feat: nixos module with haqqd service under cosmovisor (#279)

* feat: nixos module for haqq under cosmovisor

* ci: update-flake-lock action

* fix: package version, ci: check version

* ci: build nix package

* build: run tests in nix package

* test: increate node timeout

* build: use informalsystems' cosmos.nix for building haqq https://github.com/informalsystems/cosmos.nix

* ci: make nix ci actions run in parallel with others

* ci: check nix pkg version before building it not to waste time on building pkg with a wrong version

* build: ignore .github to help nix cache

* build: use nixpkgs's nix-gitignore for scoping nix package src

* build: no v prefix on nix pakcage

* deps: update flake inputs

* ci: print build logs in nix test

* ci: print build logs in nix pkg

* build: ignore .github directory

* chore: add haqq cachix

* deps: update informalsystems' cosmos.nix and follow nixpkgs-unstable

* build: migrate to gomod2nix to optimise build times

* chore: add golangci-lint pre-commit hook

* build: faster build for default haqq nix package

* ci: run nix package checks in parallel with package build

* ci: separate CI shell to speedup shell building on both CI and dev machines

* ci: change go version to 1.20, set checkout action to v4

* ci: run node bootstrap weekly

* chore: grammar

* build(nix): parse go version from go.mod

* ci(nix): better nix caching

.envrc

@@ -1 +1,2 @@
+watch_file nix/devshell.nix
 use flake . --impure

.gitattributes

@@ -8,3 +8,4 @@ x/**/spec/* linguist-documentation
 **/*.pb.gw.go linguist-generated
 *.gz filter=lfs diff=lfs merge=lfs -text
 flake.lock linguist-generated
+gomod2nix.toml linguist-generated

.github/workflows/build-docs.yml

@@ -13,7 +13,7 @@ jobs:
     name: Check docs build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v4
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/build.yml

@@ -17,10 +17,10 @@ jobs:
   build:
     runs-on: ubuntu-cpu16-ram64
     steps:
-      - uses: actions/checkout@v2.4.0
-      - uses: actions/setup-go@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: '1.20'
       - uses: technote-space/get-diff-action@v5
         id: git_diff
         with:
@@ -33,3 +33,28 @@ jobs:
       - run: |
           make build
         if: "env.GIT_DIFF != ''"
+  build-nix:
+    runs-on: ubuntu-cpu16-ram64
+    steps:
+      - uses: actions/checkout@v4
+      - uses: haqq-network/nix-action@master
+        with:
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          cacheKeyPostfix: ${{ hashFiles('**/go.sum') }}
+      - name: Build nix package
+        run: |
+          nix build .#haqq --print-build-logs
+  check-nix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: haqq-network/nix-action@master
+        with:
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          cacheKeyPostfix: ${{ hashFiles('**/go.sum') }}
+      - name: Check if nix package and Makefile versions match
+        run: |
+          nix develop --impure .#ci --command ci-check-version
+      - name: Check if gomod2nix is up to date
+        run: |
+          nix develop --impure .#ci --command ci-check-gomod2nix

.github/workflows/codeql-analysis.yml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2.4.0
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/docker-build.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       -
         name: Git fetch everything
         run: git fetch --prune --unshallow

.github/workflows/docker-push.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       -
         name: Git fetch everything
         run: git fetch --prune --unshallow

.github/workflows/docs.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           # fetch all commits to get last updated time or other git log info
           fetch-depth: 0

.github/workflows/goreleaser.yml

@@ -9,13 +9,13 @@ jobs:
     runs-on: ubuntu-cpu16-ram64
     environment: release
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v4
         with:
           submodules: true
       - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: '1.20'
           check-latest: true
       - name: Pull LFS files
         run: git lfs pull

.github/workflows/linkchecker.yml

@@ -6,7 +6,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v4
       - uses: gaurav-nelson/[email protected]
         with:
           folder-path: "docs"

.github/workflows/lint.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.19
-      - uses: actions/checkout@v2.4.0
+          go-version: '1.20'
+      - uses: actions/checkout@v4
       - uses: technote-space/get-diff-action@v5
         with:
           SUFFIX_FILTER: |
@@ -28,4 +28,4 @@ jobs:
           # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
           version: latest
           args: --timeout 10m
-          github-token: ${{ secrets.github_token }}
+          github-token: ${{ secrets.github_token }}

.github/workflows/proto.yml

@@ -29,7 +29,7 @@ jobs:
         with:
           signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
       - run: |
-          nix develop --impure --command ci-proto
+          nix develop --impure #ci --command ci-proto
 
   lint:
     name: Proto lint

.github/workflows/snyk.yml

@@ -6,12 +6,12 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
       - uses: snyk/actions/setup@master
-      - uses: actions/setup-go@v1
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.20'
       - name: Snyk monitor
         run: snyk code test
         env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

.github/workflows/test-node-bootstrap.yml

@@ -0,0 +1,13 @@
+name: update-flake-lock
+on:
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-cpu16-ram64
+    steps:
+      - name: Test node bootstrap
+        run: |
+          nix build .#packages.x86_64-linux.nixos-test --no-sandbox --print-build-logs

.github/workflows/test.yml

@@ -18,9 +18,9 @@ jobs:
   install-tparse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v2.1.4
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: '1.20'
       - name: Display Go Version
         run: go version
       - name: Install tparse
@@ -35,11 +35,11 @@ jobs:
     runs-on: ubuntu-cpu16-ram64
     steps:
       - name: Set up go
-        uses: actions/setup-go@v2.1.4
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: '1.20'
       - name: Checkout source
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v4
       - name: Generate LFS file list
         run: git lfs ls-files -l | cut -d' ' -f1 | sort > .lfs-assets-id
       - name: Restore LFS cache
@@ -63,4 +63,15 @@ jobs:
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v3
         env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+  test-nix:
+    runs-on: ubuntu-cpu16-ram64
+    steps:
+      - uses: actions/checkout@v4
+      - uses: haqq-network/nix-action@master
+        with:
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          cacheKeyPostfix: ${{ hashFiles('**/go.sum') }}
+      - name: Run nix package tests
+        run: |
+          nix build .#haqq-with-tests --print-build-logs

.github/workflows/update-flake-lock.yml

@@ -0,0 +1,22 @@
+name: update-flake-lock
+on:
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: Update flake.lock
+        uses: DeterminateSystems/update-flake-lock@main
+        with:
+          pr-title: "Update flake.lock"
+          pr-labels: |                
+            dependencies
+            automated
+            automerge

.gitignore

@@ -80,4 +80,7 @@ tmp-swagger-gen
 .direnv
 .secrets
 .env
-.dccache
+.dccache
+
+result
+.pre-commit-config.yaml