1dd0e2f4b9
Some checks failed
Check / eval-and-lint (push) Failing after 2s
Gitea only scans .gitea/workflows and .github/workflows; it does not scan .forgejo/workflows (that path is Forgejo-only). The CI was therefore dormant on a Gitea instance regardless of whether Actions was enabled. git mv to .gitea/workflows/ (scanned by both Gitea and Forgejo). Updated the live references in STRUCTURE.md (Gitea + act_runner), AGENT.md, and today's ROADMAP entry; left the dated historical Shipped entries as the changelog they are. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
114 lines
5.0 KiB
YAML
114 lines
5.0 KiB
YAML
# Nomarchy CI — eval + lint.
|
|
#
|
|
# Catches the regressions that hurt today:
|
|
# 1. Flake stops evaluating (broken option ref, missing import, etc.).
|
|
# 2. A `nomarchy-*` shell script has a syntax error or a shellcheck
|
|
# error-severity issue.
|
|
# 3. `docs/SCRIPTS.md` drifts from the repo state because somebody
|
|
# added / removed / renamed a script and didn't run the generator
|
|
# (the pre-commit hook handles this, but only when enabled per-clone).
|
|
# 4. An opt-in nomarchy.* toggle stops evaluating. `nix flake check`
|
|
# only evaluates the four default configs, so a bug that only fires
|
|
# when a toggle is flipped sails through (e.g. the impermanence
|
|
# systemd-stage-1 assertion). nomarchy-eval-matrix layers each toggle
|
|
# onto the default config and forces system.build.toplevel.
|
|
#
|
|
# Doesn't build ISOs — that needs a binary cache. Add a separate job
|
|
# once Cachix/Attic is in place.
|
|
|
|
name: Check
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
eval-and-lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install Nix
|
|
uses: DeterminateSystems/nix-installer-action@main
|
|
with:
|
|
# Match the runner's effective channel. Nomarchy itself tracks
|
|
# nixos-25.11 via flake.nix; the installer-action default is fine.
|
|
extra-conf: |
|
|
experimental-features = nix-command flakes
|
|
|
|
- name: nix flake check --no-build
|
|
run: nix flake check --no-build
|
|
|
|
- name: Evaluate opt-in toggle / palette / home matrix
|
|
# flake check never flips a nomarchy.* toggle; this does. jq is
|
|
# provided via nix shell so the step doesn't depend on the runner
|
|
# image preinstalling it.
|
|
run: nix shell nixpkgs#jq --command ./bin/utils/nomarchy-eval-matrix
|
|
|
|
- name: Lint nomarchy-* scripts (bash -n + shellcheck)
|
|
run: |
|
|
# Mirror what .githooks/pre-commit runs locally, but across the
|
|
# whole tree instead of just changed files. Pre-commit gates
|
|
# individual commits; CI gates branches (including --no-verify
|
|
# bypasses).
|
|
set -e
|
|
fail=0
|
|
while IFS= read -r script; do
|
|
[[ -f "$script" ]] || continue
|
|
# Python helpers ship under the same nomarchy- prefix
|
|
# (e.g. nomarchy-haptic-touchpad). Skip non-bash.
|
|
head -1 "$script" | grep -qE '^#!.*\bbash\b' || continue
|
|
if ! bash -n "$script"; then
|
|
echo "::error file=$script::bash syntax error"
|
|
fail=1
|
|
fi
|
|
if ! nix shell nixpkgs#shellcheck --command shellcheck \
|
|
--severity=error --shell=bash "$script"; then
|
|
echo "::error file=$script::shellcheck error-severity issue"
|
|
fail=1
|
|
fi
|
|
done < <(find features/scripts/utils core/system/scripts \
|
|
themes/engine/scripts \
|
|
-maxdepth 1 -type f -name 'nomarchy-*')
|
|
exit "$fail"
|
|
|
|
- name: docs/SCRIPTS.md is up to date
|
|
run: |
|
|
# Regenerate to a temp file and compare. If different, the
|
|
# contributor forgot to run the generator (or skipped the
|
|
# pre-commit hook). Fail loudly and tell them the fix.
|
|
./bin/utils/nomarchy-docs-scripts --out /tmp/SCRIPTS.regen.md
|
|
if ! diff -q docs/SCRIPTS.md /tmp/SCRIPTS.regen.md >/dev/null; then
|
|
echo "::error::docs/SCRIPTS.md is stale."
|
|
echo "Run: ./bin/utils/nomarchy-docs-scripts --out docs/SCRIPTS.md"
|
|
echo "Then commit the regenerated file."
|
|
echo "--- diff ---"
|
|
diff -u docs/SCRIPTS.md /tmp/SCRIPTS.regen.md || true
|
|
exit 1
|
|
fi
|
|
|
|
- name: installer/hardware-db.sh references real nixos-hardware modules
|
|
run: |
|
|
# Every 4th-pipe-field in HARDWARE_DB is a nixos-hardware module
|
|
# name. Half the DB used to point at modules that don't exist
|
|
# (e.g. microsoft-surface-pro-8 — there's only -pro-intel and
|
|
# -pro-9), which made the install fail at eval time with
|
|
# cryptic "attribute not found" errors on real laptops. This
|
|
# step catches that regression class.
|
|
awk -F'|' '/^ "/ { gsub(/"/,"",$4); gsub(/^[[:space:]]+|[[:space:]]+$/,"",$4); if ($4) print $4 }' \
|
|
installer/hardware-db.sh | sort -u > /tmp/db-refs.txt
|
|
nix eval --impure --json --expr '
|
|
let
|
|
nh = (builtins.getFlake (toString ./.)).inputs.nixos-hardware.nixosModules;
|
|
in builtins.attrNames nh' \
|
|
| nix shell nixpkgs#jq --command jq -r '.[]' | sort -u > /tmp/db-real.txt
|
|
missing=$(comm -23 /tmp/db-refs.txt /tmp/db-real.txt)
|
|
if [[ -n "$missing" ]]; then
|
|
echo "::error::hardware-db.sh references nixos-hardware modules that don't exist:"
|
|
printf ' - %s\n' $missing
|
|
echo "Either fix the name (check the actual attr in nixos-hardware) or drop the row."
|
|
exit 1
|
|
fi
|