Skip to content

Commit a6dd3e8

Browse files
tomasoltomasol
committed
ci: Add basic GH actions and readme
1 parent 5d6eb7b commit a6dd3e8

4 files changed

Lines changed: 198 additions & 1 deletion

File tree

‎.github/workflows/check.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: check
2+
3+
on:
4+
push:
5+
pull_request:
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
13+
cancel-in-progress: true
14+
15+
defaults:
16+
run:
17+
shell: bash -xe {0}
18+
19+
jobs:
20+
check-dev-deps:
21+
name: Check dev-deps.txt
22+
runs-on: ubuntu-24.04
23+
steps:
24+
- uses: actions/checkout@v6
25+
26+
- uses: nixbuild/nix-quick-install-action@v34
27+
with:
28+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
29+
nix_conf: |
30+
extra-substituters = https://cache.garnix.io
31+
extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g
32+
33+
- name: Populate the Nix store
34+
run: nix develop --command echo
35+
36+
- name: Regenerate dev-deps.txt
37+
run: nix develop --command ./scripts/dev-deps.sh
38+
39+
- name: Check dev-deps.txt
40+
run: |
41+
cat dev-deps.txt
42+
if ! git diff --quiet -- dev-deps.txt; then
43+
echo "dev-deps.txt is stale:"
44+
git diff -- dev-deps.txt
45+
exit 1
46+
fi
47+
48+
verify-deployment:
49+
name: Verify deployment
50+
runs-on: ubuntu-24.04
51+
steps:
52+
- uses: actions/checkout@v6
53+
54+
- uses: nixbuild/nix-quick-install-action@v34
55+
with:
56+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
57+
nix_conf: |
58+
extra-substituters = https://cache.garnix.io
59+
extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g
60+
61+
- name: Verify deployment.toml
62+
run: |
63+
nix develop --command obelisk server verify \
64+
--deployment deployment.toml \
65+
--ignore-missing-env-vars \
66+
--skip-db

‎.github/workflows/sync-flake-lock.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: sync-flake-lock
2+
3+
on:
4+
workflow_dispatch:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
10+
defaults:
11+
run:
12+
shell: bash -xe {0}
13+
14+
jobs:
15+
sync-flake-lock:
16+
runs-on: ubuntu-24.04
17+
steps:
18+
- uses: actions/checkout@v6
19+
with:
20+
fetch-depth: 1
21+
22+
- name: Sync flake.lock from Obelisk
23+
run: |
24+
curl --fail --location \
25+
https://raw.githubusercontent.com/obeli-sk/obelisk/refs/heads/latest/flake.lock \
26+
--output flake.lock
27+
28+
- uses: nixbuild/nix-quick-install-action@v34
29+
with:
30+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
31+
nix_conf: |
32+
extra-substituters = https://cache.garnix.io
33+
extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g
34+
35+
- name: Populate the Nix store
36+
run: nix develop --command echo
37+
38+
- name: Update dev-deps.txt
39+
run: nix develop --command ./scripts/dev-deps.sh
40+
41+
- name: Create pull request
42+
env:
43+
GH_TOKEN: ${{ secrets.GH_TOKEN_PR_RW }}
44+
run: |
45+
if git diff --quiet; then
46+
echo "No changes to commit."
47+
exit 0
48+
fi
49+
50+
branch="sync-flake-lock-$(date +'%Y%m%d-%H%M%S')"
51+
git config user.name "github-actions[bot]"
52+
git config user.email "github-actions[bot]@users.noreply.github.com"
53+
git checkout -b "$branch"
54+
git add flake.lock dev-deps.txt
55+
git commit -m "chore: Sync \`flake.lock\` from upstream"
56+
git push origin "$branch"
57+
gh pr create \
58+
--base main \
59+
--head "$branch" \
60+
--title "Sync \`flake.lock\` from upstream" \
61+
--body ''

‎README.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Obelisk Version Monitor
2+
3+
An [Obelisk](https://obeli.sk/) application that monitors the Obelisk version
4+
pinned by public repositories in the
5+
[`obeli-sk`](https://github.com/obeli-sk) organization.
6+
7+
The dashboard can:
8+
9+
- show the version from each repository's `dev-deps.txt`;
10+
- dispatch its `sync-flake-lock.yml` GitHub Actions workflow;
11+
- track the Obelisk activity and GitHub Actions run;
12+
- find the resulting ``Sync `flake.lock` from upstream`` pull request;
13+
- display pull request checks; and
14+
- merge a passing pull request through an audited Obelisk activity.
15+
16+
## Dashboard
17+
18+
The dashboard is served by the `show` webhook endpoint. It polls JSON status
19+
without reloading the page.
20+
21+
| Repository | obelisk version | Action | GH Action | PR |
22+
| --- | --- | --- | --- | --- |
23+
| benchmark-fibo | `0.38.3` | Run sync-flake-lock | GH: completed: success | #62 open, checks: passing, Merge |
24+
| components | `0.38.2` | Run sync-flake-lock | GH: in progress | #96 open, checks: in progress |
25+
| webui | `0.38.2` | Run sync-flake-lock | GH: completed: success | #86 merged |
26+
27+
Each Obelisk activity displays its execution ID. GitHub Actions runs and pull
28+
requests link to GitHub.
29+
30+
## Development
31+
32+
Enter the development shell:
33+
34+
```sh
35+
nix develop
36+
```
37+
38+
Set a GitHub token with permission to dispatch workflows and merge pull
39+
requests:
40+
41+
```sh
42+
export GH_TOKEN="$(gh auth token)"
43+
```
44+
45+
Verify the deployment:
46+
47+
```sh
48+
obelisk server verify \
49+
--deployment deployment.toml \
50+
--ignore-missing-env-vars \
51+
--skip-db
52+
```
53+
54+
Apply it to a running local server:
55+
56+
```sh
57+
obelisk deployment apply deployment.toml
58+
```
59+
60+
With the default server configuration, the dashboard is available at
61+
<http://127.0.0.1:9090/>.
62+
63+
## Automation
64+
65+
- `check.yml` regenerates `dev-deps.txt` and fails if it is stale.
66+
- `sync-flake-lock.yml` copies `flake.lock` from Obelisk's `latest` branch,
67+
regenerates `dev-deps.txt`, and opens a pull request.
68+
69+
The sync workflow requires the repository secret `GH_TOKEN_PR_RW` with
70+
permission to push a branch and open a pull request.

‎dev-deps.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
obelisk 0.38.2
1+
obelisk 0.38.3

0 commit comments

Comments
 (0)