feat: include nix specific ci (may require env vars configured in rep…

…o settings)
supabase · samrose · Apr 3, 2024 · Mar 16, 2024 · Mar 16, 2024 · Mar 19, 2024
commit 28be8d06c6753b90f308439f6343b8938d9fed28
@@ -0,0 +1,26 @@
+name: Nix CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions: read-all
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ ubuntu-latest ]
+        cmd: [ "nix flake check -L --show-trace", "nix run nixpkgs#just -- build-all" ]
+    runs-on: ${{ matrix.os }}
+    name: nix-build
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+        with:
+          fetch-depth: 0
+      - uses: DeterminateSystems/nix-installer-action@65d7c888b2778e8cf30a07a88422ccb23499bfb8
+      - uses: DeterminateSystems/magic-nix-cache-action@749fc5bbc9fa49d60c2b93f6c4bc867b82e1d295
+      - run: ${{ matrix.cmd }}
@@ -0,0 +1,46 @@
+name: Nix Cache upload
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write    
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+    runs-on: ubuntu-latest
+    name: nix-build
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+        with:
+          fetch-depth: 0
+      - uses: DeterminateSystems/nix-installer-action@65d7c888b2778e8cf30a07a88422ccb23499bfb8
+      - uses: DeterminateSystems/magic-nix-cache-action@749fc5bbc9fa49d60c2b93f6c4bc867b82e1d295
+      - name: configure aws credentials for s3
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
+          aws-region: "us-east-1"
+          kvm: true
+          extra-conf: |
+            system-features = kvm
+
+      - name: write secret key
+        # use python so we don't interpolate the secret into the workflow logs, in case of bugs
+        run: |
+          python -c "import os; file = open('nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
+        env:
+          NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
+
+      - name: build and copy to S3
+        run: |
+          for x in 15 16 orioledb_16; do
+            nix build .#psql_$x/bin -o result-$x
+          done
+          nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./result*
@@ -0,0 +1,43 @@
+name: Nix Docker
+
+on:
+  push:
+    branches: [ 'main' ]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    name: "update: build and deploy postgres server images"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+        with:
+          fetch-depth: 0
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: actions/checkout@v3
+
+      - name: Build images
+        run: |
+          nix build .#psql_15/docker -o result-docker-15
+          nix build .#psql_16/docker -o result-docker-16
+          nix build .#psql_orioledb_16/docker -o result-docker-orioledb-16
+      - name: Log in to the Container registry
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push image to the Container registry
+        run: |
+          set -x
+          for x in 15 16 orioledb_16; do
+            nix build .#psql_$x/docker.copyToRegistry          
+          done