Upstream tracking

.github/workflows/build.yml

@@ -0,0 +1,50 @@
+on:
+  workflow_call:
+    inputs:
+      os:
+        required: true
+        type: string
+      system:
+        required: true
+        type: string
+      if:
+        required: false
+        default: true
+        type: boolean
+      run_tests:
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+  build:
+    if: ${{ inputs.if }}
+    strategy:
+      fail-fast: false
+    runs-on: ${{ inputs.os }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - run: nix build .#packages.${{ inputs.system }}.default .#packages.${{ inputs.system }}.binaryTarball --no-link -L
+      - run: nix build .#packages.${{ inputs.system }}.binaryTarball --out-link tarball
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ inputs.system }}
+          path: ./tarball/*.xz
+  test:
+    if: ${{ inputs.if && inputs.run_tests}}
+    strategy:
+      fail-fast: false
+    runs-on: ${{ inputs.os }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - run: nix flake check -L --system ${{ inputs.system }}

.github/workflows/ci.yml

@@ -3,180 +3,64 @@ name: "CI"
 on:
   pull_request:
   push:
+    branches:
+      - detsys-main
+      - main
+      - master
+  merge_group:
 
-permissions: read-all
+permissions:
+  id-token: "write"
+  contents: "read"
 
 jobs:
   eval:
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-32vcpu-ubuntu-2204
     steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - uses: cachix/install-nix-action@v30
-    - run: nix --experimental-features 'nix-command flakes' flake show --all-systems --json
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - run: nix flake show --all-systems --json
 
-  tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - scenario: on ubuntu
-            runs-on: ubuntu-24.04
-            os: linux
-          - scenario: on macos
-            runs-on: macos-14
-            os: darwin
-    name: tests ${{ matrix.scenario }}
-    runs-on: ${{ matrix.runs-on }}
-    timeout-minutes: 60
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - uses: cachix/install-nix-action@v30
-      with:
-        # The sandbox would otherwise be disabled by default on Darwin
-        extra_nix_config: |
-          sandbox = true
-          max-jobs = 1
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    # Since ubuntu 22.30, unprivileged usernamespaces are no longer allowed to map to the root user:
-    # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
-    - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-      if: matrix.os == 'linux'
-    - run: scripts/build-checks
-    - run: scripts/prepare-installer-for-github-actions
-    - name: Upload installer tarball
-      uses: actions/upload-artifact@v4
-      with:
-        name: installer-${{matrix.os}}
-        path: out/*
+  build_x86_64-linux:
+    uses: ./.github/workflows/build.yml
+    with:
+      os: blacksmith-32vcpu-ubuntu-2204
+      system: x86_64-linux
 
-  installer_test:
-    needs: [tests]
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - scenario: on ubuntu
-            runs-on: ubuntu-24.04
-            os: linux
-          - scenario: on macos
-            runs-on: macos-14
-            os: darwin
-    name: installer test ${{ matrix.scenario }}
-    runs-on: ${{ matrix.runs-on }}
-    steps:
-    - uses: actions/checkout@v4
-    - name: Download installer tarball
-      uses: actions/download-artifact@v4
-      with:
-        name: installer-${{matrix.os}}
-        path: out
-    - name: Serving installer
-      id: serving_installer
-      run: ./scripts/serve-installer-for-github-actions
-    - uses: cachix/install-nix-action@v30
-      with:
-        install_url: 'http://localhost:8126/install'
-        install_options: "--tarball-url-prefix http://localhost:8126/"
-    - run: sudo apt install fish zsh
-      if: matrix.os == 'linux'
-    - run: brew install fish
-      if: matrix.os == 'darwin'
-    - run: exec bash -c "nix-instantiate -E 'builtins.currentTime' --eval"
-    - run: exec sh -c "nix-instantiate -E 'builtins.currentTime' --eval"
-    - run: exec zsh -c "nix-instantiate -E 'builtins.currentTime' --eval"
-    - run: exec fish -c "nix-instantiate -E 'builtins.currentTime' --eval"
-    - run: exec bash -c "nix-channel --add https://releases.nixos.org/nixos/unstable/nixos-23.05pre466020.60c1d71f2ba nixpkgs"
-    - run: exec bash -c "nix-channel --update && nix-env -iA nixpkgs.hello && hello"
+  build_aarch64-linux:
+    uses: ./.github/workflows/build.yml
+    with:
+      if: ${{ github.event_name == 'merge_group' }}
+      os: blacksmith-32vcpu-ubuntu-2204-arm
+      system: aarch64-linux
 
-  # Steps to test CI automation in your own fork.
-  # 1. Sign-up for https://hub.docker.com/
-  # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
-  # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
-  check_secrets:
-    permissions:
-      contents: none
-    name: Check Docker secrets present for installer tests
-    runs-on: ubuntu-24.04
-    outputs:
-      docker: ${{ steps.secret.outputs.docker }}
-    steps:
-      - name: Check for secrets
-        id: secret
-        env:
-          _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
-        run: |
-          echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
-
-  docker_push_image:
-    needs: [tests, vm_tests, check_secrets]
-    permissions:
-      contents: read
-      packages: write
-    if: >-
-      needs.check_secrets.outputs.docker == 'true' &&
-      github.event_name == 'push' &&
-      github.ref_name == 'master'
-    runs-on: ubuntu-24.04
-    steps:
-    - name: Check for secrets
-      id: secret
-      env:
-        _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
-      run: |
-        echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - uses: cachix/install-nix-action@v30
-      with:
-        install_url: https://releases.nixos.org/nix/nix-2.20.3/install
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    - run: echo NIX_VERSION="$(nix --experimental-features 'nix-command flakes' eval .\#nix.version | tr -d \")" >> $GITHUB_ENV
-    - run: nix --experimental-features 'nix-command flakes' build .#dockerImage -L
-    - run: docker load -i ./result/image.tar.gz
-    - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
-    - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:master
-    # We'll deploy the newly built image to both Docker Hub and Github Container Registry.
-    #
-    # Push to Docker Hub first
-    - name: Login to Docker Hub
-      uses: docker/login-action@v3
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-    - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
-    - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:master
-    # Push to GitHub Container Registry as well
-    - name: Login to GitHub Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ghcr.io
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-    - name: Push image
-      run: |
-        IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix
-        # Change all uppercase to lowercase
-        IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+  build_x86_64-darwin:
+    uses: ./.github/workflows/build.yml
+    with:
+      if: ${{ github.event_name == 'merge_group' }}
+      os: namespace-profile-mac-m2-12c28g
+      system: x86_64-darwin
 
-        docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION
-        docker tag nix:$NIX_VERSION $IMAGE_ID:latest
-        docker push $IMAGE_ID:$NIX_VERSION
-        docker push $IMAGE_ID:latest
-        # deprecated 2024-02-24
-        docker tag nix:$NIX_VERSION $IMAGE_ID:master
-        docker push $IMAGE_ID:master
+  build_aarch64-darwin:
+    uses: ./.github/workflows/build.yml
+    with:
+      os: namespace-profile-mac-m2-12c28g
+      system: aarch64-darwin
 
-  vm_tests:
-    runs-on: ubuntu-24.04
+  vm_tests_smoke:
+    if: github.event_name != 'merge_group'
+    needs: build_x86_64-linux
+    runs-on: blacksmith-32vcpu-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          determinate: true
+      - uses: DeterminateSystems/flakehub-cache-action@main
       - run: |
           nix build -L \
             .#hydraJobs.tests.functional_user \
@@ -185,22 +69,80 @@ jobs:
             .#hydraJobs.tests.tarballFlakes \
             ;
 
+  vm_tests_all:
+    if: github.event_name == 'merge_group'
+    needs: build_x86_64-linux
+    runs-on: blacksmith-32vcpu-ubuntu-2204
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - run: |
+          nix build -L --keep-going \
+            $(nix flake show --json \
+              | jq -r '
+                .hydraJobs.tests
+                | with_entries(select(.value.type == "derivation"))
+                | keys[]
+                | ".#hydraJobs.tests." + .')
+
   flake_regressions:
-    needs: vm_tests
-    runs-on: ubuntu-24.04
+    if: github.event_name == 'merge_group'
+    needs: build_x86_64-linux
+    runs-on: blacksmith-32vcpu-ubuntu-2204
     steps:
       - name: Checkout nix
         uses: actions/checkout@v4
       - name: Checkout flake-regressions
         uses: actions/checkout@v4
         with:
-          repository: NixOS/flake-regressions
+          repository: DeterminateSystems/flake-regressions
           path: flake-regressions
       - name: Checkout flake-regressions-data
         uses: actions/checkout@v4
         with:
-          repository: NixOS/flake-regressions-data
+          repository: DeterminateSystems/flake-regressions-data
           path: flake-regressions/tests
       - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH MAX_FLAKES=25 flake-regressions/eval-all.sh
+        with:
+          determinate: true
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH MAX_FLAKES=50 flake-regressions/eval-all.sh
+
+  manual:
+    if: github.event_name != 'merge_group'
+    needs: build_x86_64-linux
+    runs-on: blacksmith
+    permissions:
+      id-token: "write"
+      contents: "read"
+      pull-requests: "write"
+      statuses: "write"
+      deployments: "write"
+    steps:
+      - name: Checkout nix
+        uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - name: Build manual
+        run: nix build .#hydraJobs.manual
+      - uses: nwtgck/[email protected]
+        with:
+          publish-dir: "./result/share/doc/nix/manual"
+          production-branch: detsys-main
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          deploy-message: "Deploy from GitHub Actions"
+          # NOTE(cole-h): We have a perpetual PR displaying our changes against upstream open, but
+          # its conversation is locked, so this PR comment can never be posted.
+          # https://github.com/DeterminateSystems/nix-src/pull/4
+          enable-pull-request-comment: ${{ github.event.pull_request.number != 4 }}
+          enable-commit-comment: true
+          enable-commit-status: true
+          overwrites-pull-request-comment: true
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}

.github/workflows/propose-release.yml

@@ -0,0 +1,29 @@
+on:
+  workflow_dispatch:
+    inputs:
+      reference-id:
+        type: string
+        required: true
+      version:
+        type: string
+        required: true
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  propose-release:
+    uses: DeterminateSystems/propose-release/.github/workflows/workflow.yml@main
+    permissions:
+      id-token: write
+      contents: write
+      pull-requests: write
+    with:
+      update-flake: false
+      reference-id: ${{ inputs.reference-id }}
+      version: ${{ inputs.version }}
+      extra-commands-early: |
+        echo ${{ inputs.version }} > .version-determinate
+        git add .version-determinate
+        git commit -m "Set .version-determinate to ${{ inputs.version }}" || true