surrealdb/.github/workflows/nix.yml at main · AdaWorldAPI/surrealdb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: Nix

on:
  push:
    branches:
      - main
  pull_request:
    types: [ labeled ]

# Setting the shell option, it will run 'bash --noprofile --norc -eo pipefail {0}'
defaults:
  run:
    shell: bash

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read

jobs:
  # TODO: Figure out why it fails to build
  #
  # build-static:
  #   name: Build static Linux binary
  #   if: ${{ github.ref == 'refs/heads/main' || github.event.label.name == 'nix' }}
  #   runs-on: ubuntu-latest
  #   steps:
  #     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
  #     - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
  #     - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
  #       with:
  #         name: surrealdb
  #         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
  #         extraPullNames: nix-community
  #     - run: nix build .#static-binary
  #     - run: ./result/bin/surreal help

  build-docker:
    name: Build Docker image
    if: ${{ github.ref == 'refs/heads/main' || github.event.label.name == 'nix' }}
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # (Actions must be pinned by commit hash) v6.0.2
      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # (Actions must be pinned by commit hash) v31.10.4
      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # (Actions must be pinned by commit hash) v17
        with:
          name: surrealdb
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          extraPullNames: nix-community
      - run: nix build .#docker-image
      - run: docker load --input ./result

  build-native-linux:
    name: Build native Linux binary
    if: ${{ github.ref == 'refs/heads/main' || github.event.label.name == 'nix' }}
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # (Actions must be pinned by commit hash) v6.0.2
      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # (Actions must be pinned by commit hash) v31.10.4
      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # (Actions must be pinned by commit hash) v17
        with:
          name: surrealdb
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
          extraPullNames: nix-community
      - run: nix build .#x86_64-unknown-linux-gnu
      - run: ./result/bin/surreal help