-
Notifications
You must be signed in to change notification settings - Fork 114
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: simplify CI and remove need for secrets
- Loading branch information
Showing
4 changed files
with
27 additions
and
212 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -18,57 +18,39 @@ on: | |
DOCKER: | ||
type: boolean | ||
required: true | ||
secrets: | ||
AWS_ACCOUNT_ID: | ||
required: true | ||
SSH_PRIVATE_KEY: | ||
required: true | ||
NIX_CACHE_PUB_KEY: | ||
required: true | ||
NIX_CACHE_PRIV_KEY: | ||
required: true | ||
NIX_REMOTE_BUILDER_SECURITY_GROUP_ID: | ||
required: true | ||
NIX_REMOTE_BUILDER_SUBNET_ID: | ||
required: true | ||
|
||
jobs: | ||
artifacts: | ||
runs-on: ubuntu-latest | ||
timeout-minutes: 180 | ||
|
||
permissions: | ||
id-token: write | ||
contents: write | ||
|
||
strategy: | ||
matrix: | ||
platform: ["x86_64", "aarch64"] | ||
os: [ubuntu-22.04, ubuntu-arm64-22.04-2cores] | ||
fail-fast: true | ||
|
||
runs-on: ${{ matrix.os }} | ||
timeout-minutes: 180 | ||
|
||
steps: | ||
- name: "Check out repository" | ||
uses: actions/checkout@v4 | ||
with: | ||
fetch-depth: 0 | ||
ref: ${{ inputs.GIT_REF }} | ||
|
||
- name: Configure aws | ||
uses: aws-actions/configure-aws-credentials@v4 | ||
with: | ||
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-nhost-${{ github.event.repository.name }} | ||
aws-region: eu-central-1 | ||
|
||
- uses: nixbuild/nix-quick-install-action@v28 | ||
- uses: cachix/install-nix-action@v27 | ||
with: | ||
nix_version: 2.20.5 | ||
nix_conf: | | ||
install_url: "https://releases.nixos.org/nix/nix-2.20.5/install" | ||
install_options: "--no-daemon" | ||
extra_nix_config: | | ||
experimental-features = nix-command flakes | ||
sandbox = false | ||
access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | ||
substituters = https://cache.nixos.org/?priority=40 s3://nhost-nix-cache?region=eu-central-1&priority=50 | ||
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= ${{ secrets.NIX_CACHE_PUB_KEY }} | ||
builders-use-substitutes = true | ||
substituters = https://cache.nixos.org/?priority=40 | ||
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= | ||
- uses: DeterminateSystems/magic-nix-cache-action@main | ||
with: | ||
diagnostic-endpoint: "" | ||
|
||
- name: Compute common env vars | ||
id: vars | ||
|
@@ -85,74 +67,9 @@ jobs: | |
|| export BUILD_NEEDED=yes | ||
echo BUILD_NEEDED=$BUILD_NEEDED >> $GITHUB_OUTPUT | ||
- name: "Setup nix-remote-builder" | ||
uses: dbarrosop/[email protected] | ||
id: nix-remote-builder | ||
with: | ||
name: ${{ inputs.NAME }}-${{ inputs.GIT_REF }} | ||
ami: " ami-034dac72b37504107" | ||
instance-type: 't4g.xlarge' | ||
region: "eu-central-1" | ||
ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }} | ||
security-group-id: ${{ secrets.NIX_REMOTE_BUILDER_SECURITY_GROUP_ID }} | ||
subnet-id: ${{ secrets.NIX_REMOTE_BUILDER_SUBNET_ID }} | ||
if: ${{ ( matrix.platform == 'aarch64' ) && steps.verify-build.outputs.BUILD_NEEDED == 'yes' }} | ||
|
||
- name: "Setup nix-remote-builder in nix.conf" | ||
run: | | ||
echo "builders = ssh://ec2-user@${{ steps.nix-remote-builder.outputs.publicDnsName }} aarch64-linux;" >> ~/.config/nix/nix.conf | ||
if: ${{ ( matrix.platform == 'aarch64' ) && steps.verify-build.outputs.BUILD_NEEDED == 'yes' }} | ||
|
||
- name: Cache nix store | ||
uses: actions/cache@v4 | ||
with: | ||
path: | | ||
/nix/store/** | ||
/nix/var/nix/*/* | ||
/nix/var/nix/db/* | ||
/nix/var/nix/db/*/** | ||
!/nix/var/nix/daemon-socket/socket | ||
!/nix/var/nix/userpool/* | ||
!/nix/var/nix/gc.lock | ||
!/nix/var/nix/db/big-lock | ||
!/nix/var/nix/db/reserved | ||
key: nix-${{ inputs.NAME }}-build-${{ runner.os }}-${{ matrix.platform }}-${{ hashFiles('nix/**.nix', 'flake.nix', 'flake.lock') }} | ||
restore-keys: nix-${{ inputs.NAME }}-build-${{ runner.OS }}-${{ matrix.platform }}-main | ||
if: ${{ steps.verify-build.outputs.BUILD_NEEDED == 'yes' }} | ||
|
||
- uses: docker/setup-qemu-action@v3 | ||
if: ${{ ( matrix.platform == 'aarch64' ) }} | ||
|
||
- name: "Wait for remote builder to be ready" | ||
run: | | ||
set +e | ||
max_attempts=6 | ||
retry_interval=10 | ||
attempt=1 | ||
while [ "$attempt" -le "$max_attempts" ]; do | ||
echo "Checking SSH connection (attempt $attempt)..." | ||
nc -zv ${{ steps.nix-remote-builder.outputs.publicDnsName }} 22 | ||
if [ $? -eq 0 ]; then | ||
echo "success" | ||
break | ||
else | ||
echo "SSH connection failed." | ||
if [ "$attempt" -lt "$max_attempts" ]; then | ||
echo "Retrying in $retry_interval seconds..." | ||
sleep "$retry_interval" | ||
else | ||
echo "Exceeded maximum connection attempts." | ||
exit 1 | ||
fi | ||
fi | ||
((attempt++)) | ||
done | ||
if: ${{ ( matrix.platform == 'aarch64' ) && steps.verify-build.outputs.BUILD_NEEDED == 'yes' }} | ||
|
||
- name: "Build artifact" | ||
run: | | ||
nix build .\#packages.${{ matrix.platform }}-linux.hasura-auth | ||
make build | ||
zip -r result.zip result | ||
- name: "Push artifact to artifact repository" | ||
|
@@ -164,8 +81,7 @@ jobs: | |
|
||
- name: "Build docker image" | ||
run: | | ||
make build-docker-image ARCH=${{ matrix.platform }} | ||
nix build .\#packages.${{ matrix.platform }}-linux.docker-image | ||
make build-docker-image | ||
if: ${{ ( inputs.DOCKER ) }} | ||
|
||
- name: "Push docker image to artifact repository" | ||
|
@@ -175,20 +91,3 @@ jobs: | |
path: result | ||
retention-days: 7 | ||
if: ${{ ( inputs.DOCKER ) }} | ||
|
||
- name: "Cache nix store on s3" | ||
run: | | ||
echo ${{ secrets.NIX_CACHE_PRIV_KEY }} > cache-priv-key.pem | ||
nix store sign --key-file cache-priv-key.pem --all | ||
find /nix/store -maxdepth 1 -name "*-*" -type d | grep -v source | xargs -n 1000 nix copy --to s3://nhost-nix-cache\?region=eu-central-1 | ||
if: always() | ||
|
||
- name: "Cache nix store on s3 (docker-image)" | ||
run: | | ||
echo ${{ secrets.NIX_CACHE_PRIV_KEY }} > cache-priv-key.pem | ||
nix store sign --key-file cache-priv-key.pem --all | ||
nix copy --to s3://nhost-nix-cache\?region=eu-central-1 .\#packages.${{ matrix.platform }}-linux.docker-image | ||
if: ${{ ( inputs.DOCKER ) && steps.verify-build.outputs.BUILD_NEEDED == 'yes' }} | ||
|
||
- run: rm cache-priv-key.pem || echo "file not found" | ||
if: always() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters