chore: weekly flake.lock update
#20595
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "build" | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: {} | |
| merge_group: {} | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| # Abort superseded runs: a new push to a PR cancels the in-progress run for that | |
| # PR (rapid-fire commits no longer pile up runners). Pushes to master and merge | |
| # queue runs are never cancelled (each gets a unique group via run_id). | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| common-tests: | |
| strategy: | |
| matrix: | |
| # Small/free GitHub runners — the heavy lifting is offloaded to | |
| # nixbuild.net by the test-blueprint action. | |
| os: [ubuntu-latest, ubuntu-26.04-arm] | |
| fail-fast: false | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Run Common Tests | |
| uses: ./.github/actions/test-blueprint | |
| with: | |
| os: ${{ matrix.os }} | |
| test-target: common-tests | |
| test-name: ${{ matrix.os }}-common-tests | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| nixbuild_token: ${{ secrets.NIXBUILD_TOKEN }} | |
| gc-tests: | |
| strategy: | |
| matrix: | |
| # The RTS-variant builds that previously OOM'd big runners now run as | |
| # separate derivations on nixbuild.net. | |
| os: [ubuntu-latest, ubuntu-26.04-arm] | |
| fail-fast: false | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Run GC Tests | |
| uses: ./.github/actions/test-blueprint | |
| with: | |
| os: ${{ matrix.os }} | |
| test-target: gc-tests | |
| test-name: ${{ matrix.os }}-gc-tests | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| nixbuild_token: ${{ secrets.NIXBUILD_TOKEN }} | |
| # Ignored on the nixbuild.net path (builds run remotely). Only applies | |
| # to the local fallback (fork PRs / no token): serialise the ~3 GB | |
| # RTS-variant builds so they don't OOM the small standard runners. | |
| max-jobs: 1 | |
| tests: | |
| strategy: | |
| matrix: | |
| # Small/free GitHub runners — builds are offloaded to nixbuild.net. | |
| os: [ubuntu-latest, ubuntu-26.04-arm] | |
| build_type: [release, debug] | |
| fail-fast: false | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # fetch full history so that git merge-base works | |
| fetch-depth: 0 | |
| # fetch PR commit, not predicted merge commit | |
| ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }} | |
| - name: Run Tests | |
| uses: ./.github/actions/test-blueprint | |
| with: | |
| os: ${{ matrix.os }} | |
| test-target: ${{ matrix.build_type }}-systems-go | |
| test-name: ${{ matrix.os }}-${{ matrix.build_type }}-tests | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| nixbuild_token: ${{ secrets.NIXBUILD_TOKEN }} | |
| # Ignored on the nixbuild.net path (builds run remotely). Only applies | |
| # to the local fallback (fork PRs / no token): serialise the ~3 GB | |
| # derivation builds so they don't OOM the small standard runners. | |
| max-jobs: 1 | |
| # Secrets/vars are not exposed to fork PRs, so this step (and the perf | |
| # step that consumes its output) is skipped on fork PRs. | |
| - name: Create GitHub App Token | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: app-token | |
| with: | |
| client-id: ${{ vars.GENERIC_CI_RW_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.GENERIC_CI_RW_APP_PRIVATE_KEY }} | |
| - name: Run Performance Tests | |
| if: github.actor != 'dependabot[bot]' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && runner.os == 'Linux' && runner.arch == 'X64' && matrix.build_type == 'release' | |
| uses: ./.github/actions/performance | |
| with: | |
| head_sha: ${{ github.event.pull_request.head.sha }} | |
| head_ref: ${{ github.event.pull_request.head.ref }} | |
| base_ref: ${{ github.base_ref }} | |
| pr_number: ${{ github.event.pull_request.number }} | |
| is_fork: ${{ github.event.pull_request.head.repo.full_name != github.repository }} | |
| token: ${{ steps.app-token.outputs.token }} | |
| artifacts: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && contains(github.event.pull_request.labels.*.name, 'build_artifacts') | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, ubuntu-26.04-arm, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 | |
| - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 | |
| with: | |
| name: ic-hs-test | |
| - name: nix-build | |
| run: | | |
| nix build .#release.moc | |
| # upload-artifact doesn't work for symlink dir | |
| # https://github.com/actions/upload-artifact/issues/92 | |
| - run: echo "UPLOAD_PATH=$(readlink -f result)" >> $GITHUB_ENV | |
| - name: upload artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: moc-${{ matrix.os }} | |
| path: ${{ env.UPLOAD_PATH }} | |
| retention-days: 5 | |
| verify-common-gc: | |
| needs: [common-tests, gc-tests] | |
| if: ${{ always() }} # run even if dependencies failed/skipped/cancelled | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Show dependency results | |
| run: | | |
| echo common-tests: ${{ needs.common-tests.result }} | |
| echo gc-tests: ${{ needs.gc-tests.result }} | |
| - name: Fail if any dependency did not succeed | |
| run: | | |
| if ${{ needs.common-tests.result != 'success' || needs.gc-tests.result != 'success' }}; then | |
| echo "One or more dependencies failed/skipped/cancelled." | |
| exit 1 | |
| fi | |
| - name: Common and GC tests passed | |
| if: ${{ success() }} | |
| run: echo "Common and GC tests completed successfully." | |
| verify-main-tests: | |
| needs: tests | |
| if: ${{ always() }} # run even if dependencies failed/skipped/cancelled | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Show dependency results | |
| run: | | |
| echo tests: ${{ needs.tests.result }} | |
| - name: Fail if any dependency did not succeed | |
| run: | | |
| if ${{ needs.tests.result != 'success' }}; then | |
| echo "One or more dependencies failed/skipped/cancelled." | |
| exit 1 | |
| fi | |
| - name: Main test passed | |
| if: ${{ success() }} | |
| run: echo "Main test completed successfully." | |
| autoclose: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.state == 'open' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.ref == 'master' && contains(github.event.pull_request.labels.*.name, 'autoclose') | |
| needs: [verify-common-gc, verify-main-tests] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: "master" | |
| - name: Automatically closing successful trials | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh pr close ${{ github.event.pull_request.number }} --delete-branch --comment "CI looks good, this dependency bump would not cause problems, hence closing this trial PR." | |
| gh pr edit ${{ github.event.pull_request.number }} --remove-label "autoclose" | |
| approvals: | |
| if: github.event_name == 'pull_request' && github.event.pull_request.state == 'open' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.ref == 'master' && github.event.pull_request.changed_files == 1 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: "master" | |
| - name: Create GitHub App Token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: app-token-for-approvals | |
| with: | |
| client-id: ${{ vars.GENERIC_CI_RW_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.GENERIC_CI_RW_APP_PRIVATE_KEY }} | |
| - name: Hand out single-file review approvals | |
| env: | |
| GH_TOKEN: ${{ steps.app-token-for-approvals.outputs.token }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| set +e | |
| ### Handles open PRs that address `master` and only have one changed file. The body checks whether that is the `Changelog.md` (since the `if:` condition can't). If so, the PR gets approved with a comment. | |
| [ $(gh pr diff $PR --name-only) == "Changelog.md" ] \ | |
| && gh pr review $PR --approve --body 'A change to `Changelog.md`? I can handle that!' | |
| ### Handles open PRs filed by `dependabot[bot]` that carry the `dependencies` label. The single changed file must be `doc/site/package-lock.json`. If so, the PR gets approved with a comment. | |
| ${{ github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'dependencies') }} \ | |
| && [ $(gh pr diff $PR --name-only) == "doc/site/package-lock.json" ] \ | |
| && gh pr review $PR --approve --body 'A change to `doc/site/package-lock.json`? I can handle that!' \ | |
| && gh pr merge $PR --squash --auto | |
| ### Handles open PRs filed by the GH automation bot that carry the `automerge-squash` label. The single changed file must be `flake.lock`. If so, the PR gets approved with a comment, auto-merge activated and the label removed. | |
| ${{ github.event.pull_request.user.login == 'caffeine-ci-generic-rw[bot]' && contains(github.event.pull_request.labels.*.name, 'automerge-squash') }} \ | |
| && [ $(gh pr diff $PR --name-only) == "flake.lock" ] \ | |
| && gh pr review $PR --approve --body 'A change to `flake.lock`? I can handle that!' \ | |
| && gh pr merge $PR --squash --auto \ | |
| && gh pr edit $PR --remove-label 'automerge-squash' | |
| true |