orb-software/.github/workflows/nix-ci.yaml at 22ebfd894b66f3a6e1b88e628a41336fc8d23210 · worldcoin/orb-software · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
name: Nix CI
on:
  pull_request:
  workflow_dispatch:
  workflow_call:
    secrets:
      ORB_GIT_HUB_TOKEN:
        required: true
      CACHIX_AUTH_TOKEN:
        required: false
  push:
    branches:
      - main
      - prod
    tags:
      - '**'

env:
  CI_NIXOS_HOSTNAMES: ryan-worldcoin-hil worldcoin-hil-munich-0 worldcoin-hil-munich-1 worldcoin-hil-munich-2 worldcoin-hil-jabil-0

jobs:
  fmt:
    name: Format
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3
        with:
          token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # pin@v31.8.4
        with:
          github_access_token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # pin@v15
        continue-on-error: true
        with:
          name: worldcoin
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Print environment
        run: |
          uname -a
          nix develop -c env

      - name: Check Nix formatting
        run: |
          nix develop -c \
            treefmt --ci

  shells:
    name: Check that devshells work
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3
        with:
          token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # pin@v31.8.4
        with:
          github_access_token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # pin@v15
        continue-on-error: true
        with:
          name: worldcoin
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Authorize private git repos
        run: git config --global url."https://${{ secrets.ORB_GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com
      - name: Confirm HIL FhsEnv works
        run: |
          set -Eeux -o pipefail
          # build only due to bwrap permissions in github owned runners
          nix build --print-build-logs .#tegra-bash

      - name: Confirm devshell works
        run: |
          set -Eeux -o pipefail
          OUTPUT="$(nix develop --print-build-logs --command -- echo testoutput)"
          [[ "${OUTPUT}" == "testoutput" ]]

  nixos:
    name: Build NixOS Machines
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3
        with:
          token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # pin@v31.8.4
        with:
          github_access_token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # pin@v15
        continue-on-error: true
        with:
          name: worldcoin
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Authorize private git repos
        run: git config --global url."https://${{ secrets.ORB_GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com

      - name: Build NixOS configurations
        run: |
          set -Eeux -o pipefail
          # TODO: Build *all* configurations.
          for hostname in ${CI_NIXOS_HOSTNAMES}; do
            nix build --print-build-logs .#nixosConfigurations.${hostname}.config.system.build.toplevel
          done

  liveusb:
    name: Build NixOS Installer
    runs-on: public-ubuntu-24.04-32core
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3
        with:
          token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # pin@v31.8.4
        with:
          github_access_token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # pin@v15
        continue-on-error: true
        with:
          name: worldcoin
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Authorize private git repos
        run: git config --global url."https://${{ secrets.ORB_GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com

      - name: Build Disko Image Script
        run: |
          set -Eeuxo pipefail
          nix build --print-build-logs .#nixosConfigurations.liveusb.config.system.build.diskoImagesScript
          ls -alhR ./result
      - name: Run Disko Image Script
        run: |
          set -Eeuxo pipefail
          sudo prlimit --pid $$ --nofile=500000:500000
          ./result --build-memory 1024
          ls -lh *.raw
      - name: Compress artifact
        run: |
          set -Eeuxo pipefail
          mkdir -p artifacts
          gzip --stdout liveusb.raw > artifacts/liveusb.raw.gz
          ls -aRsh artifacts

      - name: Upload Artifacts
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # pin@v4.3.3
        if: github.event_name == 'workflow_dispatch' || format('refs/heads/{0}', github.event.repository.default_branch) == github.ref
        with:
          # upload v4 doesn't support writing multiple times to the same artifact name.
          # so its important that we name it after the workflow and not something
          # general like "artifacts"
          name: nix
          path: artifacts/*
          compression-level: 0
          if-no-files-found: error
          retention-days: 14