aboutsummaryrefslogtreecommitdiff
path: root/.github/workflows/ci.yml
diff options
context:
space:
mode:
Diffstat (limited to '.github/workflows/ci.yml')
-rw-r--r--.github/workflows/ci.yml72
1 files changed, 44 insertions, 28 deletions
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 09436b7e3..dafba6d85 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,54 +4,62 @@ on:
pull_request:
push:
+permissions: read-all
+
jobs:
tests:
- needs: [check_cachix]
+ needs: [check_secrets]
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 60
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
with:
fetch-depth: 0
- - uses: cachix/install-nix-action@v16
+ - uses: cachix/install-nix-action@v18
- run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
- - uses: cachix/cachix-action@v10
- if: needs.check_cachix.outputs.secret == 'true'
+ - uses: cachix/cachix-action@v12
+ if: needs.check_secrets.outputs.cachix == 'true'
with:
name: '${{ env.CACHIX_NAME }}'
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
- run: nix --experimental-features 'nix-command flakes' flake check -L
- check_cachix:
- name: Cachix secret present for installer tests
+ check_secrets:
+ permissions:
+ contents: none
+ name: Check Cachix and Docker secrets present for installer tests
runs-on: ubuntu-latest
outputs:
- secret: ${{ steps.secret.outputs.secret }}
+ cachix: ${{ steps.secret.outputs.cachix }}
+ docker: ${{ steps.secret.outputs.docker }}
steps:
- - name: Check for Cachix secret
+ - name: Check for secrets
id: secret
env:
_CACHIX_SECRETS: ${{ secrets.CACHIX_SIGNING_KEY }}${{ secrets.CACHIX_AUTH_TOKEN }}
- run: echo "::set-output name=secret::${{ env._CACHIX_SECRETS != '' }}"
+ _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
+ run: |
+ echo "::set-output name=cachix::${{ env._CACHIX_SECRETS != '' }}"
+ echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
installer:
- needs: [tests, check_cachix]
- if: github.event_name == 'push' && needs.check_cachix.outputs.secret == 'true'
+ needs: [tests, check_secrets]
+ if: github.event_name == 'push' && needs.check_secrets.outputs.cachix == 'true'
runs-on: ubuntu-latest
outputs:
installerURL: ${{ steps.prepare-installer.outputs.installerURL }}
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
with:
fetch-depth: 0
- run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
- - uses: cachix/install-nix-action@v16
- - uses: cachix/cachix-action@v10
+ - uses: cachix/install-nix-action@v18
+ - uses: cachix/cachix-action@v12
with:
name: '${{ env.CACHIX_NAME }}'
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
@@ -60,37 +68,45 @@ jobs:
run: scripts/prepare-installer-for-github-actions
installer_test:
- needs: [installer, check_cachix]
- if: github.event_name == 'push' && needs.check_cachix.outputs.secret == 'true'
+ needs: [installer, check_secrets]
+ if: github.event_name == 'push' && needs.check_secrets.outputs.cachix == 'true'
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
runs-on: ${{ matrix.os }}
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
- run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
- - uses: cachix/install-nix-action@v16
+ - uses: cachix/install-nix-action@v18
with:
install_url: '${{needs.installer.outputs.installerURL}}'
install_options: "--tarball-url-prefix https://${{ env.CACHIX_NAME }}.cachix.org/serve"
- - run: nix-instantiate -E 'builtins.currentTime' --eval
+ - run: sudo apt install fish zsh
+ if: matrix.os == 'ubuntu-latest'
+ - run: brew install fish
+ if: matrix.os == 'macos-latest'
+ - run: exec bash -c "nix-instantiate -E 'builtins.currentTime' --eval"
+ - run: exec sh -c "nix-instantiate -E 'builtins.currentTime' --eval"
+ - run: exec zsh -c "nix-instantiate -E 'builtins.currentTime' --eval"
+ - run: exec fish -c "nix-instantiate -E 'builtins.currentTime' --eval"
docker_push_image:
- needs: [check_cachix, tests]
+ needs: [check_secrets, tests]
if: >-
github.event_name == 'push' &&
github.ref_name == 'master' &&
- needs.check_cachix.outputs.secret == 'true'
+ needs.check_secrets.outputs.cachix == 'true' &&
+ needs.check_secrets.outputs.docker == 'true'
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
with:
fetch-depth: 0
- - uses: cachix/install-nix-action@v16
+ - uses: cachix/install-nix-action@v18
- run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
- - run: echo NIX_VERSION="$(nix-instantiate --eval -E '(import ./default.nix).defaultPackage.${builtins.currentSystem}.version' | tr -d \")" >> $GITHUB_ENV
- - uses: cachix/cachix-action@v10
- if: needs.check_cachix.outputs.secret == 'true'
+ - run: echo NIX_VERSION="$(nix --experimental-features 'nix-command flakes' eval .\#default.version | tr -d \")" >> $GITHUB_ENV
+ - uses: cachix/cachix-action@v12
+ if: needs.check_secrets.outputs.cachix == 'true'
with:
name: '${{ env.CACHIX_NAME }}'
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
@@ -100,7 +116,7 @@ jobs:
- run: docker tag nix:$NIX_VERSION nixos/nix:$NIX_VERSION
- run: docker tag nix:$NIX_VERSION nixos/nix:master
- name: Login to Docker Hub
- uses: docker/login-action@v1
+ uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 11:37:56 +0000