Miguel Palhas
d9000c0d00
user.nix fetches SSH keys via fetchurl+readFile (import-from-derivation); --no-build blocks the IFD fetch, failing eval in a fresh store. Evaluating the toplevel/activation drvPaths permits IFD without building the toplevels. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
59 lines
2.2 KiB
YAML
59 lines
2.2 KiB
YAML
# Gitea Actions CI for the nix config.
|
|
#
|
|
# Requirements on the act_runner:
|
|
# - a runner with the `ubuntu-latest` label (or change `runs-on` below)
|
|
# - the runner must be allowed to fetch actions from github.com
|
|
# (act_runner default: DEFAULT_ACTIONS_URL = https://github.com)
|
|
#
|
|
# Design: `eval` is blocking (it's the real safety net — the whole module
|
|
# system must evaluate). `lint` is informational (continue-on-error) because
|
|
# the existing statix/deadnix/format findings are intentionally tolerated.
|
|
# Flip `continue-on-error` to false once the config is clean to make it gating.
|
|
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
eval:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: DeterminateSystems/nix-installer-action@main
|
|
# Evaluate each config's toplevel/activation drvPath. This exercises the
|
|
# full module system and permits import-from-derivation (user.nix fetches
|
|
# SSH keys via fetchurl+readFile), but does NOT build the toplevels.
|
|
# `nix flake check --no-build` can't be used: --no-build blocks the IFD.
|
|
- name: Evaluate NixOS + home configs
|
|
run: |
|
|
set -euo pipefail
|
|
for h in arrakis konishi; do
|
|
echo "== nixos/$h =="
|
|
nix eval --raw ".#nixosConfigurations.$h.config.system.build.toplevel.drvPath"; echo
|
|
echo "== home/naps62@$h =="
|
|
nix eval --raw ".#homeConfigurations.\"naps62@$h\".activationPackage.drvPath"; echo
|
|
done
|
|
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: DeterminateSystems/nix-installer-action@main
|
|
# Each lint step is continue-on-error so all three always run and none
|
|
# reds the job — findings are visible in the logs but non-gating. Flip a
|
|
# step's continue-on-error to false (or drop it) to make it blocking.
|
|
- name: nixfmt (format check)
|
|
continue-on-error: true
|
|
run: |
|
|
fd_nix=$(find . -name '*.nix')
|
|
nix run nixpkgs#nixfmt -- --check $fd_nix
|
|
- name: statix
|
|
continue-on-error: true
|
|
run: nix run nixpkgs#statix -- check
|
|
- name: deadnix
|
|
continue-on-error: true
|
|
run: nix run nixpkgs#deadnix -- --fail
|