jory
7ed54e51a2
- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/ X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail upstream copies via header_down on mail.severijnse.eu - tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync _25/_465/_993, fail-safe placeholders; coredns zone updated - pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint, ...); CI pre-commit job over x86_64 + aarch64 matrix - gitea: enable Gitea Actions + self-hosted runner (native:host, aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook - fix statix warnings (merge repeated systemd/database/configFile keys, inherit, bool-compare guards); add missing trailing newlines
75 lines
2.4 KiB
YAML
75 lines
2.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
# Least-privilege by default; jobs opt into what they need.
|
|
permissions: {}
|
|
|
|
# Cancel superseded runs on the same ref.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
jobs:
|
|
check:
|
|
name: Flake check (${{ matrix.system }})
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
system:
|
|
- x86_64-linux
|
|
- aarch64-linux
|
|
# Match the architecture to a native runner, exactly like nixpkgs
|
|
# (its treefmt/parse/owners jobs run on ubuntu-24.04-arm).
|
|
runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
|
|
with:
|
|
extra_nix_config: |
|
|
experimental-features = nix-command flakes
|
|
|
|
# Evaluate the flake for this system (incl. nixosConfigurations) without
|
|
# building. Catches the class of break we hit with the duplicate module block.
|
|
- name: Flake check (${{ matrix.system }})
|
|
run: nix flake check --no-build --system ${{ matrix.system }}
|
|
|
|
pre-commit:
|
|
name: Pre-commit checks (${{ matrix.system }})
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
system:
|
|
- x86_64-linux
|
|
- aarch64-linux
|
|
runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
|
|
with:
|
|
extra_nix_config: |
|
|
experimental-features = nix-command flakes
|
|
|
|
# Build the pre-commit check derivation: runs alejandra (--check),
|
|
# statix, deadnix, actionlint and the pre-commit-hooks suite
|
|
# (trailing-whitespace, end-of-file-fixer, check-yaml/toml,
|
|
# check-added-large-files, check-merge-conflicts, detect-private-keys)
|
|
# in a read-only sandbox. Fails the build on any reported problem.
|
|
- name: Pre-commit checks (${{ matrix.system }})
|
|
run: nix build .#checks.${{ matrix.system }}.pre-commit
|