Mohamed Boudra
29277c900d
build runs on push to main and every PR including forks. Same model as the test/lint/typecheck workflows: read-only token, no secrets injected, runs scripts/update-nix.sh + nix build to validate. No commit, no push. update-hash runs only on push to main. Mints the paseo-ai App token, re-runs the update + build, and commits the refreshed hash via the ruleset bypass. The default GITHUB_TOKEN no longer pushes anywhere. Rename file to nix.yml since it's no longer just a build job.
99 lines
2.5 KiB
YAML
99 lines
2.5 KiB
YAML
name: Nix
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "nix/**"
|
|
- "flake.nix"
|
|
- "flake.lock"
|
|
- "package.json"
|
|
- "package-lock.json"
|
|
- "packages/highlight/**"
|
|
- "packages/server/**"
|
|
- "packages/relay/**"
|
|
- "packages/cli/**"
|
|
- "scripts/update-nix.sh"
|
|
- "scripts/fix-lockfile.mjs"
|
|
- ".github/workflows/nix.yml"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- "nix/**"
|
|
- "flake.nix"
|
|
- "flake.lock"
|
|
- "package.json"
|
|
- "package-lock.json"
|
|
- "packages/highlight/**"
|
|
- "packages/server/**"
|
|
- "packages/relay/**"
|
|
- "packages/cli/**"
|
|
- "scripts/update-nix.sh"
|
|
- "scripts/fix-lockfile.mjs"
|
|
- ".github/workflows/nix.yml"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.ref }}
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: "npm"
|
|
|
|
- uses: cachix/install-nix-action@v31
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
|
|
- name: Update lockfile + Nix hash if stale
|
|
run: ./scripts/update-nix.sh
|
|
|
|
- name: Build Nix package
|
|
run: nix build .#default -o result
|
|
|
|
update-hash:
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/create-github-app-token@v1
|
|
id: app-token
|
|
with:
|
|
app-id: ${{ secrets.PASEO_BOT_APP_ID }}
|
|
private-key: ${{ secrets.PASEO_BOT_APP_PRIVATE_KEY }}
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.ref }}
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: "npm"
|
|
|
|
- uses: cachix/install-nix-action@v31
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
|
|
- name: Update lockfile + Nix hash if stale
|
|
run: ./scripts/update-nix.sh
|
|
|
|
- name: Build Nix package
|
|
run: nix build .#default -o result
|
|
|
|
- name: Commit hash/lockfile updates
|
|
run: |
|
|
git diff --quiet package-lock.json nix/npm-deps.hash && exit 0
|
|
git config user.name "paseo-ai[bot]"
|
|
git config user.email "266920839+paseo-ai[bot]@users.noreply.github.com"
|
|
git add package-lock.json nix/npm-deps.hash
|
|
git commit -m "fix: update lockfile signatures and Nix hash [skip ci]"
|
|
git push
|