macro/.github/workflows/push_local_stack_binaries.yml at main · MantisShrimpdev/macro · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# DO NOT EDIT — regenerate with `cargo x workflows` (from the repository root).
# Source: tooling/xtask/crates/xtask_workflows/src/workflows/push_local_stack_binaries.rs
name: Push local stack binaries
'on':
  push:
    branches:
    - main
  workflow_dispatch: {}
permissions:
  contents: read
jobs:
  push:
    name: Build and push local-stack-binaries
    runs-on: namespace-profile-linux-mid
    steps:
    - name: Checkout Repo
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      with:
        persist-credentials: 'false'
    - name: Mount /nix cache volume
      uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0
      with:
        cache: nix
      continue-on-error: true
    - name: Setup Nix
      uses: './.github/actions/setup-nix'
      with:
        nix-cache-url: ${{ vars.NIX_CACHE_URL }}
        nix-cache-public-key: ${{ vars.NIX_CACHE_PUBLIC_KEY }}
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    - name: Build local stack binaries
      run: |-
        set -euo pipefail
        nix build --print-build-logs ".#local-stack-binaries"
        echo "Local stack binaries realised into /nix/store."
      shell: bash
    - name: Push to nix cache
      run: |
        set -uo pipefail
        if [[ -z "${NIX_CACHE_URL:-}" || -z "${NIX_CACHE_SIGNING_KEY:-}" ]]; then
          echo "nix cache not configured; skipping push"
          exit 0
        fi
        key="$RUNNER_TEMP/nix-cache-signing-key"
        printf '%s\n' "$NIX_CACHE_SIGNING_KEY" > "$key"
        sep='?'; [[ "$NIX_CACHE_URL" == *\?* ]] && sep='&'
        # shellcheck disable=SC2086 # TARGETS is a list on purpose
        nix copy --to "${NIX_CACHE_URL}${sep}secret-key=${key}" $TARGETS \
          || echo "::warning::nix cache push failed (non-fatal)"
        rm -f "$key"
      shell: bash
      env:
        TARGETS: '.#local-stack-binaries'
        NIX_CACHE_URL: ${{ vars.NIX_CACHE_URL }}
        NIX_CACHE_SIGNING_KEY: ${{ secrets.NIX_CACHE_SIGNING_KEY }}
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    - name: Teardown Nix
      if: always()
      uses: './.github/actions/teardown-nix'
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true