Skip to content

Commit 0640b39

Browse files
juliankunersjuliankuners
authored
Cachix workaround & push kevm to k-framework-binary cachix (#2841)
* add kevm to `k-framework-binary` cachix * don't test kevm in release workflow * allow flaky cachix errors when pushing to `k-framework` * add `nix-binary-cache` as requirement for `make-release` workflow
1 parent f202a4d commit 0640b39

2 files changed

Lines changed: 151 additions & 6 deletions

File tree

‎.github/scripts/check-cachix-pin.sh‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# Kup relies on cachix registry k-framework-binary.
5+
CACHE="k-framework-binary"
6+
OWNER_REPO="${OWNER_REPO:-$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')}"
7+
REV="${REV:-${GITHUB_SHA:-$(git rev-parse HEAD)}}"
8+
UNAME_S="$(uname -s)"
9+
UNAME_M="$(uname -m)"
10+
case "${UNAME_S}-${UNAME_M}" in
11+
Linux-x86_64) SYSTEM="x86_64-linux" ;;
12+
Linux-aarch64 | Linux-arm64) SYSTEM="aarch64-linux" ;;
13+
Darwin-x86_64) SYSTEM="x86_64-darwin" ;;
14+
Darwin-arm64) SYSTEM="aarch64-darwin" ;;
15+
*)
16+
echo "Unsupported platform: ${UNAME_S}-${UNAME_M}" >&2
17+
exit 1
18+
;;
19+
esac
20+
PIN_API_URL="https://app.cachix.org/api/v1/cache/${CACHE}/pin"
21+
CHECK_PACKAGES=(kevm)
22+
23+
SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
24+
25+
# Append to the GitHub step summary when set; always print to stdout for live job logs.
26+
summary_and_log() {
27+
if [[ "${SUMMARY}" == "/dev/stdout" ]]; then
28+
cat
29+
else
30+
tee -a "${SUMMARY}"
31+
fi
32+
}
33+
34+
{
35+
echo "## Cachix Publish Summary"
36+
echo "CACHE: $CACHE"
37+
echo "OWNER_REPO: $OWNER_REPO"
38+
echo "REV: $REV"
39+
echo "SYSTEM: $SYSTEM"
40+
echo "PACKAGES: ${CHECK_PACKAGES[*]}"
41+
} >> "$SUMMARY"
42+
43+
# Verify push + pin together for each package. Both can become visible with delay.
44+
PIN_VISIBILITY_TIMEOUT_SECONDS=120 # 2 minutes
45+
PIN_VISIBILITY_INTERVAL_SECONDS=5 # 5 seconds
46+
PIN_VISIBILITY_ATTEMPTS=$((PIN_VISIBILITY_TIMEOUT_SECONDS / PIN_VISIBILITY_INTERVAL_SECONDS))
47+
for i in $(seq 1 "$PIN_VISIBILITY_ATTEMPTS"); do
48+
PIN_JSON="$(curl -fsSL "${PIN_API_URL}?q=${REV}")"
49+
ALL_OK=1
50+
51+
for PKG in "${CHECK_PACKAGES[@]}"; do
52+
KEY="github:${OWNER_REPO}/${REV}#packages.${SYSTEM}.${PKG}"
53+
STORE_PATH="$(
54+
echo "$PIN_JSON" \
55+
| jq -r --arg k "$KEY" 'map(select(.name == $k)) | first | (.lastRevision.storePath // .storePath // .store_path // .path // "")'
56+
)"
57+
if [ -z "$STORE_PATH" ]; then
58+
PIN_STATUS="pin-missing"
59+
PUSH_STATUS="000"
60+
ALL_OK=0
61+
{
62+
echo "key-${PKG}: ${KEY}"
63+
echo "pin-status-${PKG}: ${PIN_STATUS}"
64+
echo "push-http-${PKG}: ${PUSH_STATUS}"
65+
} | summary_and_log
66+
continue
67+
fi
68+
69+
PIN_STATUS="pin-ok"
70+
HASH="$(basename "$STORE_PATH" | cut -d- -f1)"
71+
PUSH_NARINFO_URL="https://${CACHE}.cachix.org/${HASH}.narinfo"
72+
PUSH_STATUS="$(curl -sS -o /dev/null -w '%{http_code}' "$PUSH_NARINFO_URL")" || PUSH_STATUS="000"
73+
if [ "$PUSH_STATUS" != "200" ]; then
74+
ALL_OK=0
75+
fi
76+
77+
{
78+
echo "key-${PKG}: ${KEY}"
79+
echo "store-path-${PKG}: ${STORE_PATH}"
80+
echo "pin-status-${PKG}: ${PIN_STATUS}"
81+
echo "push-http-${PKG}: ${PUSH_STATUS}"
82+
} | summary_and_log
83+
done
84+
85+
if [ "$ALL_OK" = "1" ]; then
86+
echo "cachix-status: push-and-pin-ok-for-all-packages" >> "$SUMMARY"
87+
exit 0
88+
fi
89+
90+
RETRY_MSG="cachix-check-attempt-${i}: not-ready, retrying in ${PIN_VISIBILITY_INTERVAL_SECONDS}s"
91+
printf '%s\n' "$RETRY_MSG" | summary_and_log
92+
sleep "$PIN_VISIBILITY_INTERVAL_SECONDS"
93+
done
94+
95+
echo "cachix-status: push-or-pin-missing-after-${PIN_VISIBILITY_TIMEOUT_SECONDS}s-for-at-least-one-package" >> "$SUMMARY"
96+
# Pin API bulk JSON goes to job logs only (step summary stays readable); helps if the response shape changes.
97+
echo "check-cachix-pin: raw Cachix pin API response (last fetch):" >&2
98+
echo "$PIN_JSON" >&2
99+
exit 1

‎.github/workflows/release.yml‎

Lines changed: 52 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,10 +48,7 @@ jobs:
4848
- name: 'Build KEVM'
4949
run: |
5050
GC_DONT_GC=1 nix build --extra-experimental-features 'nix-command flakes' --print-build-logs
51-
- name: 'Test KEVM'
52-
run: |
53-
GC_DONT_GC=1 nix build --extra-experimental-features 'nix-command flakes' --print-build-logs .#kevm-test
54-
- name: 'Push KEVM'
51+
- name: 'Push KEVM dependencies to nix cache'
5552
uses: workflow/nix-shell-action@v3.0.3
5653
env:
5754
GC_DONT_GC: 1
@@ -61,7 +58,56 @@ jobs:
6158
script: |
6259
kevm=$(nix build --extra-experimental-features 'nix-command flakes' .#kevm --json | jq -r '.[].outputs | to_entries[].value')
6360
drv=$(nix-store --query --deriver ${kevm})
64-
nix-store --query --requisites --include-outputs ${drv} | cachix push k-framework
61+
nix-store --query --requisites --include-outputs ${drv} | cachix push k-framework || true
62+
- name: 'On failure, delete drafted release'
63+
if: failure()
64+
env:
65+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
66+
run: |
67+
set -x
68+
VERSION=v$(cat package/version)
69+
gh release delete ${VERSION} \
70+
--repo runtimeverification/evm-semantics \
71+
--yes \
72+
--cleanup-tag
73+
- name: 'Post failure to channel'
74+
if: failure()
75+
uses: slackapi/slack-github-action@v1.24.0
76+
with:
77+
channel-id: "#kevm-notifications"
78+
slack-message: "Failed to create KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
79+
env:
80+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
81+
82+
nix-binary-cache:
83+
name: 'Populate Nix Binary Cache'
84+
strategy:
85+
matrix:
86+
include:
87+
- runner: normal
88+
- runner: ARM64
89+
runs-on: ${{ matrix.runner }}
90+
needs: draft-release
91+
steps:
92+
- name: 'Check out code'
93+
uses: actions/checkout@v4
94+
with:
95+
ref: ${{ github.event.push.head.sha }}
96+
fetch-depth: 0
97+
- name: 'Publish KEVM to k-framework-binary cache'
98+
uses: workflow/nix-shell-action@v3.0.3
99+
env:
100+
GC_DONT_GC: '1'
101+
CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}'
102+
OWNER_REPO: '${{ github.repository }}'
103+
REV: '${{ github.sha }}'
104+
with:
105+
packages: jq
106+
script: |
107+
export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH"
108+
kup publish k-framework-binary .#kevm --keep-days 180 || true
109+
# Cachix has not been responding to 'cachix pin' requests made under the hood by kup. Verify the push and pin manually.
110+
.github/scripts/check-cachix-pin.sh
65111
- name: 'On failure, delete drafted release'
66112
if: failure()
67113
env:
@@ -85,7 +131,7 @@ jobs:
85131
make-release:
86132
name: 'Cut Release'
87133
runs-on: ubuntu-latest
88-
needs: [draft-release, nix-cache]
134+
needs: [draft-release, nix-cache, nix-binary-cache]
89135
steps:
90136
- name: 'Check out code'
91137
uses: actions/checkout@v4

0 commit comments

Comments
 (0)