jory
ca4a0b23ab
- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/ X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail upstream copies via header_down on mail.severijnse.eu - tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync _25/_465/_993, fail-safe placeholders; coredns zone updated - pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint, ...); CI pre-commit job over x86_64 + aarch64 matrix - gitea: enable Gitea Actions + self-hosted runner (native:host, aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook - fix statix warnings (merge repeated systemd/database/configFile keys, inherit, bool-compare guards); add missing trailing newlines
80 lines
2.6 KiB
YAML
80 lines
2.6 KiB
YAML
# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
|
|
# https://github.com/cachix/install-nix-action
|
|
# (README: "Flakes CI workflow with nix build and flake check")
|
|
# Every action used here (actions/checkout) is from an official GitHub repo.
|
|
#
|
|
# Adaptations for Gitea Actions:
|
|
# * runs-on: native - Gitea's self-hosted native runner. cachix/install-nix-action
|
|
# explicitly supports self-hosted runners, and this runner's host already provides
|
|
# Nix (Lix), so the installer step is omitted and flakes are enabled via NIX_CONFIG
|
|
# (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
|
|
# * The native runner only puts its `hostPackages` on PATH, which does NOT include Nix.
|
|
# Each job therefore exports the host's system Nix (/run/current-system/sw/bin) onto
|
|
# PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
|
|
# second Nix client that would mismatch the running Lix daemon.
|
|
# * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
|
|
# * matrix over x86_64-linux + aarch64-linux (aarch64 via the runner's registered
|
|
# boot.binfmt.emulatedSystems).
|
|
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
# Least-privilege by default; jobs opt into what they need.
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
env:
|
|
NIX_CONFIG: experimental-features = nix-command flakes
|
|
|
|
jobs:
|
|
flake-check:
|
|
name: Flake check (${{ matrix.system }})
|
|
runs-on: native
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
system:
|
|
- x86_64-linux
|
|
- aarch64-linux
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Flake check (${{ matrix.system }})
|
|
run: |
|
|
export PATH=/run/current-system/sw/bin:$PATH
|
|
nix flake check --no-build --system ${{ matrix.system }}
|
|
|
|
pre-commit:
|
|
name: Pre-commit checks (${{ matrix.system }})
|
|
runs-on: native
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
system:
|
|
- x86_64-linux
|
|
- aarch64-linux
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Pre-commit checks (${{ matrix.system }})
|
|
run: |
|
|
export PATH=/run/current-system/sw/bin:$PATH
|
|
nix build .#checks.${{ matrix.system }}.pre-commit
|