67 lines
2.5 KiB
YAML
67 lines
2.5 KiB
YAML
# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
|
|
# https://github.com/cachix/install-nix-action
|
|
# (README: "Flakes CI workflow with nix build and flake check")
|
|
# Every action used here (actions/checkout) is from an official GitHub repo.
|
|
#
|
|
# Adaptations for Gitea Actions:
|
|
# * runs-on: native - Gitea's self-hosted native runner. cachix/install-nix-action
|
|
# explicitly supports self-hosted runners, and this runner's host already provides
|
|
# Nix (Lix), so the installer step is omitted and flakes are enabled via NIX_CONFIG
|
|
# (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
|
|
# * The native runner only puts its `hostPackages` on PATH, which does NOT include Nix.
|
|
# Each job therefore exports the host's system Nix (/run/current-system/sw/bin) onto
|
|
# PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
|
|
# second Nix client that would mismatch the running Lix daemon.
|
|
# * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
|
|
# * matrix over x86_64-linux + aarch64-linux.
|
|
# All jobs use --no-build (eval-only) because the runner has 2 cores / 4GB RAM:
|
|
# building nix derivations would exhaust memory and crash the server.
|
|
# Pre-commit hooks run locally via git-hooks-nix on the developer's machine.
|
|
# * aarch64 builds need QEMU binfmt (boot.binfmt.emulatedSystems) + nix extra-platforms,
|
|
# which require a nixos-rebuild switch not yet applied. Flake-check for aarch64
|
|
# runs eval-only (no build) and passes.
|
|
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
# Least-privilege by default; jobs opt into what they need.
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
env:
|
|
NIX_CONFIG: |
|
|
experimental-features = nix-command flakes
|
|
extra-platforms = aarch64-linux
|
|
|
|
jobs:
|
|
flake-check:
|
|
name: Flake check (${{ matrix.system }})
|
|
runs-on: native
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
system:
|
|
- x86_64-linux
|
|
- aarch64-linux
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Flake check (${{ matrix.system }})
|
|
run: |
|
|
export PATH=/run/current-system/sw/bin:$PATH
|
|
nix flake check --no-build --system ${{ matrix.system }}
|