devcontainer-nix/.github/workflows/build-push-latest-nixos-arion.yaml at d0af32b14df4251494bba543404eaa223411fc73 · lucernae/devcontainer-nix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: latest-build-nixos-arion
on:
  workflow_dispatch:
  # temporarily disable NixOS Arion
  # pull_request:
  #   paths:
  #     - .devcontainer/nixos-arion/**
  #     - .devcontainer/nixos/etc/**
  #   branches:
  #     - develop
  #     - main
  # push:
  #   tags:
  #     - v*
  #   paths:
  #     - .devcontainer/nixos-arion/**
  #     - .devcontainer/nixos/etc/**
  #   branches:
  #     - develop
  #     - main
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      - name: Set up nix store cache
        uses: actions/cache@v5
        with:
          path: /tmp/nix-closure
          key: nix-store-${{ hashFiles('.devcontainer/nixos-arion') }}
          restore-keys: |
            nix-store-${{ hashFiles('.devcontainer/nixos-arion') }}-
            nix-store-

      - name: Loads nix derivation cache
        id: load-cache
        run: |
          if [[ -f /tmp/nix-closure/nix-shell.closure ]]; then
            nix-store --import --option require-sigs false < /tmp/nix-closure/nix-shell.closure
            echo "use-cache=true" >> $GITHUB_OUTPUT
          fi

      - run: |
          nix-env -f '<nixpkgs>' -iA pkgs.direnv pkgs.nix-direnv
          nix-build
          nix-shell --run "direnv allow . && direnv allow .devcontainer/nixos-arion"

      - name: Build image using arion
        shell: direnv exec . bash -eo pipefail {0}
        working-directory: .devcontainer/nixos-arion
        run: |
           nix-build arion-build.nix
           make a-build config retag-image

      - name: Store nix derivation cache
        working-directory: .devcontainer/nixos-arion
        run: |
          DERIVATION=$(readlink result)
          echo $DERIVATION
          mkdir -p /tmp/nix-closure
          nix-store --export $(nix-store -qR ${DERIVATION}) > /tmp/nix-closure/nix-shell.closure

      - name: Run arion services
        shell: direnv exec . bash -eo pipefail {0}
        working-directory: .devcontainer/nixos-arion
        run: |
           docker-compose up -d
           sleep 10
           docker-compose exec -T devcontainer uname -a

      - name: Run Coverage test
        working-directory: .devcontainer/nixos-arion
        run: |
          cat << EOF | docker-compose exec -T devcontainer bash
          node --version
          nix-env --version
          nix --version
          nix-channel --list
          EOF

  docker-builder:
    # Only push if PR happens in the same repo
    if: github.event.pull_request.base.repo.url == github.event.pull_request.head.repo.url
    runs-on: ubuntu-latest
    needs:
      - test
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io

          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_PASSWORD }}

      - name: Docker meta
        id: docker_meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/lucernae/devcontainer-nix
          flavor: |
            latest=false
            prefix=nixos-arion---
          tags: |
            type=raw,value=stable,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
            type=raw,value=nixos-arion,prefix=,enable=${{ github.ref == format('refs/heads/{0}', 'develop') }}
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=semver,pattern=v{{version}}
            type=semver,pattern=v{{major}}
            type=semver,pattern=v{{major}}.{{minor}}
            type=semver,pattern=v{{major}}.{{minor}}.{{patch}}

      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      - name: Set up nix store cache
        uses: actions/cache@v5
        with:
          path: /tmp/nix-closure
          key: nix-store-${{ hashFiles('.devcontainer/nixos-arion') }}
          restore-keys: |
            nix-store-${{ hashFiles('.devcontainer/nixos-arion') }}-
            nix-store-

      - name: Loads nix derivation cache
        id: load-cache
        run: |
          if [[ -f /tmp/nix-closure/nix-shell.closure ]]; then
            nix-store --import --option require-sigs false < /tmp/nix-closure/nix-shell.closure
            echo "use-cache=true" >> $GITHUB_OUTPUT
          fi

      - run: |
          nix-env -f '<nixpkgs>' -iA pkgs.direnv pkgs.nix-direnv
          nix-build
          nix-shell --run "direnv allow . && direnv allow .devcontainer/nixos-arion"

      - name: Build and push image using arion
        shell: direnv exec . bash -eo pipefail {0}
        working-directory: .devcontainer/nixos-arion
        run: |
           make a-build config retag-image
           bash gh-action-retag-image-and-push.sh "${{ steps.docker_meta.outputs.tags }}"