| name: ${{ inputs.NAME }}-${{ inputs.GIT_REF }} | |
| ami: ami-0a6fe6f4f55f8421a | |
| instance-type: 't4g.xlarge' | |
| region: "eu-central-1" | |
| availability-zone: "eu-central-1c" | |
| ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| - name: "Setup nix-remote-builder in nix.conf" | |
| run: | | |
| echo "builders = ssh://${{ steps.nix-remote-builder.outputs.publicDnsName }} aarch64-linux;" >> ~/.config/nix/nix.conf | |
| if: ${{ ( matrix.platform == 'aarch64' ) && steps.verify-build.outputs.BUILD_NEEDED == 'yes' }} | |
| - name: Cache nix store | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| /nix/store/** | |
| /nix/var/nix/*/* | |
| /nix/var/nix/db/* | |
| /nix/var/nix/db/*/** | |
| !/nix/var/nix/daemon-socket/socket | |
| !/nix/var/nix/userpool/* | |
| !/nix/var/nix/gc.lock | |
| !/nix/var/nix/db/big-lock | |
| !/nix/var/nix/db/reserved | |
| key: nix-${{ inputs.NAME }}-build-${{ runner.os }}-${{ matrix.platform }}-${{ hashFiles('nix/**.nix', 'flake.nix', 'flake.lock', '${{ inputs.PROJECT }}/**.nix') }} | |
| restore-keys: nix-${{ inputs.NAME }}-build-${{ runner.OS }}-${{ matrix.platform }}-main | |
| if: ${{ steps.verify-build.outputs.BUILD_NEEDED == 'yes' }} | |
| - uses: docker/setup-qemu-action@v3 | |
| if: ${{ ( matrix.platform == 'aarch64' ) }} | |
| - name: "Wait for remote builder to be ready" | |
| run: | | |
| set +e | |
| max_attempts=6 | |
| retry_interval=10 | |
| attempt=1 | |
| while [ "$attempt" -le "$max_attempts" ]; do | |
| echo "Checking SSH connection (attempt $attempt)..." | |
| nc -zv ${{ steps.nix-remote-builder.outputs.publicDnsName }} 22 | |
| if [ $? -eq 0 ]; then | |
| echo "success" | |
| break | |
| else | |
| echo "SSH connection failed." | |
| if [ "$attempt" -lt "$max_attempts" ]; then | |
| echo "Retrying in $retry_interval seconds..." | |
| sleep "$retry_interval" | |
| else | |
| echo "Exceeded maximum connection attempts." | |
| exit 1 | |
| fi | |
| fi | |
| ((attempt++)) | |
| done | |
| if: ${{ ( matrix.platform == 'aarch64' ) && steps.verify-build.outputs.BUILD_NEEDED == 'yes' }} | |
| - name: "Cache nix store on s3" | |
| run: | | |
| echo ${{ secrets.NIX_CACHE_PRIV_KEY }} > cache-priv-key.pem | |
| nix build .\#devShells.${{ matrix.platform }}-linux.default | |
| nix store sign --key-file cache-priv-key.pem --all | |
| nix copy --to s3://nhost-nix-cache\?region=eu-central-1 .\#devShells.${{ matrix.platform }}-linux.default | |
| - run: rm cache-priv-key.pem || echo "file not found" | |
| if: always() |