Bernardo Magri
d5ee59fcb1
Some checks failed
Check / eval (push) Has been cancelled
Standing decision: IONOS Gitea/act_runner docker stays eval-tier. vm-checks needs a separate KVM host later — not the 4G compose box.
103 lines
4.4 KiB
YAML
103 lines
4.4 KiB
YAML
# Nomarchy CI — the always-on net under direct-to-main pushes.
|
|
#
|
|
# Scope (deliberate): the EVAL tier only. The runner behind this Gitea
|
|
# instance is act_runner + docker containers (the legacy repo's check.yml
|
|
# ran 57 times on it) — no systemd, no /dev/kvm — so the checks.* VM
|
|
# tests and full toplevel builds can't run here. `nix flake check
|
|
# --no-build` still catches most breakage (type errors, missing options,
|
|
# bad merges, template/mkFlake drift — see docs/TESTING.md §1); the VM
|
|
# suite stays a local/promotion gate until a KVM-capable NixOS runner
|
|
# exists (see the commented vm-checks job at the bottom).
|
|
#
|
|
# Inherited-from-legacy gotchas (learned over 57 runs, kept verbatim):
|
|
# - Single-user Nix (--no-daemon): no systemd in the container. The
|
|
# installer runs as root and honours build-users-group=nixbld from
|
|
# its bundled nix.conf, aborting unless the group exists AND has
|
|
# members — create nixbld + users first.
|
|
# - sandbox=false: Stylix/base16.nix do import-from-derivation; the
|
|
# single-user Nix in this container can't set up the build sandbox
|
|
# (no user namespaces), which otherwise surfaces as
|
|
# "path '…-source' is not valid".
|
|
# - Pin the Nix version: 2.34's lazy-trees git cache doesn't
|
|
# materialise flake-input `-source` paths into the store, breaking
|
|
# the same IFD reads. 2.31.5 matches what wrote flake.lock.
|
|
# - Plain-shell Nix install, not a JS action: act_runner's bundled act
|
|
# tops out at node20; a `run:` step has no node-runtime coupling.
|
|
|
|
name: Check
|
|
|
|
on:
|
|
push:
|
|
branches: [main, v1]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
eval:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
env:
|
|
NIX_CONFIG: |
|
|
experimental-features = nix-command flakes
|
|
sandbox = false
|
|
NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install Nix
|
|
run: |
|
|
NIX_VERSION=2.31.5
|
|
groupadd -r nixbld 2>/dev/null || true
|
|
for i in $(seq 1 10); do
|
|
useradd -r -g nixbld -G nixbld -d /var/empty \
|
|
-s /usr/sbin/nologin -c "Nix build user $i" "nixbld$i" 2>/dev/null || true
|
|
done
|
|
curl -L "https://releases.nixos.org/nix/nix-${NIX_VERSION}/install" | sh -s -- --no-daemon
|
|
echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: nix flake check (eval only)
|
|
# Full module-system evaluation of every output — both nixos
|
|
# configs, the home config, the checks.* derivations (instantiated,
|
|
# not run) and the downstream template through lib.mkFlake.
|
|
run: nix flake check --no-build
|
|
|
|
- name: Python syntax (all tracked scripts)
|
|
# Every tracked *.py — theme-sync, the installer composers
|
|
# (compose-lock, patch-template) and the maintainer tools
|
|
# (tools/, tools/vm/). Via nix shell so the step doesn't depend on
|
|
# the runner image preinstalling python3.
|
|
run: |
|
|
nix shell nixpkgs#python3 --command \
|
|
bash -c 'git ls-files "*.py" | xargs -r python3 -m py_compile'
|
|
|
|
- name: Shell syntax (tracked scripts)
|
|
# The distro's user-facing scripts are generated by Nix (their
|
|
# syntax is exercised by the eval + local builds); this covers the
|
|
# hand-written .sh files: installer helpers and maintainer tools.
|
|
run: |
|
|
set -e
|
|
fail=0
|
|
while IFS= read -r script; do
|
|
head -1 "$script" | grep -qE '^#!.*\b(bash|sh)\b' || continue
|
|
if ! bash -n "$script"; then
|
|
echo "::error file=$script::bash syntax error"
|
|
fail=1
|
|
fi
|
|
done < <(git ls-files '*.sh')
|
|
exit "$fail"
|
|
|
|
# ── vm-checks (DISABLED — FUTURE #20, not NEXT) ─────────────────────
|
|
# Eval-only CI is the standing decision: Gitea act_runner stays docker
|
|
# compose (no /dev/kvm). Full checks.* VMs need a *separate* host with
|
|
# nix + KVM (label nix-kvm); see agent/BACKLOG.md FUTURE #20. Do NOT
|
|
# uncomment until that label is online — Gitea queues forever otherwise.
|
|
#
|
|
# vm-checks:
|
|
# runs-on: nix-kvm
|
|
# timeout-minutes: 120
|
|
# steps:
|
|
# - uses: actions/checkout@v4
|
|
# - run: nix flake check # builds + runs the VM tests
|
|
# - run: nix build .#nixosConfigurations.nomarchy.config.system.build.toplevel --no-link
|
|
# - run: nix build .#homeConfigurations.nomarchy.activationPackage --no-link
|