chore: cleanup and nixify #90
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: nix | |
| on: | |
| pull_request: | |
| branches: [ "main" ] | |
| push: | |
| branches: [ "main" ] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 | |
| - uses: cachix/install-nix-action@v23 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ github.token }} | |
| - uses: cachix/cachix-action@v12 | |
| with: | |
| extraPullNames: vault-auth-tee nixsgx | |
| - run: nix flake check -L --show-trace --keep-going | |
| fmt: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 | |
| - uses: cachix/install-nix-action@v23 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ github.token }} | |
| - uses: cachix/cachix-action@v12 | |
| with: | |
| extraPullNames: vault-auth-tee nixsgx | |
| - run: nix fmt | |
| clippy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 | |
| - uses: cachix/install-nix-action@v23 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ github.token }} | |
| - uses: cachix/cachix-action@v12 | |
| with: | |
| extraPullNames: vault-auth-tee nixsgx | |
| # Cache any artifacts that aren't already cached at https://cache.nixos.org | |
| - name: Enable magic Nix cache | |
| uses: DeterminateSystems/magic-nix-cache-action@main | |
| - name: cargo clippy | |
| run: nix develop -L --ignore-environment -c cargo clippy --all --locked | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 | |
| - uses: cachix/install-nix-action@v23 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ github.token }} | |
| - uses: cachix/cachix-action@v12 | |
| with: | |
| extraPullNames: vault-auth-tee nixsgx | |
| # Cache any artifacts that aren't already cached at https://cache.nixos.org | |
| - name: Enable magic Nix cache | |
| uses: DeterminateSystems/magic-nix-cache-action@main | |
| - name: nix build | |
| run: nix run nixpkgs#nixci | |
| push_to_docker: | |
| needs: build | |
| # if: ${{ github.event_name == 'push' }} | |
| runs-on: ubuntu-latest | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.config.dockerfile }} | |
| cancel-in-progress: true | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - { nixpackage: 'container-vault-sgx-azure', dockerfile: 'packages/container-vault-sgx-azure/Dockerfile', tag: 'vault:latest', repository: 'teepot-vault' } | |
| - { nixpackage: 'container-vault-unseal-sgx-azure', dockerfile: 'packages/container-vault-unseal-sgx-azure/Dockerfile', tag: 'tvu:latest', repository: 'teepot-tvu' } | |
| - { nixpackage: 'container-vault-admin-sgx-azure', dockerfile: 'packages/container-vault-admin-sgx-azure/Dockerfile', tag: 'tva:latest', repository: 'teepot-tva' } | |
| - { nixpackage: 'container-verify-attestation' } | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: cachix/install-nix-action@v23 | |
| with: | |
| extra_nix_config: | | |
| access-tokens = github.com=${{ github.token }} | |
| - uses: cachix/cachix-action@v12 | |
| with: | |
| extraPullNames: vault-auth-tee nixsgx | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Load and Push nix container | |
| run: | | |
| nix build -L .#${{ matrix.config.nixpackage }} | |
| export IMAGE_TAG=$(docker load < result | grep -Po 'Loaded image.*: \K.*') | |
| echo "Pushing image ${IMAGE_TAG} to Docker Hub" | |
| docker tag "${IMAGE_TAG}" matterlabsrobot/"${IMAGE_TAG}" | |
| docker push matterlabsrobot/"${IMAGE_TAG}" | |
| docker tag matterlabsrobot/"${IMAGE_TAG}" matterlabsrobot/"${IMAGE_TAG%:*}:latest" | |
| docker push matterlabsrobot/"${IMAGE_TAG%:*}:latest" | |
| - name: Generate build ID for Flux Image Automation | |
| if: ${{ matrix.config.dockerfile }} | |
| id: buildid | |
| run: | | |
| sha=$(git rev-parse --short HEAD) | |
| ts=$(date +%s%N | cut -b1-13) | |
| echo "BUILD_ID=${sha}-${ts}" >> "$GITHUB_OUTPUT" | |
| - name: Build and Push Container | |
| if: ${{ matrix.config.dockerfile }} | |
| uses: docker/build-push-action@v5 | |
| with: | |
| file: ${{ matrix.config.dockerfile }} | |
| tags: | | |
| "matterlabsrobot/${{ matrix.config.repository }}:latest" | |
| "matterlabsrobot/${{ matrix.config.repository }}:${{ steps.buildid.outputs.BUILD_ID }}" | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max,ignore-error=true | |
| push: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} |