forked from
lass.pds.lassul.us/superconfig
This repository has no description
2.9 kB
86 lines
1name: farm
2
3# On-demand nix-grpc-store farm (tools/ci-farm): one farm job (scheduler,
4# balancer, client, builder) and a pool of worker jobs that build the
5# requested machines together, each derivation once. Outputs land in
6# cache.lassul.us via niks3.
7#
8# Needs the FARM_KEY secret: the farm's TLS private key, matching
9# tools/ci-farm/farm.crt (`pass show ci-farm/key`).
10
11on:
12 workflow_dispatch:
13 inputs:
14 machines:
15 description: NixOS machines to build, space separated (empty for all)
16 default: ""
17 push:
18 branches: [master]
19
20permissions:
21 contents: read
22 id-token: write # niks3 push
23 actions: read # workers watch the farm job
24
25# The farm's iroh endpoint id is fixed, so only one run at a time; a newer
26# push replaces a running build.
27concurrency:
28 group: farm
29 cancel-in-progress: true
30
31env:
32 # must match the worker matrix below
33 FARM_WORKERS: 2
34 MACHINES: ${{ inputs.machines }}
35
36jobs:
37 farm:
38 name: farm
39 runs-on: ubuntu-latest
40 steps:
41 - uses: actions/checkout@v4
42 - uses: cachix/install-nix-action@v31
43 with:
44 extra_nix_config: |
45 trusted-users = root runner
46 extra-substituters = https://cache.lassul.us
47 extra-trusted-public-keys = cache.lassul.us-1:aOMEO5TU6eLvhyPi0jmgjR2sVlGjMq3rK0MeACjTcQ0=
48 # Builders need each other's outputs as soon as they are pushed;
49 # a remembered miss (default: 1 h) fails the build instead.
50 narinfo-cache-negative-ttl = 0
51 - run: nix build -L .#ci-farm -o ci-farm
52 # so the next run substitutes it instead of compiling it on every runner
53 - env:
54 FARM_KEY: ${{ secrets.FARM_KEY }}
55 run: ./ci-farm/bin/ci-farm push ./ci-farm
56 - name: build ${{ env.MACHINES || 'all machines' }}
57 env:
58 FARM_KEY: ${{ secrets.FARM_KEY }}
59 # MACHINES unquoted: one argument per machine
60 run: |
61 if [ -z "$MACHINES" ]; then
62 MACHINES=$(nix eval --raw .#nixosConfigurations --apply "c: builtins.concatStringsSep \" \" (builtins.attrNames c)")
63 fi
64 ./ci-farm/bin/ci-farm farm $MACHINES
65
66 worker:
67 name: worker ${{ matrix.index }}
68 runs-on: ubuntu-latest
69 strategy:
70 matrix:
71 index: [1, 2] # FARM_WORKERS
72 steps:
73 - uses: actions/checkout@v4
74 - uses: cachix/install-nix-action@v31
75 with:
76 extra_nix_config: |
77 trusted-users = root runner
78 extra-substituters = https://cache.lassul.us
79 extra-trusted-public-keys = cache.lassul.us-1:aOMEO5TU6eLvhyPi0jmgjR2sVlGjMq3rK0MeACjTcQ0=
80 # see the farm job
81 narinfo-cache-negative-ttl = 0
82 - run: nix build -L .#ci-farm -o ci-farm
83 - env:
84 FARM_KEY: ${{ secrets.FARM_KEY }}
85 GH_TOKEN: ${{ github.token }}
86 run: ./ci-farm/bin/ci-farm worker ${{ matrix.index }}