f3fa5fcf13
All checks were successful
CI / check (push) Successful in 4m0s
CI / build-and-cache (custom-app-launcher-server) (push) Successful in 2m28s
CI / build-and-cache (custom-claude-code) (push) Successful in 2m27s
CI / build-and-cache (custom-mcrcon-rbw) (push) Successful in 2m18s
CI / build-and-cache (custom-rclone-torbox-setup) (push) Successful in 2m23s
CI / build-and-cache (custom-tea-rbw) (push) Successful in 3m32s
CI / build-and-cache (qt-pinned-jellyfin-media-player) (push) Successful in 3m42s
Creates symlinks in /nix/var/nix/gcroots/ci-cache/ for each pushed package
73 lines
2.4 KiB
YAML
73 lines
2.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
|
|
|
|
- name: Check flake
|
|
run: nix flake check
|
|
env:
|
|
NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
|
|
|
|
build-and-cache:
|
|
runs-on: ubuntu-latest
|
|
needs: check
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
package:
|
|
- custom-claude-code
|
|
- custom-app-launcher-server
|
|
- custom-mcrcon-rbw
|
|
- custom-tea-rbw
|
|
- custom-rclone-torbox-setup
|
|
- qt-pinned-jellyfin-media-player
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
|
|
|
|
- name: Build ${{ matrix.package }}
|
|
id: build
|
|
run: |
|
|
OUT_PATH=$(nix build .#${{ matrix.package }} --no-link --print-out-paths)
|
|
echo "out_path=$OUT_PATH" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
|
|
|
|
- name: Sign and push to cache
|
|
run: |
|
|
# Write signing key
|
|
echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
|
|
chmod 600 /tmp/signing-key
|
|
|
|
# Sign the closure
|
|
nix store sign --key-file /tmp/signing-key -r "${{ steps.build.outputs.out_path }}"
|
|
|
|
# Setup SSH key for cache push
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
|
|
chmod 600 ~/.ssh/cache_key
|
|
ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
|
|
# Push to cache
|
|
nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "${{ steps.build.outputs.out_path }}"
|
|
|
|
# Create GC root to prevent garbage collection
|
|
OUT_HASH=$(basename "${{ steps.build.outputs.out_path }}" | cut -d'-' -f1)
|
|
ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
|
|
"mkdir -p /nix/var/nix/gcroots/ci-cache && ln -sfn ${{ steps.build.outputs.out_path }} /nix/var/nix/gcroots/ci-cache/${OUT_HASH}"
|
|
env:
|
|
NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
|