zero-to-nix/.github/workflows/ci.yml at main · DeterminateSystems/zero-to-nix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Run Zero to Nix site tests

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  test:
    runs-on: UbuntuLatest32Cores128G
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    permissions:
      id-token: write
      contents: read
    steps:
      - name: git checkout
        uses: actions/checkout@v6

      - name: Check Nixpkgs input
        uses: DeterminateSystems/flake-checker-action@main
        with:
          fail-mode: true

      - uses: DeterminateSystems/determinate-nix-action@main
      - uses: DeterminateSystems/flakehub-cache-action@main

      - name: Get npm cache directory
        run: |
          echo "NPM_CACHE_DIRECTORY=$(nix develop --command npm config get cache | tr -d '\n')" >> $GITHUB_ENV

      - name: Set up npm cache
        uses: actions/cache@v5
        with:
          path: ${{ env.NPM_CACHE_DIRECTORY }}
          key: npm-cache-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            npm-cache

      - name: Restore Lychee cache
        uses: actions/cache@v5
        with:
          path: .lycheecache
          key: lychee-cache-${{ github.sha }}
          restore-keys: lychee-cache-

      - name: Run Nix CI suite
        run: nix develop --command ci

      - name: Check external links
        uses: lycheeverse/lychee-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          args: >-
            --cache
            --verbose
            --no-progress
            ./dist
          fail: false

      - name: Save Lychee cache
        if: success() || failure()
        uses: actions/cache/save@v5
        with:
          path: .lycheecache
          key: cache-lychee-${{ github.sha }}

      - name: Check templates
        run: |
          ./scripts/check-templates.sh

  build-shells-and-templates:
    runs-on: ${{ matrix.systems.runner }}
    needs: test
    permissions:
      id-token: write
      contents: write
    strategy:
      matrix:
        systems:
          - nix-system: aarch64-darwin
            runner: macos-latest-xlarge
          - nix-system: x86_64-darwin
            runner: macos-latest-xlarge
          - nix-system: x86_64-linux
            runner: UbuntuLatest32Cores128G
    steps:
      - uses: actions/checkout@v6
      - uses: DeterminateSystems/determinate-nix-action@main
      - uses: DeterminateSystems/flakehub-cache-action@main

      - name: Build example dev shells
        run: ./scripts/build-example-dev-shells.sh

      - name: Build dev shells in templates
        run: ./scripts/build-dev-templates.sh

      - name: Build packages in pkg templates
        run: ./scripts/build-pkg-templates.sh

      - name: Fix hash mismatches
        if: failure() && github.event_name == 'pull_request'
        id: fix-hashes
        run: |
          git stash --include-untracked
          git fetch --depth=1 origin "$GITHUB_HEAD_REF"
          git checkout -B "$GITHUB_HEAD_REF" "${{ github.event.pull_request.head.sha }}"

          determinate-nixd fix hashes --auto-apply

          if ! git diff --quiet; then
            git config user.name "github-actions[bot]"
            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
            git add --update --ignore-removal .
            git commit -m "[dependabot skip] Automatically fix Nix hashes"
            git push origin "$GITHUB_HEAD_REF"
          fi

          git checkout -
          git stash pop || true