ci: back to garnix

.github/workflows/docker.yaml

@@ -1,12 +1,53 @@
 name: Push to image registry
 
 on:
-  workflow_call:
+  check_suite:
+    types: [completed]
   workflow_dispatch:
 
 jobs:
+  build:
+    name: Build image
+
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        arch: [x86_64, aarch64]
+
+    # https://github.com/sellout/bash-strict-mode/commit/9bf1d65c2f786a9887facfcb81e06d8b8b5f4667
+    if: github.event.check_suite.app.name == 'Garnix CI'
+      && github.event.check_suite.conclusion == 'success'
+      && github.event.check_suite.latest_check_runs_count >= 8
+      && github.event.check_suite.head_branch == 'main'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v9
+
+      - name: Setup Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@v2
+
+      - name: Build Docker image
+        id: build
+        run: |
+          nix build -L --accept-flake-config .#container-${{ matrix.arch }}
+          [ ! -L result ] && exit 1
+          echo "path=$(realpath result)" >> "$GITHUB_OUTPUT"
+
+      - name: Upload image
+        uses: actions/upload-artifact@v3
+        with:
+          name: container-${{ matrix.arch }}
+          path: ${{ steps.build.outputs.path }}
+          if-no-files-found: error
+          retention-days: 1
+
   push:
     name: Push image
+
+    needs: build
     runs-on: ubuntu-latest
 
     permissions:
@@ -23,15 +64,10 @@ jobs:
 
       - uses: actions/checkout@v4
 
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v9
-
-      - name: Setup Attic cache
-        uses: ryanccn/attic-action@v0
+      - name: Download images
+        uses: actions/download-artifact@v3
         with:
-          endpoint: https://cache.mydadleft.me
-          cache: teawiebot
-          token: ${{ secrets.ATTIC_TOKEN }}
+          path: images
 
       - name: Login to registry
         uses: docker/login-action@v3
@@ -48,11 +84,9 @@ jobs:
 
           architectures=("x86_64" "aarch64")
           for arch in "${architectures[@]}"; do
-            nix build -L --accept-flake-config .#container-"$arch"
-            docker load < result
-            docker tag ${{ env.IMAGE_NAME }}:latest-"$arch" ${{ env.TAG }}-"$arch"
+            docker load < images/container-"$arch"/*.tar.gz
+            docker tag teawiebot:latest-"$arch" ${{ env.TAG }}-"$arch"
             docker push ${{ env.TAG }}-"$arch"
-            rm result
           done
 
           docker manifest create ${{ env.TAG }} \

.github/workflows/update-flake.yaml

@@ -10,6 +10,10 @@ jobs:
   update:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+      pull-requests: write
+
     steps:
       - uses: actions/checkout@v4
 
@@ -22,11 +26,11 @@ jobs:
         with:
           commit-msg: "flake: update inputs"
           pr-title: "flake: update inputs"
-          token: ${{ secrets.MERGE_TOKEN }}
+          token: ${{ github.token }}
 
       - name: Enable auto-merge
         shell: bash
         run: gh pr merge --auto --rebase "$PR_ID"
         env:
-          GH_TOKEN: ${{ secrets.MERGE_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           PR_ID: ${{ steps.update.outputs.pull-request-number }}

README.md

@@ -1,6 +1,6 @@
 # teawie bot 🦀🦀🦀
 
-[![Build status](https://img.shields.io/github/actions/workflow/status/getchoo/teawiebot/ci.yaml?style=flat-square&logo=github&label=Build%20status&color=5277c3)](https://github.com/getchoo/teawiebot/actions/workflows/ci.yaml)
+[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgetchoo%2FteawieBot)](https://garnix.io)
 
 okay so like basically, it's just a discord bot named "teawie" (so cool!!
 and now in rust!!!)🚀🚀

flake.nix

@@ -2,8 +2,8 @@
   description = "teawie moment";
 
   nixConfig = {
-    extra-substituters = ["https://cache.mydadleft.me/teawiebot"];
-    extra-trusted-public-keys = ["teawiebot:vp7AaQ042O/3326DMMtLF4MOUa5/kCBAq+YApy5GWXA="];
+    extra-substituters = ["https://cache.garnix.io"];
+    extra-trusted-public-keys = ["cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="];
   };
 
   inputs = {
@@ -27,11 +27,6 @@
     proc-flake.url = "github:srid/proc-flake";
     flake-root.url = "github:srid/flake-root";
 
-    nix2workflow = {
-      url = "github:getchoo/nix2workflow";
-      inputs.nixpkgs-lib.follows = "nixpkgs";
-    };
-
     pre-commit = {
       url = "github:cachix/pre-commit-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -43,16 +38,13 @@
     parts.lib.mkFlake {inherit inputs;} {
       imports = [
         inputs.pre-commit.flakeModule
-
         inputs.proc-flake.flakeModule
         inputs.flake-root.flakeModule
 
-        inputs.nix2workflow.flakeModule
-
+        ./nix/ci.nix
         ./nix/deployment.nix
         ./nix/dev.nix
         ./nix/packages.nix
-        ./nix/workflow.nix
       ];
 
       systems = [

garnix.yaml

@@ -0,0 +1,6 @@
+builds:
+  exclude: []
+  include:
+    - "checks.x86_64-linux.*"
+    - "packages.x86_64-linux.*"
+    - "devShells.x86_64-linux.default"

nix/ci.nix

@@ -0,0 +1,25 @@
+{
+  perSystem = {
+    pkgs,
+    lib,
+    config,
+    ...
+  }: {
+    /*
+    require packages, checks, and devShells for ci to be considered a success
+
+    also thanks DetSys for showing me i don't need to use runCommand, symlinkJoin, or linkFarm!
+    https://determinate.systems/posts/hydra-deployment-source-of-truth
+    */
+
+    packages.ciGate = pkgs.writeText "ci-gate" ''
+      ${
+        lib.concatMapStringsSep "\n" (s: toString (builtins.attrValues s)) [
+          config.checks
+          config.devShells
+          (builtins.removeAttrs config.packages ["default" "ciGate"])
+        ]
+      }
+    '';
+  };
+}

nix/deployment.nix

@@ -13,8 +13,6 @@
     inputs',
     ...
   }: let
-    name = "getchoo/teawiebot";
-
     crossPkgsFor = lib.fix (finalAttrs: {
       "x86_64-linux" = {
         "x86_64" = pkgs.pkgsStatic;
@@ -70,7 +68,7 @@
 
     containerFor = arch:
       pkgs.dockerTools.buildLayeredImage {
-        inherit name;
+        name = "teawiebot";
         tag = "latest-${arch}";
         contents = [pkgs.dockerTools.caCertificates];
         config.Cmd = [(wieFor arch)];