This repository has no description
2.5 kB
78 lines
1name: farm
2
3# On-demand nix-grpc-store farm (tools/ci-farm): one farm job (scheduler,
4# balancer, client, builder) and a pool of worker jobs that build the
5# requested machines together, each derivation once. Outputs land in
6# cache.lassul.us via niks3.
7#
8# Needs the FARM_KEY secret: the farm's TLS private key, matching
9# tools/ci-farm/farm.crt (`pass show ci-farm/key`).
10
11on:
12 workflow_dispatch:
13 inputs:
14 machines:
15 description: NixOS machines to build, space separated
16 default: ignavia neoprism green
17 push:
18 paths:
19 - .github/workflows/farm.yml
20 - tools/ci-farm/**
21
22permissions:
23 contents: read
24 id-token: write # niks3 push
25 actions: read # workers watch the farm job
26
27# The farm's iroh endpoint id is fixed, so only one run at a time.
28concurrency:
29 group: farm
30
31env:
32 # must match the worker matrix below
33 FARM_WORKERS: 2
34 MACHINES: ${{ inputs.machines || 'ignavia neoprism green' }}
35
36jobs:
37 farm:
38 name: farm
39 runs-on: ubuntu-latest
40 steps:
41 - uses: actions/checkout@v4
42 - uses: cachix/install-nix-action@v31
43 with:
44 extra_nix_config: |
45 trusted-users = root runner
46 extra-substituters = https://cache.lassul.us
47 extra-trusted-public-keys = cache.lassul.us-1:aOMEO5TU6eLvhyPi0jmgjR2sVlGjMq3rK0MeACjTcQ0=
48 # Builders need each other's outputs as soon as they are pushed;
49 # a remembered miss (default: 1 h) fails the build instead.
50 narinfo-cache-negative-ttl = 0
51 - run: nix build -L .#ci-farm -o ci-farm
52 - name: build ${{ env.MACHINES }}
53 env:
54 FARM_KEY: ${{ secrets.FARM_KEY }}
55 # MACHINES unquoted: one argument per machine
56 run: ./ci-farm/bin/ci-farm farm $MACHINES
57
58 worker:
59 name: worker ${{ matrix.index }}
60 runs-on: ubuntu-latest
61 strategy:
62 matrix:
63 index: [1, 2] # FARM_WORKERS
64 steps:
65 - uses: actions/checkout@v4
66 - uses: cachix/install-nix-action@v31
67 with:
68 extra_nix_config: |
69 trusted-users = root runner
70 extra-substituters = https://cache.lassul.us
71 extra-trusted-public-keys = cache.lassul.us-1:aOMEO5TU6eLvhyPi0jmgjR2sVlGjMq3rK0MeACjTcQ0=
72 # see the farm job
73 narinfo-cache-negative-ttl = 0
74 - run: nix build -L .#ci-farm -o ci-farm
75 - env:
76 FARM_KEY: ${{ secrets.FARM_KEY }}
77 GH_TOKEN: ${{ github.token }}
78 run: ./ci-farm/bin/ci-farm worker ${{ matrix.index }}