aboutsummaryrefslogtreecommitdiff
path: root/.github/workflows
diff options
context:
space:
mode:
Diffstat (limited to '.github/workflows')
-rw-r--r--.github/workflows/backport.yml10
-rw-r--r--.github/workflows/ci.yml72
-rw-r--r--.github/workflows/hydra_status.yml6
3 files changed, 57 insertions, 31 deletions
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index ec7ab4516..75be788ef 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -2,20 +2,26 @@ name: Backport
on:
pull_request_target:
types: [closed, labeled]
+permissions:
+ contents: read
jobs:
backport:
name: Backport Pull Request
+ permissions:
+ # for zeebe-io/backport-action
+ contents: write
+ pull-requests: write
if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2
+ - uses: actions/checkout@v3
with:
ref: ${{ github.event.pull_request.head.sha }}
# required to find all branches
fetch-depth: 0
- name: Create backport PRs
# should be kept in sync with `version`
- uses: zeebe-io/backport-action@v0.0.7
+ uses: zeebe-io/backport-action@v0.0.8
with:
# Config README: https://github.com/zeebe-io/backport-action#backport-action
github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 09436b7e3..dafba6d85 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,54 +4,62 @@ on:
pull_request:
push:
+permissions: read-all
+
jobs:
tests:
- needs: [check_cachix]
+ needs: [check_secrets]
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 60
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
with:
fetch-depth: 0
- - uses: cachix/install-nix-action@v16
+ - uses: cachix/install-nix-action@v18
- run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
- - uses: cachix/cachix-action@v10
- if: needs.check_cachix.outputs.secret == 'true'
+ - uses: cachix/cachix-action@v12
+ if: needs.check_secrets.outputs.cachix == 'true'
with:
name: '${{ env.CACHIX_NAME }}'
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
- run: nix --experimental-features 'nix-command flakes' flake check -L
- check_cachix:
- name: Cachix secret present for installer tests
+ check_secrets:
+ permissions:
+ contents: none
+ name: Check Cachix and Docker secrets present for installer tests
runs-on: ubuntu-latest
outputs:
- secret: ${{ steps.secret.outputs.secret }}
+ cachix: ${{ steps.secret.outputs.cachix }}
+ docker: ${{ steps.secret.outputs.docker }}
steps:
- - name: Check for Cachix secret
+ - name: Check for secrets
id: secret
env:
_CACHIX_SECRETS: ${{ secrets.CACHIX_SIGNING_KEY }}${{ secrets.CACHIX_AUTH_TOKEN }}
- run: echo "::set-output name=secret::${{ env._CACHIX_SECRETS != '' }}"
+ _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
+ run: |
+ echo "::set-output name=cachix::${{ env._CACHIX_SECRETS != '' }}"
+ echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
installer:
- needs: [tests, check_cachix]
- if: github.event_name == 'push' && needs.check_cachix.outputs.secret == 'true'
+ needs: [tests, check_secrets]
+ if: github.event_name == 'push' && needs.check_secrets.outputs.cachix == 'true'
runs-on: ubuntu-latest
outputs:
installerURL: ${{ steps.prepare-installer.outputs.installerURL }}
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
with:
fetch-depth: 0
- run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
- - uses: cachix/install-nix-action@v16
- - uses: cachix/cachix-action@v10
+ - uses: cachix/install-nix-action@v18
+ - uses: cachix/cachix-action@v12
with:
name: '${{ env.CACHIX_NAME }}'
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
@@ -60,37 +68,45 @@ jobs:
run: scripts/prepare-installer-for-github-actions
installer_test:
- needs: [installer, check_cachix]
- if: github.event_name == 'push' && needs.check_cachix.outputs.secret == 'true'
+ needs: [installer, check_secrets]
+ if: github.event_name == 'push' && needs.check_secrets.outputs.cachix == 'true'
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
runs-on: ${{ matrix.os }}
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
- run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
- - uses: cachix/install-nix-action@v16
+ - uses: cachix/install-nix-action@v18
with:
install_url: '${{needs.installer.outputs.installerURL}}'
install_options: "--tarball-url-prefix https://${{ env.CACHIX_NAME }}.cachix.org/serve"
- - run: nix-instantiate -E 'builtins.currentTime' --eval
+ - run: sudo apt install fish zsh
+ if: matrix.os == 'ubuntu-latest'
+ - run: brew install fish
+ if: matrix.os == 'macos-latest'
+ - run: exec bash -c "nix-instantiate -E 'builtins.currentTime' --eval"
+ - run: exec sh -c "nix-instantiate -E 'builtins.currentTime' --eval"
+ - run: exec zsh -c "nix-instantiate -E 'builtins.currentTime' --eval"
+ - run: exec fish -c "nix-instantiate -E 'builtins.currentTime' --eval"
docker_push_image:
- needs: [check_cachix, tests]
+ needs: [check_secrets, tests]
if: >-
github.event_name == 'push' &&
github.ref_name == 'master' &&
- needs.check_cachix.outputs.secret == 'true'
+ needs.check_secrets.outputs.cachix == 'true' &&
+ needs.check_secrets.outputs.docker == 'true'
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
with:
fetch-depth: 0
- - uses: cachix/install-nix-action@v16
+ - uses: cachix/install-nix-action@v18
- run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
- - run: echo NIX_VERSION="$(nix-instantiate --eval -E '(import ./default.nix).defaultPackage.${builtins.currentSystem}.version' | tr -d \")" >> $GITHUB_ENV
- - uses: cachix/cachix-action@v10
- if: needs.check_cachix.outputs.secret == 'true'
+ - run: echo NIX_VERSION="$(nix --experimental-features 'nix-command flakes' eval .\#default.version | tr -d \")" >> $GITHUB_ENV
+ - uses: cachix/cachix-action@v12
+ if: needs.check_secrets.outputs.cachix == 'true'
with:
name: '${{ env.CACHIX_NAME }}'
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
@@ -100,7 +116,7 @@ jobs:
- run: docker tag nix:$NIX_VERSION nixos/nix:$NIX_VERSION
- run: docker tag nix:$NIX_VERSION nixos/nix:master
- name: Login to Docker Hub
- uses: docker/login-action@v1
+ uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/hydra_status.yml b/.github/workflows/hydra_status.yml
index b97076bd7..38a9c0877 100644
--- a/.github/workflows/hydra_status.yml
+++ b/.github/workflows/hydra_status.yml
@@ -1,15 +1,19 @@
name: Hydra status
+
+permissions: read-all
+
on:
schedule:
- cron: "12,42 * * * *"
workflow_dispatch:
+
jobs:
check_hydra_status:
name: Check Hydra status
if: github.repository_owner == 'NixOS'
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2.4.0
+ - uses: actions/checkout@v3
with:
fetch-depth: 0
- run: bash scripts/check-hydra-status.sh
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 15:00:09 +0000