jory
7ed54e51a2
- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/ X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail upstream copies via header_down on mail.severijnse.eu - tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync _25/_465/_993, fail-safe placeholders; coredns zone updated - pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint, ...); CI pre-commit job over x86_64 + aarch64 matrix - gitea: enable Gitea Actions + self-hosted runner (native:host, aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook - fix statix warnings (merge repeated systemd/database/configFile keys, inherit, bool-compare guards); add missing trailing newlines
60 lines
1.7 KiB
YAML
60 lines
1.7 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
jobs:
|
|
flake-check:
|
|
runs-on: native
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
system: [x86_64-linux, aarch64-linux]
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Nix
|
|
run: |
|
|
curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
|
|
mkdir -p "$HOME/.config/nix"
|
|
echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
|
|
# shellcheck disable=SC1091
|
|
source "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
|
- name: Flake check (${{ matrix.system }})
|
|
run: |
|
|
# shellcheck disable=SC1091
|
|
source "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
|
nix flake check --no-build --system ${{ matrix.system }}
|
|
|
|
pre-commit:
|
|
runs-on: native
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
system: [x86_64-linux, aarch64-linux]
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Nix
|
|
run: |
|
|
curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
|
|
mkdir -p "$HOME/.config/nix"
|
|
echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
|
|
# shellcheck disable=SC1091
|
|
source "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
|
- name: Pre-commit checks (${{ matrix.system }})
|
|
run: |
|
|
# shellcheck disable=SC1091
|
|
source "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
|
nix build .#checks.${{ matrix.system }}.pre-commit
|