publish.yml

name: Upload Amazon Images

permissions:
  contents: read

on:
  pull_request:
  merge_group:
  push:
    branches: [main]

jobs:
  nix-checks:
    name: Basic Nix checks
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: DeterminateSystems/flake-checker-action@main
        with:
          fail-mode: false

      - uses: DeterminateSystems/determinate-nix-action@main

      - uses: DeterminateSystems/flakehub-cache-action@main

      - name: Check Nix formatting
        run: |
          nix develop --command  git ls-files -z '*.nix' | xargs -0 -r nix develop --command nixfmt --check

      - name: nix flake check
        run: |
          nix flake check --all-systems

      - name: Check external links in README
        continue-on-error: true
        run: |
          nix develop --command \
            lychee README.md

      - name: check image label
        run: |
          label="$(nix eval --raw .#nixosConfigurations.x86_64-linux.config.system.nixos.label)"
          echo "checking label '$label'..."
          set -x
          echo "${label}" | grep -E '^[0-9][0-9]\.[0-9][0-9]\..*';

  build-ami:
    name: Upload NixOS AMI
    runs-on: ${{ matrix.system.runner }}
    environment: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') && 'production' || '' }}

    permissions:
      contents: read
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        system:
          - nix-system: x86_64-linux
            runner: ubuntu-latest
          - nix-system: aarch64-linux
            runner: UbuntuLatest32Cores128GArm
        partition:
          - role: arn:aws:iam::535002876703:role/upload-ami
            region: us-east-2
            bucket: detsys-nixos-images-20240916205705854200000001
          - role: arn:aws-us-gov:iam::579351485434:role/upload-ami
            region: us-gov-west-1
            bucket: detsys-nixos-images-20260303190747195900000001
          - role: arn:aws-eusc:iam::129194717446:role/upload-ami
            region: eusc-de-east-1
            bucket: detsys-nixos-images-20260409030044091900000001

    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
          extra-conf: |
            extra-system-features = kvm

      # note: no magic-nix-cache. The build is nearly trivial, except for the gigantic disk image at the end.
      # No need to cache that monstrosity.

      - id: build-disk-image
        run: |
          nix build -L .#"diskImages.${{ matrix.system.nix-system }}.aws"
          suffix=$(readlink ./result | cut -d'/' -f4 | cut -d'-' -f1)
          echo "suffix=$suffix" >> "$GITHUB_OUTPUT"

      - uses: aws-actions/configure-aws-credentials@v4
        if: github.event_name == 'merge_group' || github.event_name == 'push'
        with:
          role-to-assume: ${{ matrix.partition.role }}
          aws-region: ${{ matrix.partition.region }}

      - name: Upload Smoke test AMI
        if: github.event_name == 'merge_group' || github.event_name == 'push'
        id: upload-smoke-test-ami
        run: |
          epoch="$(nix eval --raw .#epoch)"
          prefix="smoketest/epoch-${epoch}/"
          image_ids=$(nix develop --command upload-ami \
            --image-info "./result/nix-support/image-info.json" \
            --prefix "${prefix}" \
            --s3-bucket "${{ matrix.partition.bucket }}" \
            --run-id '${{ steps.build-disk-image.outputs.suffix }}')

          echo "image_ids=$image_ids" >> "$GITHUB_OUTPUT"

      - name: Smoke test
        if: github.event_name == 'merge_group' || github.event_name == 'push'
        id: smoke-test
        # NOTE: make sure smoke test isn't cancelled so that the instance gets cleaned up
        run: |
          image_ids='${{ steps.upload-smoke-test-ami.outputs.image_ids }}'
          image_id=$(echo "$image_ids" | jq -r '.["${{ matrix.partition.region }}"]')
          nix run .#smoke-test -- \
            --image-id "$image_id" \
            --run-id "${{ github.run_id }}-${{ github.run_attempt }}" \
            --no-spot

      - name: Clean up smoke test
        # NOTE(colemickens): NixOS/amis#smoke-test has a finally to teardown instance, this is workflow-cancellation protection
        if: ${{ cancelled() && (github.event_name == 'merge_group' || github.event_name == 'push') }}
        run: |
          image_ids='${{ steps.upload-smoke-test-ami.outputs.image_ids }}'
          image_id=$(echo "$image_ids" | jq -r '.["${{ matrix.partition.region }}"]')
          nix run .#smoke-test -- \
            --image-id "$image_id" \
            --run-id "${{ github.run_id }}-${{ github.run_attempt }}" \
            --no-spot \
            --cancel

      - name: Upload AMIs to all available regions
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          epoch="$(nix eval --raw .#epoch)"
          prefix="determinate/nixos/epoch-${epoch}/"
          nix develop --command upload-ami \
            --image-info "./result/nix-support/image-info.json" \
            --prefix "${prefix}" \
            --s3-bucket "${{ matrix.partition.bucket }}" \
            --run-id "${{ github.run_id }}-${{ github.run_attempt }}" \
            --copy-to-regions \
            --public \
            --best-effort-region me-central-1 \
            --best-effort-region me-south-1

  prune-old-amis:
    name: Prune old AMIs
    runs-on: ubuntu-latest
    environment: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') && 'production' || '' }}

    permissions:
      contents: read
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        partition:
          - role: arn:aws:iam::535002876703:role/upload-ami
            region: us-east-2
          - role: arn:aws-us-gov:iam::579351485434:role/upload-ami
            region: us-gov-west-1
          - role: arn:aws-eusc:iam::129194717446:role/upload-ami
            region: eusc-de-east-1

    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main

      - uses: aws-actions/configure-aws-credentials@v4
        if: github.event_name == 'merge_group' || github.event_name == 'push'
        with:
          role-to-assume: ${{ matrix.partition.role }}
          aws-region: ${{ matrix.partition.region }}

      - name: Delete old AMIs
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          nix develop --command delete-deprecated-images --grace-period 90

  cache-dev-environment:
    name: Cache Nix development environment in FlakeHub Cache
    runs-on: ${{ matrix.system.runner }}
    permissions:
      contents: read
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        system:
          - nix-system: x86_64-linux
            runner: ubuntu-latest
          - nix-system: aarch64-linux
            runner: UbuntuLatest32Cores128GArm
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: DeterminateSystems/flakehub-cache-action@main
      - run: |
          nix build .#devShells.${{ matrix.system.nix-system }}.default

  notify-for-update-prs:
    name: Notify Discord for update_flake_lock_action PRs
    runs-on: ubuntu-latest
    needs:
      - nix-checks
      - build-ami
    if: always() && github.head_ref == 'update_flake_lock_action'
    steps:
      - name: Notify Discord
        uses: rjstone/discord-webhook-notify@v1
        with:
          severity: info
          details: NixOS AMIs Update - ${{ needs.build-ami.result }}
          webhookUrl: ${{ secrets.DISCORD_WEBHOOK_URL }}
      - name: Notify Slack
        uses: slackapi/slack-github-action@v2.1.0
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
          webhook-type: incoming-webhook
          payload: |
            text: "*NixOS AMI Update*: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}"
            blocks:
              - type: "section"
                text:
                  type: "mrkdwn"
                  text: "GitHub Action build result: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}"

  success:
    runs-on: ubuntu-latest
    needs:
      - nix-checks
      - build-ami
      - prune-old-amis
      - cache-dev-environment
    if: ${{ always() }}
    steps:
      - run: "true"
      - run: |
          echo "A dependent in the build matrix failed."
          exit 1
        if: |
          contains(needs.*.result, 'failure') ||
          contains(needs.*.result, 'cancelled')