nhost/.github/workflows/wf_check.yaml at main · superstruct/nhost · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
---
on:
  workflow_call:
    inputs:
      NAME:
        type: string
        required: true
      PATH:
        type: string
        required: true
      GIT_REF:
        type: string
        required: false
      ENV:
        type: string
        required: false
        default: ''
    secrets:
      AWS_ACCOUNT_ID:
        required: true
      NIX_CACHE_PUB_KEY:
        required: true
      NIX_CACHE_PRIV_KEY:
        required: true
      NIX_CACHE_ACCESS_KEY_ID:
        required: true
      NIX_CACHE_SECRET_ACCESS_KEY:
        required: true
      NHOST_PAT:
        required: false

jobs:
  tests:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 30

    defaults:
      run:
        working-directory: ${{ inputs.PATH }}

    env:
      NHOST_PAT: ${{ secrets.NHOST_PAT }}

    permissions:
      id-token: write
      contents: write
      actions: read

    steps:
    - name: "Set custom env"
      if: ${{ inputs.ENV != '' }}
      run: echo "${{ inputs.ENV }}" >> $GITHUB_ENV
      working-directory: .

    - name: "Check out repository"
      uses: actions/checkout@v6
      with:
        ref: ${{ inputs.GIT_REF }}

    - name: Collect Workflow Telemetry
      uses: catchpoint/workflow-telemetry-action@v2
      with:
        comment_on_pr: false

    - name: Configure aws
      uses: aws-actions/configure-aws-credentials@v6
      with:
        role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-nhost-${{ github.event.repository.name }}
        aws-region: eu-central-1

    - name: Setup Nix with Cache
      uses: ./.github/actions/setup-nix
      with:
        NAME: ${{ inputs.NAME }}
        NIX_CACHE_PUB_KEY: ${{ secrets.NIX_CACHE_PUB_KEY }}
        NIX_CACHE_ACCESS_KEY_ID: ${{ secrets.NIX_CACHE_ACCESS_KEY_ID }}
        NIX_CACHE_SECRET_ACCESS_KEY: ${{ secrets.NIX_CACHE_SECRET_ACCESS_KEY }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: "Verify if we need to build"
      id: verify-build
      run: |
        # `nix build --dry-run` (inside `make check-dry-run`) walks the
        # full build graph and reports what would be built locally vs
        # fetched from configured substituters (cache.nixos.org + our
        # S3 cache). If any derivation would be built we have new paths
        # worth uploading. This catches the case where the top-level
        # output is cached but transitive build deps aren't — `nix
        # path-info --recursive` only sees the runtime closure, which
        # misses build-time intermediates.
        stderr_log=$(mktemp)
        if ! drvPath=$(make check-dry-run 2>"$stderr_log"); then
          cat "$stderr_log" >&2
          rm -f "$stderr_log"
          exit 1
        fi
        export drvPath
        echo "Derivation path: $drvPath"
        if grep -q "will be built" "$stderr_log"; then
          export BUILD_NEEDED=yes
        else
          export BUILD_NEEDED=no
        fi
        rm -f "$stderr_log"
        echo BUILD_NEEDED=$BUILD_NEEDED >> $GITHUB_OUTPUT
        echo DERIVATION_PATH=$drvPath >> $GITHUB_OUTPUT

    - name: "Start containters for integration tests"
      run: |
        nix develop .\#${{ inputs.NAME }} -c make dev-env-up
      if: ${{ steps.verify-build.outputs.BUILD_NEEDED == 'yes' }}

    - name: "Run checks"
      run: make check
      if: ${{ steps.verify-build.outputs.BUILD_NEEDED == 'yes' }}

    - name: "Store Nix cache"
      uses: ./.github/actions/cache-nix
      with:
        NIX_CACHE_PRIV_KEY: ${{ secrets.NIX_CACHE_PRIV_KEY }}
        NIX_CACHE_ACCESS_KEY_ID: ${{ secrets.NIX_CACHE_ACCESS_KEY_ID }}
        NIX_CACHE_SECRET_ACCESS_KEY: ${{ secrets.NIX_CACHE_SECRET_ACCESS_KEY }}
      if: ${{ always() && steps.verify-build.outputs.BUILD_NEEDED == 'yes' }}