Skip to content

Commit 9444e66

Browse files
gfauredevgfauredev
committed
cicd: github flows using nix and garnix caches
1 parent a81a92f commit 9444e66

5 files changed

Lines changed: 277 additions & 0 deletions

File tree

‎.github/copilot-instructions.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Check out the README and other documentation material.
2+
3+
Respect coding conventions or guidelines you found, especially about processes.
4+
5+
This project uses a development environment, defined in `flake.nix`, providing
6+
all the dependencies and tools needed for development. Enter it with
7+
`nix develop`.

‎.github/workflows/cd.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
on:
2+
push:
3+
branches:
4+
- main
5+
tags:
6+
- 'v*'
7+
workflow_dispatch: # Allow manual trigger
8+
9+
permissions:
10+
pull-requests: write
11+
contents: read
12+
issues: write
13+
checks: read
14+
statuses: read
15+
16+
jobs:
17+
nix:
18+
name: Wait for Garnix
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 30
21+
permissions:
22+
checks: read
23+
statuses: read
24+
steps:
25+
- uses: actions/checkout@v4
26+
- name: Sleep hoping Garnix evaluation will start after
27+
run: sleep 30
28+
- name: Wait for Garnix flake.nix evaluation
29+
uses: lewagon/wait-on-check-action@v1.5.0
30+
with:
31+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
32+
check-regexp: 'Evaluate flake.nix'
33+
repo-token: ${{ secrets.GITHUB_TOKEN }}
34+
- name: Wait for Garnix packages
35+
uses: lewagon/wait-on-check-action@v1.5.0
36+
with:
37+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
38+
check-regexp: 'package.*'
39+
repo-token: ${{ secrets.GITHUB_TOKEN }}
40+
fail-on-no-checks: false
41+
- uses: cachix/install-nix-action@v31.10.0
42+
with:
43+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
44+
extra_nix_config: |
45+
extra-substituters = https://cache.garnix.io
46+
extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
47+
- uses: DeterminateSystems/magic-nix-cache-action@v13
48+
49+
prerelease:
50+
name: Rolling Release
51+
runs-on: ubuntu-latest
52+
needs: nix
53+
timeout-minutes: 30
54+
if: github.ref == 'refs/heads/main'
55+
env:
56+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57+
steps:
58+
- name: Build
59+
run: nix build
60+
- name: Publish Rolling Release
61+
run: |
62+
DATE=$(date -u +%Y-%m-%d)
63+
TAG="rolling-$DATE"
64+
if gh release view "$TAG" >/dev/null 2>&1; then
65+
echo "Rolling release for $DATE already exists. Skipping."
66+
else
67+
gh release list --limit 100 | grep "rolling-" | while read -r line; do
68+
OLD_TAG=$(echo "$line" | awk '{print $1}')
69+
OLD_DATE=${OLD_TAG#rolling-}
70+
if [ "$(date -d "$OLD_DATE" +%s)" -lt "$(date -d "7 days ago" +%s)" ]; then
71+
gh release delete "$OLD_TAG" --yes --cleanup-tag
72+
fi
73+
done
74+
gh release create "$TAG" "SmartPianoEngine" --title "Rolling $DATE" --notes "Automated rolling release for $DATE" --prerelease
75+
fi
76+
77+
release:
78+
name: Stable Release
79+
runs-on: ubuntu-latest
80+
needs: nix
81+
timeout-minutes: 30
82+
if: startsWith(github.ref, 'refs/tags/v')
83+
env:
84+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85+
steps:
86+
- name: Build
87+
run: nix build
88+
- name: Publish Stable Release
89+
run: |
90+
TAG=${GITHUB_REF#refs/tags/}
91+
gh release create "$TAG" "SmartPianoEngine" --title "SmartPiano $TAG" --notes "Release $TAG"

‎.github/workflows/ci.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
on:
2+
pull_request:
3+
workflow_dispatch: # Allow manual trigger
4+
5+
permissions:
6+
pull-requests: write
7+
contents: read
8+
issues: write
9+
checks: read
10+
statuses: read
11+
12+
jobs:
13+
nix:
14+
name: Setup Nix Env
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 30
17+
permissions:
18+
checks: read
19+
statuses: read
20+
steps:
21+
- uses: actions/checkout@v4
22+
- name: Sleep hoping Garnix evaluation will start after
23+
run: sleep 30
24+
- name: Wait for Garnix flake.nix evaluation
25+
uses: lewagon/wait-on-check-action@v1.5.0
26+
with:
27+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
28+
check-regexp: 'Evaluate flake.nix'
29+
repo-token: ${{ secrets.GITHUB_TOKEN }}
30+
fail-on-no-checks: false
31+
- name: Wait for Garnix packages
32+
uses: lewagon/wait-on-check-action@v1.5.0
33+
with:
34+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
35+
check-regexp: 'check.*'
36+
repo-token: ${{ secrets.GITHUB_TOKEN }}
37+
fail-on-no-checks: false
38+
- uses: cachix/install-nix-action@v31.10.0
39+
with:
40+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
41+
extra_nix_config: |
42+
extra-substituters = https://cache.garnix.io
43+
extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
44+
- uses: DeterminateSystems/magic-nix-cache-action@v13
45+
46+
coverage:
47+
name: Unit Test measuring Coverage
48+
needs: nix
49+
runs-on: ubuntu-latest
50+
timeout-minutes: 5
51+
steps:
52+
- name: Run Unit Tests with Coverage (from Garnix cache)
53+
run: nix build .#checks.x86_64-linux.coverage -o coverage
54+
- name: Process Coverage Report
55+
id: coverage_report
56+
run: |
57+
HTML=$(grep -o "<table>.*</table>" coverage/html/index.html)
58+
TXT=$(cat coverage/coverage.txt)
59+
echo "REPORT<<EOF" >> $GITHUB_OUTPUT
60+
echo -e "$REPORT" >> $GITHUB_OUTPUT
61+
echo "EOF" >> $GITHUB_OUTPUT
62+
# TODO Process TXT to fail test if below 80% (or change to JSON)
63+
- name: Post Coverage Comment
64+
if: always() && github.event_name == 'pull_request'
65+
uses: peter-evans/create-or-update-comment@v4
66+
with:
67+
issue-number: ${{ github.event.pull_request.number }}
68+
body: |
69+
### 📊 Coverage Report
70+
71+
${{ steps.coverage_report.outputs.REPORT }}

‎.github/workflows/copilot-setup-steps.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
on:
2+
workflow_dispatch:
3+
push:
4+
paths:
5+
- .github/workflows/copilot-setup-steps.yml
6+
pull_request:
7+
paths:
8+
- .github/workflows/copilot-setup-steps.yml
9+
10+
jobs:
11+
copilot-setup-steps:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
16+
steps:
17+
- uses: actions/checkout@v5
18+
- uses: cachix/install-nix-action@v31.10.0
19+
with:
20+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
21+
extra_nix_config: |
22+
extra-substituters = https://cache.garnix.io
23+
extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
24+
- uses: DeterminateSystems/magic-nix-cache-action@v13
25+
- name: Install Project Dependencies
26+
run: nix develop --command cmake --build build
27+
continue-on-error: true

‎.github/workflows/nightly.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
on:
2+
schedule:
3+
- cron: '0 2 * * *' # TODO
4+
workflow_dispatch: # Allow manual trigger
5+
6+
permissions:
7+
pull-requests: write
8+
contents: read
9+
issues: write
10+
checks: read
11+
statuses: read
12+
13+
jobs:
14+
nix:
15+
name: Wait for Garnix
16+
runs-on: ubuntu-latest
17+
timeout-minutes: 30
18+
steps:
19+
- uses: actions/checkout@v4
20+
- name: Sleep hoping Garnix evaluation will start after
21+
run: sleep 30
22+
- name: Wait for Garnix flake.nix evaluation
23+
uses: lewagon/wait-on-check-action@v1.5.0
24+
with:
25+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
26+
check-regexp: 'Evaluate flake.nix'
27+
repo-token: ${{ secrets.GITHUB_TOKEN }}
28+
- name: Wait for Garnix packages
29+
uses: lewagon/wait-on-check-action@v1.5.0
30+
with:
31+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
32+
check-regexp: 'package.*'
33+
repo-token: ${{ secrets.GITHUB_TOKEN }}
34+
fail-on-no-checks: false
35+
- uses: cachix/install-nix-action@v31.10.0
36+
with:
37+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
38+
extra_nix_config: |
39+
extra-substituters = https://cache.garnix.io
40+
extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
41+
- uses: DeterminateSystems/magic-nix-cache-action@v13
42+
43+
update:
44+
name: Update Dependencies
45+
runs-on: ubuntu-latest
46+
timeout-minutes: 30
47+
needs: nix
48+
permissions:
49+
pull-requests: write
50+
steps:
51+
- name: Update flake inputs
52+
run: nix flake update
53+
# - name: Renovate bot ? TODO
54+
- name: Create Pull Request
55+
uses: peter-evans/create-pull-request@v7
56+
with:
57+
commit-message: 'chore: update flake.lock, check deps freshness'
58+
title: 'chore: update flake.lock, check deps freshness'
59+
body: Automated nightly update of Nix flake inputs and dependencies
60+
branch: nightly/update-deps
61+
delete-branch: true
62+
63+
audit:
64+
name: Dependency Audit
65+
runs-on: ubuntu-latest
66+
needs: nix
67+
timeout-minutes: 30
68+
steps:
69+
- name: Audit Dependencies
70+
run: echo TODO Audit dependencies
71+
72+
mutation:
73+
name: Mutation Testing
74+
runs-on: ubuntu-latest
75+
needs: nix
76+
timeout-minutes: 180
77+
steps:
78+
- name: Build
79+
run: nix build
80+
- name: Test Mutants
81+
run: echo TODO Full mutation testing

0 commit comments

Comments
 (0)