122 lines
4.1 KiB
YAML
122 lines
4.1 KiB
YAML
name: Build NixOS ISOs
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- hosts/acheron/**
|
|
- hosts/armaros/**
|
|
- hosts/buildbox/**
|
|
- hosts/eva-01/**
|
|
- hosts/eva-03/**
|
|
- hosts/iso/**
|
|
- flake.nix
|
|
- flake.lock
|
|
- .gitea/workflows/iso-builder.yml
|
|
workflow_dispatch:
|
|
inputs:
|
|
publish-release:
|
|
description: "Publish the ISOs as a Gitea release"
|
|
type: boolean
|
|
default: true
|
|
|
|
jobs:
|
|
build-iso:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
host:
|
|
#- eva-01
|
|
#- armaros
|
|
#- ender-ml
|
|
- buildbox
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install Nix
|
|
uses: cachix/install-nix-action@v27
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
extra_nix_config: |
|
|
experimental-features = nix-command flakes
|
|
download-buffer-size = 200000000
|
|
auto-optimise-store = true
|
|
|
|
- name: Cache Nix store
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
/nix/store
|
|
/nix/var/nix/profiles
|
|
key: nix-iso-${{ matrix.host }}-${{ hashFiles('flake.lock', 'hosts/**', 'flake.nix') }}
|
|
restore-keys: |
|
|
nix-iso-${{ matrix.host }}-
|
|
nix-iso-
|
|
|
|
- name: Build ${{ matrix.host }} ISO
|
|
id: build
|
|
run: |
|
|
set -euo pipefail
|
|
# Build the ISO directly from the flake's NixOS configuration.
|
|
# `config.system.build.isoImage` is a store path containing an `iso/`
|
|
# directory with the actual .iso file.
|
|
nix build --print-out-paths \
|
|
.#nixosConfigurations.${{ matrix.host }}-iso.config.system.build.isoImage \
|
|
--out-link result-iso 2>&1 | tee /tmp/nix-build.log
|
|
|
|
# Resolve the real .iso. Do NOT use `find -L` — it follows symlinks
|
|
# into the nix store and may pick up .iso files from build deps.
|
|
ISO_SRC="$(ls result-iso/iso/*.iso 2>/dev/null | head -n 1 || true)"
|
|
if [ -z "$ISO_SRC" ]; then
|
|
echo "::error::No ISO found at result-iso/iso/*.iso"
|
|
cat /tmp/nix-build.log
|
|
ls -la result-iso/ || true
|
|
ls -la result-iso/iso/ || true
|
|
exit 1
|
|
fi
|
|
|
|
# Verify it's actually a bootable ISO 9660 image before proceeding.
|
|
if ! file "$ISO_SRC" | grep -q "ISO 9660"; then
|
|
echo "::error::$ISO_SRC is not an ISO 9660 image:"
|
|
file "$ISO_SRC"
|
|
exit 1
|
|
fi
|
|
|
|
# Stage the ISO under a stable name in the workspace root so the
|
|
# upload-artifact step can reference a single file directly.
|
|
ISO_NAME="${{ matrix.host }}-installer.iso"
|
|
cp "$ISO_SRC" "$ISO_NAME"
|
|
|
|
echo "iso-path=$ISO_NAME" >> "$GITHUB_OUTPUT"
|
|
echo "iso-size=$(stat -c%s "$ISO_NAME")" >> "$GITHUB_OUTPUT"
|
|
|
|
echo "::group::ISO info"
|
|
ls -lh "$ISO_NAME"
|
|
file "$ISO_NAME"
|
|
echo "SHA256:"
|
|
sha256sum "$ISO_NAME"
|
|
echo "::endgroup::"
|
|
|
|
- name: Pick release tag
|
|
id: tag
|
|
if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish-release }}
|
|
run: |
|
|
if [ "${GITHUB_REF:-}" = "refs/tags/${GITHUB_REF_NAME:-}" ] && [ -n "${GITHUB_REF_NAME:-}" ]; then
|
|
echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
|
|
echo "prerelease=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "tag=ci-${{ matrix.host }}-${GITHUB_SHA:0:12}-${GITHUB_RUN_NUMBER}" >> "$GITHUB_OUTPUT"
|
|
echo "prerelease=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Publish ${{ matrix.host }} ISO as a Gitea release
|
|
if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish-release }}
|
|
uses: akkuman/gitea-release-action@v1
|
|
with:
|
|
token: ${{ secrets.UPLOAD_TOKEN }}
|
|
tag_name: ${{ steps.tag.outputs.tag }}
|
|
name: ${{ matrix.host }} ISO ${{ steps.tag.outputs.tag }}
|
|
prerelease: ${{ steps.tag.outputs.prerelease }}
|
|
files: ${{ matrix.host }}-installer.iso
|