refactor: optimisations #196
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - '**.md' | |
| - 'LICENSE*' | |
| - '.git*' | |
| - '.envrc' | |
| - 'garnix.yaml' | |
| - '.github/workflows/ci.yml' | |
| tags: [v*] | |
| workflow_dispatch: | |
| jobs: | |
| pwa: | |
| if: github.ref == 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/v') | |
| timeout-minutes: 15 | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| lfs: true | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| extra_nix_config: | | |
| extra-substituters = https://cache.garnix.io | |
| extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g= | |
| - uses: DeterminateSystems/magic-nix-cache-action@v13 | |
| - run: sleep 5 # Sleep hoping Garnix evaluation will start after | |
| - uses: lewagon/wait-on-check-action@v1.5.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| check-regexp: 'Evaluate flake.nix' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| fail-on-no-checks: false | |
| allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral | |
| - uses: lewagon/wait-on-check-action@v1.5.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| check-regexp: 'package web.*' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| fail-on-no-checks: false | |
| allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral | |
| - run: nix build .#web -o dist | |
| - uses: actions/upload-pages-artifact@v4 | |
| with: { path: ./dist/LogOut } | |
| - uses: actions/deploy-pages@v4 | |
| id: deployment | |
| android-release: | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: write # Required by 'gh release' | |
| checks: read # Required by wait-on-check-action | |
| statuses: read # Required by wait-on-check-action | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| lfs: true | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| extra_nix_config: | | |
| extra-substituters = https://cache.garnix.io | |
| extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g= | |
| - uses: DeterminateSystems/magic-nix-cache-action@v13 | |
| - run: sleep 5 # Sleep hoping Garnix evaluation will start after | |
| - uses: lewagon/wait-on-check-action@v1.5.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| check-regexp: 'Evaluate flake.nix' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| fail-on-no-checks: false | |
| allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral | |
| - uses: lewagon/wait-on-check-action@v1.5.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| check-regexp: 'devShell.*linux.*' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| fail-on-no-checks: false | |
| allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral | |
| - uses: timheuer/base64-to-file@v1.2.4 | |
| with: | |
| fileName: 'logout.jks' | |
| encodedString: ${{ secrets.ANDROID_KEYSTORE_B64 }} | |
| id: keystore | |
| - run: nix run .#androidBuild | |
| env: | |
| ANDROID_KEYSTORE_PATH: ${{ steps.keystore.outputs.filePath }} | |
| ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }} | |
| - name: Publish Semantically Versionned Release | |
| run: | | |
| TAG=${GITHUB_REF#refs/tags/} | |
| gh release create "$TAG" *.apk --title "$TAG" --notes "Release $TAG" | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| check-tag: | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| is_tagged: ${{ steps.check.outputs.is_tagged }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - id: check | |
| run: | | |
| if git describe --tags --exact-match HEAD >/dev/null 2>&1; then | |
| echo "is_tagged=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "is_tagged=false" >> $GITHUB_OUTPUT | |
| fi | |
| android-prerelease: | |
| needs: check-tag | |
| if: github.ref == 'refs/heads/main' && needs.check-tag.outputs.is_tagged == 'false' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: write # Required by 'gh release' | |
| checks: read # Required by wait-on-check-action | |
| statuses: read # Required by wait-on-check-action | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| lfs: true | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| extra_nix_config: | | |
| extra-substituters = https://cache.garnix.io | |
| extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g= | |
| - uses: DeterminateSystems/magic-nix-cache-action@v13 | |
| - run: sleep 5 # Sleep hoping Garnix evaluation will start after | |
| - uses: lewagon/wait-on-check-action@v1.5.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| check-regexp: 'Evaluate flake.nix' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| fail-on-no-checks: false | |
| allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral | |
| - uses: lewagon/wait-on-check-action@v1.5.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| check-regexp: 'devShell.*linux.*' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| fail-on-no-checks: false | |
| allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral | |
| - uses: timheuer/base64-to-file@v1.2.4 | |
| with: | |
| fileName: 'logout.jks' | |
| encodedString: ${{ secrets.ANDROID_KEYSTORE_B64 }} | |
| id: keystore | |
| - run: nix run .#androidBuild | |
| env: | |
| ANDROID_KEYSTORE_PATH: ${{ steps.keystore.outputs.filePath }} | |
| ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }} | |
| - name: Publish Timestamped Pre-release # If no SemVer tag on last commit | |
| run: | | |
| NOW=$(date -u +"%Y-%m-%d") | |
| read -r OLD_TAG CREATED_AT <<< "$(gh release list \ | |
| --json tagName,createdAt,isPrerelease --limit 1 \ | |
| --jq '.[]|select(.isPrerelease == true)|"\(.tagName) \(.createdAt)"')" | |
| if [ -z "$CREATED_AT" ] || | |
| [ "$(date -d "$CREATED_AT" +%s)" -le "$(date -d '2 days ago' +%s)" ] | |
| then | |
| gh release create "pre-$NOW" *.apk --prerelease \ | |
| --title "$NOW" --notes "Automated pre-release for $NOW" | |
| fi | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| cleanup: | |
| if: github.ref == 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/v') | |
| timeout-minutes: 5 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - run: | # Cleanup rolling releases > 7 days or < 12 hours | |
| gh release list --json tagName,createdAt,isPrerelease --limit 100 \ | |
| --jq '.[]|select(.isPrerelease == true)|"\(.tagName) \(.createdAt)"' \ | |
| | while read -r OLD_TAG CREATED_AT; do | |
| TIMESTAMP=$(date -d "$CREATED_AT" +%s) | |
| if [ "$TIMESTAMP" -lt "$(date -d '14 days ago' +%s)" ]; then | |
| gh release delete "$OLD_TAG" --yes --cleanup-tag | |
| fi | |
| done | |
| env: | |
| GH_TOKEN: ${{ github.token }} |