forked from
lass.pds.lassul.us/superconfig
This repository has no description
3.1 kB
89 lines
1name: farm
2
3# On-demand nix-grpc-store farm (tools/ci-farm): one farm job (scheduler,
4# balancer, client, builder) and a pool of worker jobs that build the
5# requested machines together, each derivation once. Outputs land in
6# cache.lassul.us via niks3.
7#
8# Needs the FARM_KEY secret: the farm's TLS private key, matching
9# tools/ci-farm/farm.crt (`pass show ci-farm/key`).
10
11on:
12 workflow_dispatch:
13 inputs:
14 machines:
15 description: NixOS machines to build, space separated (empty for all)
16 default: ""
17 push:
18 branches: [master]
19
20permissions:
21 contents: read
22 id-token: write # niks3 push
23 actions: read # workers watch the farm job
24
25# The farm's iroh endpoint id is fixed, so only one run at a time. A push to
26# master replaces a running build (an older master state or an update-pkgs
27# verification, which retries). Dispatched runs (update-pkgs verifying a PR,
28# manual runs) never cancel a running build; they wait as the group's pending
29# run.
30concurrency:
31 group: farm
32 cancel-in-progress: ${{ github.event_name == 'push' }}
33
34env:
35 # must match the worker matrix below
36 FARM_WORKERS: 2
37 MACHINES: ${{ inputs.machines }}
38
39jobs:
40 farm:
41 name: farm
42 runs-on: ubuntu-latest
43 steps:
44 - uses: actions/checkout@v4
45 - uses: cachix/install-nix-action@v31
46 with:
47 extra_nix_config: |
48 trusted-users = root runner
49 extra-substituters = https://cache.lassul.us
50 extra-trusted-public-keys = cache.lassul.us-1:aOMEO5TU6eLvhyPi0jmgjR2sVlGjMq3rK0MeACjTcQ0=
51 # Builders need each other's outputs as soon as they are pushed;
52 # a remembered miss (default: 1 h) fails the build instead.
53 narinfo-cache-negative-ttl = 0
54 - run: nix build -L .#ci-farm -o ci-farm
55 # so the next run substitutes it instead of compiling it on every runner
56 - env:
57 FARM_KEY: ${{ secrets.FARM_KEY }}
58 run: ./ci-farm/bin/ci-farm push ./ci-farm
59 - name: build ${{ env.MACHINES || 'all machines' }}
60 env:
61 FARM_KEY: ${{ secrets.FARM_KEY }}
62 # MACHINES unquoted: one argument per machine
63 run: |
64 if [ -z "$MACHINES" ]; then
65 MACHINES=$(nix eval --raw .#nixosConfigurations --apply "c: builtins.concatStringsSep \" \" (builtins.attrNames c)")
66 fi
67 ./ci-farm/bin/ci-farm farm $MACHINES
68
69 worker:
70 name: worker ${{ matrix.index }}
71 runs-on: ubuntu-latest
72 strategy:
73 matrix:
74 index: [1, 2] # FARM_WORKERS
75 steps:
76 - uses: actions/checkout@v4
77 - uses: cachix/install-nix-action@v31
78 with:
79 extra_nix_config: |
80 trusted-users = root runner
81 extra-substituters = https://cache.lassul.us
82 extra-trusted-public-keys = cache.lassul.us-1:aOMEO5TU6eLvhyPi0jmgjR2sVlGjMq3rK0MeACjTcQ0=
83 # see the farm job
84 narinfo-cache-negative-ttl = 0
85 - run: nix build -L .#ci-farm -o ci-farm
86 - env:
87 FARM_KEY: ${{ secrets.FARM_KEY }}
88 GH_TOKEN: ${{ github.token }}
89 run: ./ci-farm/bin/ci-farm worker ${{ matrix.index }}