devcontainer-nix/.github/workflows/build-push-latest-nixos.yaml at 50abc8e8dd89d0e60a2a4c8753fe6e7066a218c0 · lucernae/devcontainer-nix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: latest-build-nixos
on:
  workflow_dispatch:
  pull_request:
    paths:
      - .devcontainer/nixos/**
      - .github/workflows/build-push-latest-nixos.yaml
    branches:
      - develop
      - main
  push:
    tags:
      - v*
    paths:
      - .devcontainer/nixos/**
      - .github/workflows/build-push-latest-nixos.yaml
    branches:
      - develop
      - main
jobs:
  nix-build:
    # Note: NixOS builds require KVM for runAsRoot in dockerTools.buildImage
    # aarch64-linux: self-hosted runner with KVM support
    # x86_64-linux: GitHub-hosted runner
    runs-on: ${{ matrix.nix_system == 'aarch64-linux' && fromJSON('["self-hosted", "Linux", "ARM64"]') || 'ubuntu-24.04' }}
    strategy:
      fail-fast: false
      matrix:
        nix_system:
          - "x86_64-linux"
          - "aarch64-linux"
        nix_channel:
          - nixos_channel: "nixos-25.11"
            home_manager_version_string: "release-25.11"
            default_tag: true
          - nixos_channel: "nixos-unstable"
            home_manager_version_string: "master"
            default_tag: false
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4

      - name: Set up PATH for NixOS (self-hosted)
        if: matrix.nix_system == 'aarch64-linux'
        run: echo "/run/current-system/sw/bin" >> $GITHUB_PATH

      - name: Set up QEMU
        if: matrix.nix_system != 'aarch64-linux'
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31
        if: matrix.nix_system != 'aarch64-linux'
        with:
          nix_path: nixpkgs=channel:${{ matrix.nix_channel.nixos_channel }}
          extra_nix_config: |
            filter-syscalls = false
            experimental-features = nix-command flakes
            extra-platforms = aarch64-linux

      - uses: DeterminateSystems/flakehub-cache-action@main

      - name: Login to Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Update flake inputs to ${{ matrix.nix_channel.nixos_channel }}
        working-directory: .devcontainer/nixos
        run: nix flake update

      - name: Nix build NixOS devcontainer image (${{ matrix.nix_system }})
        working-directory: .devcontainer/nixos
        run: |
          nix build '.#packages.${{ matrix.nix_system }}.layeredImage'

      - name: Load image into Docker and push (${{ matrix.nix_system }})
        if: ${{ github.event.pull_request.base.repo.url == github.event.pull_request.head.repo.url || github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        working-directory: .devcontainer/nixos
        run: |
          export loaded_tag=$(cat ./result | docker load | awk '/Loaded image/{print $NF}')
          echo "Loaded image: $loaded_tag"

          TARGET_TAG="ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---${{ matrix.nix_system }}"
          docker tag "$loaded_tag" "$TARGET_TAG"
          docker push "$TARGET_TAG"

          # Also push a channel-level tag on main/develop (no arch suffix)
          if [[ "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == "refs/heads/develop" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            BRANCH_LABEL=$( [[ "${{ github.ref }}" == "refs/heads/main" ]] && echo "stable" || echo "latest" )
            CHANNEL_TAG="ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---${BRANCH_LABEL}---${{ matrix.nix_system }}"
            docker tag "$loaded_tag" "$CHANNEL_TAG"
            docker push "$CHANNEL_TAG"
          fi

      - name: Print image digest
        working-directory: .devcontainer/nixos
        run: |
          docker inspect ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---${{ matrix.nix_system }} \
            --format '{{.Id}}' 2>/dev/null || echo "Image not loaded locally"

  manifests-create:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
        nix_channel:
          - nixos_channel: "nixos-25.11"
            default_tag: true
          - nixos_channel: "nixos-unstable"
            default_tag: false
    needs:
      - nix-build
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4

      - name: Login to Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create multi-arch manifest
        run: |
          docker manifest create \
            ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }} \
            --amend ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---x86_64-linux \
            --amend ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}---aarch64-linux
          docker manifest push \
            ghcr.io/lucernae/devcontainer-nix:nixos--${{ matrix.nix_channel.nixos_channel }}