build: behold the power of Nix

Author: maxbrunet

.dockerignore

@@ -11,12 +11,10 @@ on:
     - release-*
 
 env:
-  # renovate: datasource=go depName=mvdan.cc/gofumpt
-  GOFUMPT_VERSION: v0.4.0
-  # renovate: datasource=go depName=github.com/golangci/golangci-lint
-  GOLANGCI_LINT_VERSION: v1.51.2
   # renovate: datasource=go depName=github.com/florianl/bluebox
   BLUEBOX_VERSION: v0.0.1
+  # renovate: datasource=github-tags depName=NixOS/nix
+  NIX_VERSION: 2.13.2
 
 jobs:
   skip-check:
@@ -36,14 +34,16 @@ jobs:
           paths: |-
             [
               "**.go",
+              "**.nix",
               ".github/workflows/build.yml",
               ".go-version",
-              "3rdparty",
               "Makefile",
               "bpf/**",
+              "flake.lock",
               "go.mod",
               "go.sum",
-              "kerneltest/**"
+              "kerneltest/**",
+              "VERSION"
             ]
           skip_after_successful_duplicate: false
 
@@ -55,49 +55,36 @@ jobs:
     steps:
       - name: Check out the code
         uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        with:
+          submodules: true
 
-      - name: Set up Go
-        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
+      - name: Set up Nix
+        uses: cachix/install-nix-action@5c11eae19dba042788936d4f1c9685fdd814ac49 # v19
         with:
-          go-version-file: .go-version
-          cache: true
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
 
-      - name: Set up Clang
-        uses: KyleMayes/install-llvm-action@ef175530927af66c61e4e8da4fea4e15de63f780 # v1.7.0
+      - name: Set up Cachix
+        uses: cachix/cachix-action@6a9a34cdd93d0ae4b4b59fd678660efb08109f2f # v12
         with:
-          version: "14"
+          name: parca-agent
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+
+      - name: Set up DevShell
+        run: nix develop --command true
 
       - name: clang version
+        shell: nix develop --command bash -e {0}
         run:  |
           clang -v
           ld --version
-          ld.lld --version
-
-      - name: Set up gofumpt
-        run: go install "mvdan.cc/gofumpt@${GOFUMPT_VERSION}"
-
-      - name: Install clang-format
-        run: sudo apt-get install clang-format
 
       - name: Show clang-format version
+        shell: nix develop --command bash -e {0}
         run: clang-format --version
 
-      - name: Install libbpf dependencies
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -yq libelf-dev zlib1g-dev
-
-      - name: Initialize and update git submodules
-        run: git submodule init && git submodule update
-
-      - name: Build libbpf
-        run: make libbpf
-
-      - name: Build BPF
-        run: make bpf
-
       - name: Build
-        run: make build
+        run: nix build --print-build-logs --print-out-paths
 
       - name: Show kernel version
         run: uname -a
@@ -110,25 +97,22 @@ jobs:
           echo $PATH
 
       - name: Test
-        # Some of the GH action CI machines have several versions of Go installed.
-        # Make sometimes somehow resolves different Go. We need to specify explicitly.
+        shell: nix develop --command bash -e {0}
         run: make GO=`which go` test ENABLE_RACE=yes
 
       - name: Test unwind tables
+        shell: nix develop --command bash -e {0}
         run: make test-dwarf-unwind-tables
 
       - name: Format
+        shell: nix develop --command bash -e {0}
         run: make format-check
 
-      - name: Install golangci-lint
-        run: go install "github.com/golangci/golangci-lint/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}"
-
-      - name: Lint
-        run: make go/lint
-
       - name: Build initramfs
+        shell: nix develop --command bash -e {0}
         run: |
           go install "github.com/florianl/bluebox@${BLUEBOX_VERSION}"
+          export PATH="$(go env GOPATH)/bin:${PATH}"
           make initramfs
 
       - name: Upload initramfs

.github/workflows/build.yml

@@ -23,6 +23,10 @@ on:
   schedule:
     - cron: '28 16 * * 3'
 
+env:
+  # renovate: datasource=github-tags depName=NixOS/nix
+  NIX_VERSION: 2.13.2
+
 jobs:
   analyze:
     name: Analyze
@@ -44,26 +48,29 @@ jobs:
       - name: Check out the code
         uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
 
-      - name: Set up Go
-        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
+      - name: Set up Nix
+        uses: cachix/install-nix-action@5c11eae19dba042788936d4f1c9685fdd814ac49 # v19
         with:
-          go-version-file: .go-version
-          cache: true
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
 
-      - name: Set up Clang
-        uses: KyleMayes/install-llvm-action@ef175530927af66c61e4e8da4fea4e15de63f780 # v1.7.0
+      - name: Set up Cachix
+        uses: cachix/cachix-action@6a9a34cdd93d0ae4b4b59fd678660efb08109f2f # v12
         with:
-          version: "14"
+          name: parca-agent
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
 
-      - name: Install libbpf dependencies
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -yq libelf-dev zlib1g-dev
+      - name: Set up DevShell
+        run: nix develop --command true
 
-      - name: Initialize and update libbpf submodule
-        run: git submodule init && git submodule update
+      - name: Set up Go
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
+        with:
+          go-version-file: .go-version
+          cache: true
 
       - name: Build BPF
+        shell: nix develop --command bash -e {0}
         run: make bpf
 
       # Initializes the CodeQL tools for scanning.
@@ -84,7 +91,9 @@ jobs:
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
 
-      - run: make build
+      - name: Build
+        shell: nix develop --command bash -e {0}
+        run: make build
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@32dc499307d133bb5085bae78498c0ac2cf762d5 # v2.2.5