nix-installer/.github/workflows/release-prs.yml at 26121337edc741d68f65b3e8790fc48f67a52fb2 · DeterminateSystems/nix-installer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
name: Release PR

on:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - labeled

permissions:
  id-token: "write"
  contents: "read"

jobs:
  build-x86_64-linux:
    # Only intra-repo PRs are allowed to have PR artifacts uploaded
    # We only want to trigger once the upload once in the case the upload label is added, not when any label is added
    if: |
      always() && !failure() && !cancelled()
      && github.event.pull_request.head.repo.full_name == 'DeterminateSystems/nix-installer'
      && (
        (github.event.action == 'labeled' && github.event.label.name == 'upload to s3')
        || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'upload to s3'))
      )
    uses: ./.github/workflows/build-x86_64-linux.yml
  build-aarch64-linux:
    # Only intra-repo PRs are allowed to have PR artifacts uploaded
    # We only want to trigger once the upload once in the case the upload label is added, not when any label is added
    if: |
      always() && !failure() && !cancelled()
      && github.event.pull_request.head.repo.full_name == 'DeterminateSystems/nix-installer'
      && (
        (github.event.action == 'labeled' && github.event.label.name == 'upload to s3')
        || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'upload to s3'))
      )
    uses: ./.github/workflows/build-aarch64-linux.yml
  build-aarch64-darwin:
    # Only intra-repo PRs are allowed to have PR artifacts uploaded
    # We only want to trigger once the upload once in the case the upload label is added, not when any label is added
    if: |
      always() && !failure() && !cancelled()
      && github.event.pull_request.head.repo.full_name == 'DeterminateSystems/nix-installer'
      && (
        (github.event.action == 'labeled' && github.event.label.name == 'upload to s3')
        || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'upload to s3'))
      )
    uses: ./.github/workflows/build-aarch64-darwin.yml

  release:
    # Only intra-repo PRs are allowed to have PR artifacts uploaded
    # We only want to trigger once the upload once in the case the upload label is added, not when any label is added
    if: |
      always() && !failure() && !cancelled()
      && github.event.pull_request.head.repo.full_name == 'DeterminateSystems/nix-installer'
      && (
        (github.event.action == 'labeled' && github.event.label.name == 'upload to s3')
        || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'upload to s3'))
      )
    runs-on: ubuntu-latest
    needs:
      - build-x86_64-linux
      - build-aarch64-linux
      - build-aarch64-darwin
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Create artifacts directory
        run: mkdir -p ./artifacts

      - name: Fetch x86_64-linux binary artifact
        uses: actions/download-artifact@v8
        with:
          name: nix-installer-x86_64-linux
      - name: Fetch aarch64-linux binary artifact
        uses: actions/download-artifact@v8
        with:
          name: nix-installer-aarch64-linux
      - name: Fetch aarch64-darwin binary artifact
        uses: actions/download-artifact@v8
        with:
          name: nix-installer-aarch64-darwin
      - name: Move binaries into upload staging dir
        run: |
          mv nix-installer-x86_64-linux artifacts/
          mv nix-installer-aarch64-linux artifacts/
          mv nix-installer-aarch64-darwin artifacts/

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ secrets.AWS_S3_UPLOAD_ROLE }}
          aws-region: us-east-2
      - name: Publish Release (PR)
        env:
          AWS_BUCKET: ${{ secrets.AWS_S3_UPLOAD_BUCKET }}
        run: |
          PR="pr_${{ github.event.pull_request.number }}"
          GIT_ISH="${{ github.event.pull_request.head.sha }}"
          ./upload_s3.sh "$PR" "$GIT_ISH" "https://install.determinate.systems/nix/rev/$GIT_ISH"
      - name: Install Instructions (PR)
        run: |
          cat <<EOF
          This commit can be installed by running the following command:

          curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix/rev/${{ github.event.pull_request.head.sha }} | sh -s -- install

          The latest commit from this PR can be installed by running the following command:

          curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix/pr/${{ github.event.pull_request.number }} | sh -s -- install
          EOF