Update cachix/install-nix-action digest to 13d8dd5 #199
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: latest-build-nixos | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| paths: | |
| - .devcontainer/nixos/** | |
| - .github/workflows/build-push-latest-nixos.yaml | |
| branches: | |
| - develop | |
| - main | |
| push: | |
| tags: | |
| - v* | |
| paths: | |
| - .devcontainer/nixos/** | |
| - .github/workflows/build-push-latest-nixos.yaml | |
| branches: | |
| - develop | |
| - main | |
| jobs: | |
| nix-build: | |
| # Note: NixOS builds require KVM for runAsRoot in dockerTools.buildImage | |
| # aarch64-linux: self-hosted runner with KVM support | |
| # x86_64-linux: GitHub-hosted runner | |
| runs-on: ${{ matrix.nix_system == 'aarch64-linux' && fromJSON('["self-hosted", "Linux", "ARM64"]') || 'ubuntu-24.04' }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| nix_system: | |
| - "x86_64-linux" | |
| - "aarch64-linux" | |
| nix_channel: | |
| - nixos_channel: "nixos-25.11" | |
| home_manager_version_string: "release-25.11" | |
| default_tag: true | |
| - nixos_channel: "nixos-unstable" | |
| home_manager_version_string: "master" | |
| default_tag: false | |
| steps: | |
| - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4 | |
| - name: Set up PATH for NixOS (self-hosted) | |
| if: matrix.nix_system == 'aarch64-linux' | |
| run: echo "/run/current-system/sw/bin" >> $GITHUB_PATH | |
| - name: Set up QEMU | |
| if: matrix.nix_system != 'aarch64-linux' | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31 | |
| if: matrix.nix_system != 'aarch64-linux' | |
| with: | |
| nix_path: nixpkgs=channel:${{ matrix.nix_channel.nixos_channel }} | |
| extra_nix_config: | | |
| filter-syscalls = false | |
| experimental-features = nix-command flakes | |
| extra-platforms = aarch64-linux | |
| - uses: DeterminateSystems/flakehub-cache-action@main | |
| - name: Login to Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Update flake inputs to ${{ matrix.nix_channel.nixos_channel }} | |
| working-directory: .devcontainer/nixos | |
| run: nix flake update | |
| - name: Nix build NixOS devcontainer image (${{ matrix.nix_system }}) | |
| working-directory: .devcontainer/nixos | |
| run: | | |
| nix build '.#packages.${{ matrix.nix_system }}.layeredImage' | |
| - name: Load image into Docker and push (${{ matrix.nix_system }}) | |
| if: ${{ github.event.pull_request.base.repo.url == github.event.pull_request.head.repo.url || github.event_name == 'push' || github.event_name == 'workflow_dispatch' }} | |
| working-directory: .devcontainer/nixos | |
| run: | | |
| export loaded_tag=$(cat ./result | docker load | awk '/Loaded image/{print $NF}') | |
| echo "Loaded image: $loaded_tag" | |
| TARGET_TAG="ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---${{ matrix.nix_system }}" | |
| docker tag "$loaded_tag" "$TARGET_TAG" | |
| docker push "$TARGET_TAG" | |
| # Also push a channel-level tag on main/develop (no arch suffix) | |
| if [[ "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == "refs/heads/develop" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then | |
| BRANCH_LABEL=$( [[ "${{ github.ref }}" == "refs/heads/main" ]] && echo "stable" || echo "latest" ) | |
| CHANNEL_TAG="ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---${BRANCH_LABEL}---${{ matrix.nix_system }}" | |
| docker tag "$loaded_tag" "$CHANNEL_TAG" | |
| docker push "$CHANNEL_TAG" | |
| fi | |
| - name: Print image digest | |
| working-directory: .devcontainer/nixos | |
| run: | | |
| docker inspect ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---${{ matrix.nix_system }} \ | |
| --format '{{.Id}}' 2>/dev/null || echo "Image not loaded locally" | |
| manifests-create: | |
| runs-on: ubuntu-latest | |
| if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| nix_channel: | |
| - nixos_channel: "nixos-25.11" | |
| default_tag: true | |
| - nixos_channel: "nixos-unstable" | |
| default_tag: false | |
| needs: | |
| - nix-build | |
| steps: | |
| - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4 | |
| - name: Login to Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Create multi-arch manifest | |
| run: | | |
| docker manifest create \ | |
| ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }} \ | |
| --amend ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---x86_64-linux \ | |
| --amend ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---aarch64-linux | |
| docker manifest push \ | |
| ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }} |