From 574aa151c6ef88c9ba58e45c530846dbf7187cdc Mon Sep 17 00:00:00 2001 From: wucke13 Date: Thu, 16 Jul 2026 09:47:50 +0200 Subject: [PATCH] feat: expose all relevant packages via ciJobs attr Signed-off-by: wucke13 --- .ci/gen-workflow-files.nu | 200 ------------------- .github/workflows/nix-mac.yaml | 109 ----------- .github/workflows/nix.yaml | 346 ++++----------------------------- flake.nix | 24 ++- 4 files changed, 58 insertions(+), 621 deletions(-) delete mode 100755 .ci/gen-workflow-files.nu delete mode 100644 .github/workflows/nix-mac.yaml diff --git a/.ci/gen-workflow-files.nu b/.ci/gen-workflow-files.nu deleted file mode 100755 index 3cff82aa..00000000 --- a/.ci/gen-workflow-files.nu +++ /dev/null @@ -1,200 +0,0 @@ -#!/usr/bin/env nu - -use std log - -# cd to git root -cd (git rev-parse --show-toplevel) - -# check if a subject depends on a potential dependency -def depends [ - subject:string # package to examine - maybe_dep:string # maybe a dependency of subject - ] { - not ( nix why-depends --quiet --derivation $subject $maybe_dep | is-empty ) -} - -# get attribute names of the attribute set -def get-attr-names [ - expr: # nix expression to get attrNames of - ] { - nix eval --json $expr --apply builtins.attrNames | from json -} - -def job-id [ - system:string, - derivation:string, - ] { - $"($system)---($derivation)" -} - -# map from nixos system to github runner type -let systems_map = { - # aarch64-darwin - # aarch64-linux - - i686-linux: ubicloud-standard-2-ubuntu-2204, - x86_64-darwin: macos-13, - x86_64-linux: ubicloud-standard-2-ubuntu-2204 -} - -let targets = (get-attr-names ".#packages" - | par-each {|system| { $system : (get-attr-names $".#packages.($system)") } } - | reduce {|it, acc| $acc | merge $it } -) - -mut cachix_workflow = { - name: "Nix", - permissions: {contents: write}, - on: { - pull_request: null, - push: {branches: [main]} - }, - jobs: {}, -} - -mut release_workflow = { - name: "Release", - permissions: {contents: write}, - on: { push: {tags: ["v*"]} }, - jobs: {}, -} - -let runner_setup = [ - { - uses: "actions/checkout@v4" - } - { - uses: "cachix/install-nix-action@v30", - } - { - uses: "cachix/cachix-action@v17", - with: { - name: rosenpass, - authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - } - } -] - -for system in ($targets | columns) { - if ($systems_map | get -i $system | is-empty) { - log info $"skipping ($system), since there are no GH-Actions runners for it" - continue - } - - # lookup the correct runner for $system - let runs_on = [ ($systems_map | get $system) ] - - # add jobs for all derivations - let derivations = ($targets | get $system) - for derivation in $derivations { - - if ($system == "i686-linux") and ($derivation | str contains "static") { - log info $"skipping ($system).($derivation), due to liboqs 0.8 not present in oqs-sys" - continue - } - - if ($system == "i686-linux") and ($derivation | str contains "release-package") { - log info $"skipping ($system).($derivation), due to liboqs 0.8 not present in oqs-sys" - continue - } - - # job_id for GH-Actions - let id = ( job-id $system $derivation ) - - # name displayed - let name = $"($system).($derivation)" - - # collection of dependencies - # TODO currently only considers dependencies on the same $system - let needs = ($derivations - | filter {|it| $it != $derivation and $it != "default" } # filter out self and default - | par-each {|it| { - name: $it, # the other derivation - # does self depend on $it? - needed: (depends $".#packages.($system).($derivation)" $".#packages.($system).($it)") - } } - | filter {|it| $it.needed} - | each {|it| job-id $system $it.name} - | sort - ) - - mut new_job = { - name: $"Build ($name)", - "runs-on": $runs_on, - needs: $needs, - steps: ($runner_setup | append [ - { - name: Build, - run: $"nix build .#packages.($system).($derivation) --print-build-logs" - } - ]) - } - $cachix_workflow.jobs = ($cachix_workflow.jobs | insert $id $new_job ) - } - - # add check job - $cachix_workflow.jobs = ($cachix_workflow.jobs | insert $"($system)---check" { - name: $"Run Nix checks on ($system)", - "runs-on": $runs_on, - steps: ($runner_setup | append { - name: Check, - run: "nix flake check . --print-build-logs" - }) - }) - - # add release job - $release_workflow.jobs = ($release_workflow.jobs | insert $"($system)---release" { - name: $"Build release artifacts for ($system)", - "runs-on": $runs_on, - steps: ($runner_setup | append [ - { - name: "Build release", - run: "nix build .#release-package --print-build-logs" - } - { - name: Release, - uses: "softprops/action-gh-release@v2", - with: { - draft: "${{ contains(github.ref_name, 'rc') }}", - prerelease: "${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') }}", - files: "result/*" - } - } - ]) - }) -} - -# add whitepaper job with upload -let system = "x86_64-linux" -$cachix_workflow.jobs = ($cachix_workflow.jobs | insert $"($system)---whitepaper-upload" { - name: $"Upload whitepaper ($system)", - "runs-on": ($systems_map | get $system), - "if": "${{ github.ref == 'refs/heads/main' }}", - steps: ($runner_setup | append [ - { - name: "Git add git sha and commit", - run: "cd papers && ./tex/gitinfo2.sh && git add gitHeadInfo.gin" - } - { - name: Build, - run: $"nix build .#packages.($system).whitepaper --print-build-logs" - } - { - name: "Deploy PDF artifacts", - uses: "peaceiris/actions-gh-pages@v4", - with: { - github_token: "${{ secrets.GITHUB_TOKEN }}", - publish_dir: result/, - publish_branch: papers-pdf, - force_orphan: true - } - } - ]) -}) - -log info "saving nix-cachix workflow" -$cachix_workflow | to yaml | save --force .github/workflows/nix.yaml -$release_workflow | to yaml | save --force .github/workflows/release.yaml - -log info "prettify generated yaml" -prettier -w .github/workflows/ diff --git a/.github/workflows/nix-mac.yaml b/.github/workflows/nix-mac.yaml deleted file mode 100644 index 0fe61ae9..00000000 --- a/.github/workflows/nix-mac.yaml +++ /dev/null @@ -1,109 +0,0 @@ -name: Nix on Mac -permissions: - contents: write -on: - push: - branches: - - main - # - upgrade-ci-macos - workflow_call: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - aarch64-darwin---default: - name: Build aarch64-darwin.default - runs-on: warp-macos-26-arm64-6x - needs: - - aarch64-darwin---rosenpass - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.aarch64-darwin.default --print-build-logs - aarch64-darwin---release-package: - name: Build aarch64-darwin.release-package - runs-on: warp-macos-26-arm64-6x - needs: - - aarch64-darwin---rosenpass - - aarch64-darwin---rp - - aarch64-darwin---rosenpass-oci-image - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.aarch64-darwin.release-package --print-build-logs - aarch64-darwin---rosenpass: - name: Build aarch64-darwin.rosenpass - runs-on: warp-macos-26-arm64-6x - needs: [] - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.aarch64-darwin.rosenpass --print-build-logs - aarch64-darwin---rp: - name: Build aarch64-darwin.rp - runs-on: warp-macos-26-arm64-6x - needs: [] - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.aarch64-darwin.rp --print-build-logs - aarch64-darwin---rosenpass-oci-image: - name: Build aarch64-darwin.rosenpass-oci-image - runs-on: warp-macos-26-arm64-6x - needs: - - aarch64-darwin---rosenpass - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.aarch64-darwin.rosenpass-oci-image --print-build-logs - aarch64-darwin---check: - name: Run Nix checks on aarch64-darwin - runs-on: warp-macos-26-arm64-6x - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Check - run: nix flake check . --print-build-logs diff --git a/.github/workflows/nix.yaml b/.github/workflows/nix.yaml index 850ba050..916fd653 100644 --- a/.github/workflows/nix.yaml +++ b/.github/workflows/nix.yaml @@ -12,331 +12,55 @@ concurrency: cancel-in-progress: true jobs: - i686-linux---default: - name: Build i686-linux.default - runs-on: ubicloud-standard-4 - needs: - - i686-linux---rosenpass - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.i686-linux.default --print-build-logs - i686-linux---rosenpass: - name: Build i686-linux.rosenpass - runs-on: ubicloud-standard-4 - needs: [] - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.i686-linux.rosenpass --print-build-logs - i686-linux---rosenpass-oci-image: - name: Build i686-linux.rosenpass-oci-image - runs-on: ubicloud-standard-4 - needs: - - i686-linux---rosenpass - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.i686-linux.rosenpass-oci-image --print-build-logs - i686-linux---check: - # use --max-jobs 1 for the nix command to debug this - name: Run Nix checks on i686-linux + nix-flake-check: + name: nix flake check strategy: - fail-fast: false - runs-on: ubicloud-standard-8 + matrix: + RUNNER: + # - macos-latest + # - ubuntu-24.04-arm + # - ubuntu-latest + - ubicloud-standard-2 + - warp-macos-26-arm64-6x + runs-on: ${{ matrix.RUNNER }} steps: - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable + # The default image contains dozens of gigabytes of tools. NixOS builds get big. Thus, remove + # unused tools (Nix provides for all we need!) to get some space. + - uses: wimpysworld/nothing-but-nix@main + - uses: cachix/install-nix-action@v31 - uses: cachix/cachix-action@v17 with: name: rosenpass authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Check - run: | - nix flake check . --print-build-logs --option min-free 10G - x86_64-linux---default: - name: Build x86_64-linux.default - runs-on: ubicloud-standard-4 - needs: - - x86_64-linux---rosenpass - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.default --print-build-logs - x86_64-linux---proof-proverif: - name: Build x86_64-linux.proof-proverif - runs-on: ubicloud-standard-2 - needs: - - x86_64-linux---proverif-patched - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.proof-proverif --print-build-logs - x86_64-linux---proverif-patched: - name: Build x86_64-linux.proverif-patched - runs-on: ubicloud-standard-2 - needs: [] - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.proverif-patched --print-build-logs - x86_64-linux---release-package: - name: Build x86_64-linux.release-package - runs-on: ubicloud-standard-2 - needs: - - x86_64-linux---rosenpass-static - - x86_64-linux---rosenpass-static-oci-image - - x86_64-linux---rp-static - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.release-package --print-build-logs - # aarch64-linux---release-package: - # name: Build aarch64-linux.release-package - # runs-on: ubicloud-standard-2-arm - # needs: - # - aarch64-linux---rosenpass-oci-image - # - aarch64-linux---rosenpass - # - aarch64-linux---rp - # steps: - # - run: | - # DEBIAN_FRONTEND=noninteractive - # sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static - # - uses: actions/checkout@v7 - # - uses: cachix/install-nix-action@v30 - # with: - # nix_path: nixpkgs=channel:nixos-unstable - # extra_nix_config: | - # system = aarch64-linux - # - uses: cachix/cachix-action@v17 - # with: - # name: rosenpass - # authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - # - name: Build - # run: nix build .#packages.aarch64-linux.release-package --print-build-logs - x86_64-linux---rosenpass: - name: Build x86_64-linux.rosenpass - runs-on: ubicloud-standard-4 - needs: [] - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.rosenpass --print-build-logs - aarch64-linux---rosenpass: - name: Build aarch64-linux.rosenpass - runs-on: ubicloud-standard-4-arm - needs: [] - steps: - - run: | - DEBIAN_FRONTEND=noninteractive - sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi-aarch64 binfmt-support qemu-user-static - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - extra_nix_config: | - system = aarch64-linux - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.aarch64-linux.rosenpass --print-build-logs - aarch64-linux---rp: - name: Build aarch64-linux.rp - runs-on: ubicloud-standard-4-arm - needs: [] - steps: - - run: | - DEBIAN_FRONTEND=noninteractive - sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi-aarch64 binfmt-support qemu-user-static - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - extra_nix_config: | - system = aarch64-linux - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.aarch64-linux.rp --print-build-logs - x86_64-linux---rosenpass-oci-image: - name: Build x86_64-linux.rosenpass-oci-image - runs-on: ubicloud-standard-2 - needs: - - x86_64-linux---rosenpass - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.rosenpass-oci-image --print-build-logs - aarch64-linux---rosenpass-oci-image: - name: Build aarch64-linux.rosenpass-oci-image - runs-on: ubicloud-standard-2-arm - needs: - - aarch64-linux---rosenpass - steps: - - run: | - DEBIAN_FRONTEND=noninteractive - sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi-aarch64 binfmt-support qemu-user-static - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - extra_nix_config: | - system = aarch64-linux - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.aarch64-linux.rosenpass-oci-image --print-build-logs - x86_64-linux---rosenpass-static: - name: Build x86_64-linux.rosenpass-static - runs-on: ubicloud-standard-4 - needs: [] - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.rosenpass-static --print-build-logs - x86_64-linux---rp-static: - name: Build x86_64-linux.rp-static - runs-on: ubicloud-standard-4 - needs: [] - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.rp-static --print-build-logs - x86_64-linux---rosenpass-static-oci-image: - name: Build x86_64-linux.rosenpass-static-oci-image - runs-on: ubicloud-standard-2 - needs: - - x86_64-linux---rosenpass-static - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.rosenpass-static-oci-image --print-build-logs - x86_64-linux---whitepaper: - name: Build x86_64-linux.whitepaper - runs-on: ubicloud-standard-2 - needs: [] - steps: - - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable - - uses: cachix/cachix-action@v17 - with: - name: rosenpass - authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Build - run: nix build .#packages.x86_64-linux.whitepaper --print-build-logs - x86_64-linux---check: - # use --max-jobs 1 for the nix command to debug this - name: Run Nix checks on x86_64-linux + - run: nix flake check + nix-fast-build: + name: Build everything in `.#ciJobs` strategy: - fail-fast: false - runs-on: ubicloud-standard-8 + matrix: + RUNNER: + # - macos-latest + # - ubuntu-24.04-arm + # - ubuntu-latest + - ubicloud-standard-2 + - warp-macos-26-arm64-6x + runs-on: ${{ matrix.RUNNER }} steps: - uses: actions/checkout@v7 - - uses: cachix/install-nix-action@v30 - with: - nix_path: nixpkgs=channel:nixos-unstable + - uses: wimpysworld/nothing-but-nix@main + - uses: cachix/install-nix-action@v31 - uses: cachix/cachix-action@v17 with: name: rosenpass authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} - - name: Check - run: nix flake check . --print-build-logs --option min-free 10G - x86_64-linux---whitepaper-upload: - name: Upload whitepaper x86_64-linux + - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --flake .#ciJobs --no-nom --skip-cached --result-file result-junit.xml --result-format junit # TODO add --fail-fast once we get a newer nix-fast-build + - name: Test Summary + uses: test-summary/action@v2 + with: + paths: "result-junit.xml" + if: always() + whitepaper-upload: + name: Upload whitepaper runs-on: ubicloud-standard-2 if: ${{ github.ref == 'refs/heads/main' }} steps: diff --git a/flake.nix b/flake.nix index 5e075f4f..c0892952 100644 --- a/flake.nix +++ b/flake.nix @@ -36,6 +36,28 @@ # { overlays.default = import ./overlay.nix; } + # + ### Export the overlay.nix from this flake ### + # + { + ciJobs = + let + inherit (nixpkgs) lib; + in + { + checks = lib.attrsets.recurseIntoAttrs (self.checks or { }); + homeConfigurations = lib.attrsets.recurseIntoAttrs ( + lib.attrsets.mapAttrs (name: value: value.activationPackage) (self.homeConfigurations or { }) + ); + nixosConfigurations = lib.attrsets.recurseIntoAttrs ( + lib.attrsets.mapAttrs (name: value: value.config.system.build.toplevel) ( + self.nixosConfigurations or { } + ) + ); + packages = lib.attrsets.recurseIntoAttrs (self.packages or { }); + }; + } + # ### Actual Rosenpass Package and Docker Container Images ### # @@ -46,7 +68,7 @@ # unsuported best-effort "i686-linux" - "x86_64-darwin" + # "x86_64-darwin" "aarch64-darwin" # "x86_64-windows" ]