Release v3.19.0 (#163) #559
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Upload Amazon Images | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| merge_group: | |
| push: | |
| branches: [main] | |
| jobs: | |
| nix-checks: | |
| name: Basic Nix checks | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: DeterminateSystems/flake-checker-action@main | |
| with: | |
| fail-mode: false | |
| - uses: DeterminateSystems/determinate-nix-action@main | |
| - uses: DeterminateSystems/flakehub-cache-action@main | |
| - name: Check Nix formatting | |
| run: | | |
| nix develop --command git ls-files -z '*.nix' | xargs -0 -r nix develop --command nixfmt --check | |
| - name: nix flake check | |
| run: | | |
| nix flake check --all-systems | |
| - name: Check external links in README | |
| continue-on-error: true | |
| run: | | |
| nix develop --command \ | |
| lychee README.md | |
| - name: check image label | |
| run: | | |
| label="$(nix eval --raw .#nixosConfigurations.x86_64-linux.config.system.nixos.label)" | |
| echo "checking label '$label'..." | |
| set -x | |
| echo "${label}" | grep -E '^[0-9][0-9]\.[0-9][0-9]\..*'; | |
| build-ami: | |
| name: Upload NixOS AMI | |
| runs-on: ${{ matrix.system.runner }} | |
| environment: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') && 'production' || '' }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| system: | |
| - nix-system: x86_64-linux | |
| runner: ubuntu-latest | |
| - nix-system: aarch64-linux | |
| runner: UbuntuLatest32Cores128GArm | |
| partition: | |
| - role: arn:aws:iam::535002876703:role/upload-ami | |
| region: us-east-2 | |
| bucket: detsys-nixos-images-20240916205705854200000001 | |
| - role: arn:aws-us-gov:iam::579351485434:role/upload-ami | |
| region: us-gov-west-1 | |
| bucket: detsys-nixos-images-20260303190747195900000001 | |
| - role: arn:aws-eusc:iam::129194717446:role/upload-ami | |
| region: eusc-de-east-1 | |
| bucket: detsys-nixos-images-20260409030044091900000001 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: DeterminateSystems/nix-installer-action@main | |
| with: | |
| determinate: true | |
| extra-conf: | | |
| extra-system-features = kvm | |
| # note: no magic-nix-cache. The build is nearly trivial, except for the gigantic disk image at the end. | |
| # No need to cache that monstrosity. | |
| - id: build-disk-image | |
| run: | | |
| nix build -L .#"diskImages.${{ matrix.system.nix-system }}.aws" | |
| suffix=$(readlink ./result | cut -d'/' -f4 | cut -d'-' -f1) | |
| echo "suffix=$suffix" >> "$GITHUB_OUTPUT" | |
| - uses: aws-actions/configure-aws-credentials@v4 | |
| if: github.event_name == 'merge_group' || github.event_name == 'push' | |
| with: | |
| role-to-assume: ${{ matrix.partition.role }} | |
| aws-region: ${{ matrix.partition.region }} | |
| - name: Upload Smoke test AMI | |
| if: github.event_name == 'merge_group' || github.event_name == 'push' | |
| id: upload-smoke-test-ami | |
| run: | | |
| epoch="$(nix eval --raw .#epoch)" | |
| prefix="smoketest/epoch-${epoch}/" | |
| image_ids=$(nix develop --command upload-ami \ | |
| --image-info "./result/nix-support/image-info.json" \ | |
| --prefix "${prefix}" \ | |
| --s3-bucket "${{ matrix.partition.bucket }}" \ | |
| --run-id '${{ steps.build-disk-image.outputs.suffix }}') | |
| echo "image_ids=$image_ids" >> "$GITHUB_OUTPUT" | |
| - name: Smoke test | |
| if: github.event_name == 'merge_group' || github.event_name == 'push' | |
| id: smoke-test | |
| # NOTE: make sure smoke test isn't cancelled so that the instance gets cleaned up | |
| run: | | |
| image_ids='${{ steps.upload-smoke-test-ami.outputs.image_ids }}' | |
| image_id=$(echo "$image_ids" | jq -r '.["${{ matrix.partition.region }}"]') | |
| nix run .#smoke-test -- \ | |
| --image-id "$image_id" \ | |
| --run-id "${{ github.run_id }}-${{ github.run_attempt }}" \ | |
| --no-spot | |
| - name: Clean up smoke test | |
| # NOTE(colemickens): NixOS/amis#smoke-test has a finally to teardown instance, this is workflow-cancellation protection | |
| if: ${{ cancelled() && (github.event_name == 'merge_group' || github.event_name == 'push') }} | |
| run: | | |
| image_ids='${{ steps.upload-smoke-test-ami.outputs.image_ids }}' | |
| image_id=$(echo "$image_ids" | jq -r '.["${{ matrix.partition.region }}"]') | |
| nix run .#smoke-test -- \ | |
| --image-id "$image_id" \ | |
| --run-id "${{ github.run_id }}-${{ github.run_attempt }}" \ | |
| --no-spot \ | |
| --cancel | |
| - name: Upload AMIs to all available regions | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| run: | | |
| epoch="$(nix eval --raw .#epoch)" | |
| prefix="determinate/nixos/epoch-${epoch}/" | |
| nix develop --command upload-ami \ | |
| --image-info "./result/nix-support/image-info.json" \ | |
| --prefix "${prefix}" \ | |
| --s3-bucket "${{ matrix.partition.bucket }}" \ | |
| --run-id "${{ github.run_id }}-${{ github.run_attempt }}" \ | |
| --copy-to-regions \ | |
| --public \ | |
| --best-effort-region me-central-1 \ | |
| --best-effort-region me-south-1 | |
| prune-old-amis: | |
| name: Prune old AMIs | |
| runs-on: ubuntu-latest | |
| environment: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') && 'production' || '' }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| partition: | |
| - role: arn:aws:iam::535002876703:role/upload-ami | |
| region: us-east-2 | |
| - role: arn:aws-us-gov:iam::579351485434:role/upload-ami | |
| region: us-gov-west-1 | |
| - role: arn:aws-eusc:iam::129194717446:role/upload-ami | |
| region: eusc-de-east-1 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: DeterminateSystems/nix-installer-action@main | |
| - uses: aws-actions/configure-aws-credentials@v4 | |
| if: github.event_name == 'merge_group' || github.event_name == 'push' | |
| with: | |
| role-to-assume: ${{ matrix.partition.role }} | |
| aws-region: ${{ matrix.partition.region }} | |
| - name: Delete old AMIs | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| run: | | |
| nix develop --command delete-deprecated-images --grace-period 90 | |
| cache-dev-environment: | |
| name: Cache Nix development environment in FlakeHub Cache | |
| runs-on: ${{ matrix.system.runner }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| system: | |
| - nix-system: x86_64-linux | |
| runner: ubuntu-latest | |
| - nix-system: aarch64-linux | |
| runner: UbuntuLatest32Cores128GArm | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: DeterminateSystems/nix-installer-action@main | |
| with: | |
| determinate: true | |
| - uses: DeterminateSystems/flakehub-cache-action@main | |
| - run: | | |
| nix build .#devShells.${{ matrix.system.nix-system }}.default | |
| notify-for-update-prs: | |
| name: Notify Discord for update_flake_lock_action PRs | |
| runs-on: ubuntu-latest | |
| needs: | |
| - nix-checks | |
| - build-ami | |
| if: always() && github.head_ref == 'update_flake_lock_action' | |
| steps: | |
| - name: Notify Discord | |
| uses: rjstone/discord-webhook-notify@v1 | |
| with: | |
| severity: info | |
| details: NixOS AMIs Update - ${{ needs.build-ami.result }} | |
| webhookUrl: ${{ secrets.DISCORD_WEBHOOK_URL }} | |
| - name: Notify Slack | |
| uses: slackapi/slack-github-action@v2.1.0 | |
| with: | |
| webhook: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| webhook-type: incoming-webhook | |
| payload: | | |
| text: "*NixOS AMI Update*: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}" | |
| blocks: | |
| - type: "section" | |
| text: | |
| type: "mrkdwn" | |
| text: "GitHub Action build result: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}" | |
| success: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - nix-checks | |
| - build-ami | |
| - prune-old-amis | |
| - cache-dev-environment | |
| if: ${{ always() }} | |
| steps: | |
| - run: "true" | |
| - run: | | |
| echo "A dependent in the build matrix failed." | |
| exit 1 | |
| if: | | |
| contains(needs.*.result, 'failure') || | |
| contains(needs.*.result, 'cancelled') |