@@ -3,9 +3,9 @@ name: Nix CI
33on :
44 push :
55 branches :
6- - develop
76 - release/*
87 pull_request :
8+ merge_group :
99 workflow_dispatch :
1010
1111permissions :
@@ -14,6 +14,10 @@ permissions:
1414 contents : write
1515 packages : write
1616
17+ concurrency :
18+ group : ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
19+ cancel-in-progress : ${{ github.event_name == 'pull_request' }}
20+
1721jobs :
1822 build-run-image :
1923 strategy :
@@ -31,54 +35,12 @@ jobs:
3135 steps :
3236 - name : Checkout Repo
3337 uses : supabase/postgres/.github/actions/shared-checkout@HEAD
34- - name : aws-creds
35- uses : aws-actions/configure-aws-credentials@v4
36- if : ${{ github.secret_source == 'Actions' }}
38+ - uses : ./.github/actions/nix-install-ephemeral
3739 with :
38- role-to-assume : ${{ secrets.DEV_AWS_ROLE }}
39- aws-region : " us-east-1"
40- output-credentials : true
41- role-duration-seconds : 7200
42- - name : Setup AWS credentials for Nix
43- if : ${{ github.secret_source == 'Actions' }}
44- run : |
45- sudo -H aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
46- sudo -H aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
47- sudo -H aws configure set aws_session_token $AWS_SESSION_TOKEN
48- name : write secret key
49- # use python so we don't interpolate the secret into the workflow logs, in case of bugs
50- run : |
51- sudo mkdir -p /etc/nix
52- sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
40+ push-to-cache : ${{ github.secret_source == 'Actions' && 'true' || 'false' }}
5341 env :
42+ DEV_AWS_ROLE : ${{ secrets.DEV_AWS_ROLE }}
5443 NIX_SIGN_SECRET_KEY : ${{ secrets.NIX_SIGN_SECRET_KEY }}
55- - name : Setup cache script
56- if : ${{ github.secret_source == 'Actions' }}
57- run : |
58- cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null
59- #!/usr/bin/env bash
60- set -euf
61- export IFS=' '
62- /nix/var/nix/profiles/default/bin/nix copy --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' $OUT_PATHS
63- EOF
64- sudo chmod +x /etc/nix/upload-to-cache.sh
65- name : Install nix
66- uses : cachix/install-nix-action@v27
67- if : ${{ github.secret_source == 'Actions' }}
68- with :
69- install_url : https://releases.nixos.org/nix/nix-2.29.1/install
70- extra_nix_config : |
71- substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
72- trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
73- post-build-hook = /etc/nix/upload-to-cache.sh
74- name : Install nix
75- uses : cachix/install-nix-action@v27
76- if : ${{ github.secret_source == 'None' }}
77- with :
78- install_url : https://releases.nixos.org/nix/nix-2.29.1/install
79- extra_nix_config : |
80- substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
81- trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
8244 - name : Aggressive disk cleanup for DuckDB build
8345 if : matrix.runner == 'macos-latest-xlarge'
8446 run : |
10466 sudo rm -rf /tmp/* 2>/dev/null || true
10567 echo "=== AFTER CLEANUP ==="
10668 df -h
107- name : Build psql bundle
69+
70+ name : Build psql bundle
10871 run : >
10972 nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48"
11073 -- --skip-cached --no-nom ${{ matrix.runner == 'macos-latest-xlarge' && '--max-jobs 1' || '' }}
0 commit comments