fix: keep same-username homes on different hosts distinct #2736
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: test | |
| on: | |
| push: | |
| branches: [main] | |
| paths: ["**/*.nix"] | |
| pull_request: | |
| types: [labeled, opened, synchronize, reopened, review_requested, ready_for_review] | |
| paths: ["**/*.nix"] | |
| pull_request_review: | |
| types: [submitted] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| # never cancel main builds: back-to-back merges would leave main untested | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| env: | |
| NIX_PATH: "nixpkgs=https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz" | |
| jobs: | |
| non-draft: | |
| runs-on: ubuntu-latest | |
| # review events: only approvals re-trigger CI; comment reviews would | |
| # otherwise produce skipped check runs that overwrite real test results | |
| if: ${{github.ref == 'refs/heads/main' || (github.event.pull_request.draft == false && (github.event_name != 'pull_request_review' || github.event.review.state == 'approved'))}} | |
| outputs: | |
| nix-changed: ${{ steps.diff.outputs.nix-changed }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - id: diff | |
| # pull_request_review has no paths filter, so docs-only PRs reach here; | |
| # downstream jobs skip on nix-changed=false (skipped required checks | |
| # count as passing, which is what lets docs-only PRs merge) | |
| run: | | |
| if [[ "${{github.ref}}" == "refs/heads/main" ]]; then | |
| echo "nix-changed=true" >> "$GITHUB_OUTPUT" | |
| else | |
| git fetch --depth 1 origin refs/heads/main | |
| if git diff --name-only origin/main..${{github.sha}} -- | grep -q '\.nix$'; then | |
| echo "nix-changed=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "nix-changed=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| fi | |
| allow-ci: | |
| needs: [non-draft] | |
| name: allow-ci | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check access | |
| if: ${{github.event_name == 'pull_request' || github.event_name == 'pull_request_review'}} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # labels are queried live, not from github.event: re-runs reuse the | |
| # payload frozen at trigger time, so a label added after a failure | |
| # would never be seen. auto-allow-ci's GITHUB_TOKEN labeling also does | |
| # not re-trigger workflows, hence the permission-check fallback. | |
| run: | | |
| if gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels --jq '.[].name' | grep -qx 'allow-ci'; then | |
| exit 0 | |
| fi | |
| perm=$(gh api repos/${{ github.repository }}/collaborators/${{ github.event.pull_request.user.login }}/permission --jq '.permission') || perm=none | |
| if [[ "$perm" != "admin" && "$perm" != "write" ]]; then | |
| echo "::error::PR author does not have write access and PR is missing allow-ci label" | |
| exit 1 | |
| fi | |
| ci-deep: | |
| needs: [non-draft, allow-ci] | |
| # runs even when allow-ci fails so the required check goes red instead of | |
| # skipped (skipped required checks count as passing and would allow merge) | |
| if: ${{!cancelled() && needs.non-draft.result == 'success' && needs.non-draft.outputs.nix-changed == 'true'}} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| name: Tests ${{matrix.os}} | |
| runs-on: ${{matrix.os}} | |
| steps: | |
| - name: Require allow-ci | |
| run: test "${{needs.allow-ci.result}}" == "success" | |
| - uses: wimpysworld/nothing-but-nix@v10 | |
| - uses: cachix/install-nix-action@v31 | |
| - uses: DeterminateSystems/magic-nix-cache-action@v13 | |
| - uses: actions/checkout@v6 | |
| - run: nix-shell --run 'just ci-deep' | |
| flake-check: | |
| needs: [non-draft, allow-ci] | |
| if: ${{!cancelled() && needs.non-draft.result == 'success' && needs.non-draft.outputs.nix-changed == 'true'}} | |
| name: nix flake check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require allow-ci | |
| run: test "${{needs.allow-ci.result}}" == "success" | |
| - uses: cachix/install-nix-action@v31 | |
| - run: nix flake check -L github:vic/checkmate --override-input target github:$GITHUB_REPOSITORY/$GITHUB_SHA | |
| noflake: | |
| needs: [non-draft, allow-ci] | |
| if: ${{needs.non-draft.outputs.nix-changed == 'true'}} | |
| name: noflake | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: wimpysworld/nothing-but-nix@v10 | |
| - uses: cachix/install-nix-action@v31 | |
| - uses: DeterminateSystems/magic-nix-cache-action@v13 | |
| - uses: actions/checkout@v6 | |
| - run: sed -i 's@# den.outPath@den.outPath@' templates/noflake/default.nix | |
| - run: | | |
| cat <<-EOF > templates/noflake/modules/ci-runtime.nix | |
| { | |
| _module.args.CI = true; | |
| } | |
| EOF | |
| git add templates/noflake/modules/ci-runtime.nix | |
| - run: (cd templates/noflake && nix-build ./default.nix -A flake.nixosConfigurations.igloo.config.system.build.toplevel) | |
| - run: (cd templates/noflake && nix-shell ./default.nix -A den.sh --run 'igloo build --offline') | |
| template: | |
| needs: [non-draft, allow-ci] | |
| if: ${{needs.non-draft.outputs.nix-changed == 'true'}} | |
| # max-parallel: 2 | |
| strategy: | |
| matrix: | |
| template: [bogus, minimal, microvm, nvf-standalone, flake-parts-modules] | |
| os: [ubuntu-latest] | |
| name: Check template ${{matrix.template}} ${{matrix.os}} | |
| runs-on: ${{matrix.os}} | |
| steps: | |
| - uses: wimpysworld/nothing-but-nix@v10 | |
| - uses: cachix/install-nix-action@v31 | |
| - uses: DeterminateSystems/magic-nix-cache-action@v13 | |
| - uses: actions/checkout@v6 | |
| - run: | | |
| cat <<-EOF > templates/${{matrix.template}}/modules/ci-runtime.nix | |
| { | |
| _module.args.CI = true; | |
| } | |
| EOF | |
| git add templates/${{matrix.template}}/modules/ci-runtime.nix | |
| - run: nix flake check -L ./templates/${{matrix.template}} --override-input den github:$GITHUB_REPOSITORY/$GITHUB_SHA | |
| - run: (cd templates/nvf-standalone && nix build .#my-neovim --override-input den github:$GITHUB_REPOSITORY/$GITHUB_SHA) | |
| if: matrix.template == 'nvf-standalone' | |
| - run: (cd templates/minimal && nix build .#.nixosConfigurations.igloo.config.system.build.toplevel --override-input den github:$GITHUB_REPOSITORY/$GITHUB_SHA) | |
| if: matrix.template == 'minimal' | |
| - run: | | |
| cd templates/minimal | |
| sed -i "s#github:$GITHUB_REPOSITORY#github:$GITHUB_REPOSITORY/$GITHUB_SHA#" flake.nix | |
| nix flake update den | |
| nix run .#igloo -- build --offline | |
| if: matrix.template == 'minimal' | |
| - run: (cd templates/flake-parts-modules && nix develop .# --override-input den github:$GITHUB_REPOSITORY/$GITHUB_SHA --command cowsay) | |
| if: matrix.template == 'flake-parts-modules' | |
| flake-file-template: | |
| needs: [non-draft, allow-ci] | |
| if: ${{needs.non-draft.outputs.nix-changed == 'true'}} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest] | |
| template: [default, example] | |
| name: Check template ${{matrix.template}} ${{matrix.os}} | |
| runs-on: ${{matrix.os}} | |
| steps: | |
| - uses: wimpysworld/nothing-but-nix@v10 | |
| if: matrix.os == 'ubuntu-latest' | |
| - uses: cachix/install-nix-action@v31 | |
| - uses: DeterminateSystems/magic-nix-cache-action@v13 | |
| - run: nix flake init -t github:$GITHUB_REPOSITORY/$GITHUB_SHA#${{matrix.template}} | |
| - run: | | |
| cat <<-EOF > modules/ci-runtime.nix | |
| { lib, ... }: | |
| { | |
| flake-file.inputs.den.url = lib.mkForce "github:$GITHUB_REPOSITORY/$GITHUB_SHA"; | |
| _module.args.CI = true; | |
| } | |
| EOF | |
| - run: nix run .#write-flake --override-input den "github:$GITHUB_REPOSITORY/$GITHUB_SHA" | |
| - run: nix flake update den | |
| - run: nix run .#write-flake | |
| - run: nix flake metadata | |
| - run: nix flake check -L --no-build |