mirror of
https://github.com/logos-co/logos-basecamp.git
synced 2026-08-27 14:51:07 +00:00
ci: take Nix and the Attic cache from setup-nix-cache-action
build.yml owned its own Nix installer, substituter list, trusted keys, cache selection and push -- four times over, in two different spellings. All of it now comes from logos-co/setup-nix-cache-action@v1. 237 lines -> 203, and four (installer + attic-action) pairs collapse to four one-step uses. WHAT THIS FIXES, beyond the duplication: * THE SIGNING KEY. This was the only repo in the fleet trusting public:Z1wyVBEx8PHbXujYB52Mysv9Rd8rWIhyQ3bQyef9yy4=; the shared action configures public:l4HrXgL4nw246+LBh2SOJyhz64BoGegOYLheT/iIAPU= for the same cache name. I could not determine from outside which is current -- a narinfo's Sig names the key `public` but not its value, and attempts to discriminate by verifying a copy failed on incomplete closures rather than on signatures. Two answers to that question was the actual problem; there is now one. * NIX VERSION. Two jobs ran cachix/install-nix-action@v27, which is Nix 2.22 -- below the 2.26 floor where `--override-input` keeps the overridden input's own lock. The shared action uses @v31 (nix_version=2.35.1). The other two jobs ran DeterminateSystems/nix-installer-action@main, i.e. an unpinned ref on a release-producing workflow. * IT NOW READS THE ci CACHE. Every block here configured only cache.nix.logos.co/public as a substituter while pushing to `ci` on branches -- so a branch build could not reuse what any earlier branch build had pushed. The shared action configures both. ONE DELIBERATE REGRESSION, stated rather than buried: the old steps passed `inputs-from: "."` to attic-action, which also pushes the flake inputs' store paths. setup-nix-cache-action does not expose that input, so slightly less is pushed per run. Reading the ci cache should more than compensate on branches, but it is a real difference and the right fix is an `inputs-from` passthrough in the shared action rather than keeping a second implementation here. The `if: env.ATTIC_ENDPOINT != ''` guards are dropped with the env block they read. They existed to skip the push on fork PRs where secrets are absent; the shared action needs no guard, because with no token it configures the substituters and skips the push -- which is what those guards approximated. This repo's ATTIC_ENDPOINT secret is consequently unused here, and the action's default endpoint is the same host this file already named. Verified: actionlint clean, and all five jobs keep their build/test steps unchanged -- only the preamble moved. NOT verified: this has not run. It touches the release path, so it wants a real CI run on a branch before merge.
This commit is contained in:
Dario Gabriel Lipicar
committed by
Dario Lipicar
Dario Lipicar
parent
fb64b23144
commit
adee4734e6
+24
-58
@@ -8,10 +8,18 @@ on:
|
||||
pull_request:
|
||||
branches: [master]
|
||||
|
||||
env:
|
||||
ATTIC_CACHE: ${{ github.ref == 'refs/heads/master' && 'public' || 'ci' }}
|
||||
# Empty on fork PRs (secrets not available) — Attic steps skip via the if below.
|
||||
ATTIC_ENDPOINT: ${{ secrets.ATTIC_ENDPOINT }}
|
||||
# Nix and the Logos cache come from logos-co/setup-nix-cache-action, which owns
|
||||
# the installer, the substituters, the trusted keys, which cache is written
|
||||
# (public on master/main, ci elsewhere) and the push itself. This file used to
|
||||
# own all of that four times over.
|
||||
#
|
||||
# The ATTIC_CACHE / ATTIC_ENDPOINT env pair that lived here is gone: the first is
|
||||
# the shared action's decision, and the second existed only to feed `if:` guards
|
||||
# that skipped the push on fork PRs. The shared action needs no guard -- with no
|
||||
# token it configures the substituters anyway and skips the push, which is the
|
||||
# behaviour those guards were approximating. The repo's ATTIC_ENDPOINT secret is
|
||||
# consequently unused here; the action's default endpoint is the same host this
|
||||
# file already pointed at.
|
||||
|
||||
jobs:
|
||||
build-appimage:
|
||||
@@ -28,21 +36,10 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: cachix/install-nix-action@v27
|
||||
- uses: logos-co/setup-nix-cache-action@v1
|
||||
with:
|
||||
extra_nix_config: |
|
||||
experimental-features = nix-command flakes
|
||||
extra-substituters = https://cache.nix.logos.co/public
|
||||
extra-trusted-public-keys = public:Z1wyVBEx8PHbXujYB52Mysv9Rd8rWIhyQ3bQyef9yy4=
|
||||
fallback = true
|
||||
|
||||
- uses: ryanccn/attic-action@v0.4.1
|
||||
if: ${{ env.ATTIC_ENDPOINT != '' }}
|
||||
with:
|
||||
endpoint: ${{ env.ATTIC_ENDPOINT }}
|
||||
cache: ${{ env.ATTIC_CACHE }}
|
||||
inputs-from: "."
|
||||
token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
|
||||
attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }}
|
||||
attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }}
|
||||
|
||||
- name: Build bin-appimage
|
||||
run: nix build .#bin-appimage
|
||||
@@ -71,20 +68,10 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: DeterminateSystems/nix-installer-action@main
|
||||
- uses: logos-co/setup-nix-cache-action@v1
|
||||
with:
|
||||
extra-conf: |
|
||||
extra-substituters = https://cache.nix.logos.co/public
|
||||
extra-trusted-public-keys = public:Z1wyVBEx8PHbXujYB52Mysv9Rd8rWIhyQ3bQyef9yy4=
|
||||
fallback = true
|
||||
|
||||
- uses: ryanccn/attic-action@v0.4.1
|
||||
if: ${{ env.ATTIC_ENDPOINT != '' }}
|
||||
with:
|
||||
endpoint: ${{ env.ATTIC_ENDPOINT }}
|
||||
cache: ${{ env.ATTIC_CACHE }}
|
||||
inputs-from: "."
|
||||
token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
|
||||
attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }}
|
||||
attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }}
|
||||
|
||||
- name: Build bin-macos-app
|
||||
run: nix build .#bin-macos-app
|
||||
@@ -118,21 +105,10 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: cachix/install-nix-action@v27
|
||||
- uses: logos-co/setup-nix-cache-action@v1
|
||||
with:
|
||||
extra_nix_config: |
|
||||
experimental-features = nix-command flakes
|
||||
extra-substituters = https://cache.nix.logos.co/public
|
||||
extra-trusted-public-keys = public:Z1wyVBEx8PHbXujYB52Mysv9Rd8rWIhyQ3bQyef9yy4=
|
||||
fallback = true
|
||||
|
||||
- uses: ryanccn/attic-action@v0.4.1
|
||||
if: ${{ env.ATTIC_ENDPOINT != '' }}
|
||||
with:
|
||||
endpoint: ${{ env.ATTIC_ENDPOINT }}
|
||||
cache: ${{ env.ATTIC_CACHE }}
|
||||
inputs-from: "."
|
||||
token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
|
||||
attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }}
|
||||
attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }}
|
||||
|
||||
- name: Unit tests
|
||||
run: nix build .#unit-tests -L
|
||||
@@ -173,20 +149,10 @@ jobs:
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: DeterminateSystems/nix-installer-action@main
|
||||
- uses: logos-co/setup-nix-cache-action@v1
|
||||
with:
|
||||
extra-conf: |
|
||||
extra-substituters = https://cache.nix.logos.co/public
|
||||
extra-trusted-public-keys = public:Z1wyVBEx8PHbXujYB52Mysv9Rd8rWIhyQ3bQyef9yy4=
|
||||
fallback = true
|
||||
|
||||
- uses: ryanccn/attic-action@v0.4.1
|
||||
if: ${{ env.ATTIC_ENDPOINT != '' }}
|
||||
with:
|
||||
endpoint: ${{ env.ATTIC_ENDPOINT }}
|
||||
cache: ${{ env.ATTIC_CACHE }}
|
||||
inputs-from: "."
|
||||
token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
|
||||
attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }}
|
||||
attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }}
|
||||
|
||||
- name: Unit tests
|
||||
run: nix build .#unit-tests -L
|
||||
|
||||
Reference in New Issue
Block a user