8a9f0b8a47
This is slightly faster than downloading and extracting a tarball and additionally allows a sparse checkout. No need to download docs or nixos for our purpose. The data is quite noisy, but suggests improvements from anywhere between 5-15 seconds for each job using the pinned nixpkgs.
104 lines
3.5 KiB
YAML
104 lines
3.5 KiB
YAML
name: Lint
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
mergedSha:
|
|
required: true
|
|
type: string
|
|
targetSha:
|
|
required: true
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
jobs:
|
|
treefmt:
|
|
runs-on: ubuntu-24.04-arm
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
with:
|
|
sparse-checkout: .github/actions
|
|
- name: Check if the PR can be merged and checkout the merge commit
|
|
uses: ./.github/actions/get-merge-commit
|
|
with:
|
|
mergedSha: ${{ inputs.mergedSha }}
|
|
merged-as-untrusted: true
|
|
pinnedFrom: untrusted
|
|
|
|
- uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
|
|
|
|
- name: Check that files are formatted
|
|
run: |
|
|
# Note that it's fine to run this on untrusted code because:
|
|
# - There's no secrets accessible here
|
|
# - The build is sandboxed
|
|
if ! nix-build untrusted/ci --arg nixpkgs ./pinned -A fmt.check; then
|
|
echo "Some files are not properly formatted"
|
|
echo "Please format them by going to the Nixpkgs root directory and running one of:"
|
|
echo " nix-shell --run treefmt"
|
|
echo " nix develop --command treefmt"
|
|
echo " nix fmt"
|
|
echo "Make sure your branch is up to date with master; rebase if not."
|
|
echo "If you're having trouble, please ping @NixOS/nix-formatting"
|
|
exit 1
|
|
fi
|
|
|
|
parse:
|
|
runs-on: ubuntu-24.04-arm
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
with:
|
|
sparse-checkout: .github/actions
|
|
- name: Check if the PR can be merged and checkout the merge commit
|
|
uses: ./.github/actions/get-merge-commit
|
|
with:
|
|
mergedSha: ${{ inputs.mergedSha }}
|
|
merged-as-untrusted: true
|
|
pinnedFrom: untrusted
|
|
|
|
- uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
|
|
|
|
- name: Parse all nix files
|
|
run: |
|
|
# Tests multiple versions at once, let's make sure all of them run, so keep-going.
|
|
nix-build untrusted/ci --arg nixpkgs ./pinned -A parse --keep-going
|
|
|
|
nixpkgs-vet:
|
|
runs-on: ubuntu-24.04-arm
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
with:
|
|
sparse-checkout: .github/actions
|
|
- name: Check if the PR can be merged and checkout merged and target commits
|
|
uses: ./.github/actions/get-merge-commit
|
|
with:
|
|
mergedSha: ${{ inputs.mergedSha }}
|
|
merged-as-untrusted: true
|
|
pinnedFrom: untrusted
|
|
targetSha: ${{ inputs.targetSha }}
|
|
target-as-trusted: true
|
|
|
|
- uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
|
|
|
|
- name: Running nixpkgs-vet
|
|
env:
|
|
# Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
|
|
CLICOLOR_FORCE: 1
|
|
run: |
|
|
if nix-build untrusted/ci --arg nixpkgs ./pinned -A nixpkgs-vet --arg base "./trusted" --arg head "./untrusted"; then
|
|
exit 0
|
|
else
|
|
exitCode=$?
|
|
echo "To run locally: ./ci/nixpkgs-vet.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
|
|
echo "If you're having trouble, ping @NixOS/nixpkgs-vet"
|
|
exit "$exitCode"
|
|
fi
|