nixos-config/.github/workflows/build-machines-and-homes.yml

name: build and cache machines and homes
on:
  workflow_dispatch:
  push:
  pull_request:

env:
  TERM: ansi
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}

jobs:
  build-machines:
    strategy:
      fail-fast: false
      matrix:
        machine:
          - chunk
          - ytnix
        os:
          - ubuntu-latest
    runs-on: ${{ matrix.os }}

    steps:
      - name: Maximize build disk space
        uses: easimon/maximize-build-space@v10
        with:
          overprovision-lvm: true
          swap-size-mb: 1024
          remove-dotnet: 'true'
          remove-android: 'true'
          remove-haskell: 'true'
          remove-codeql: 'true'
          remove-docker-images: 'true'
          build-mount-path: /nix

      - name: setup binary cache key
        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem

      - name: Install Nix
        uses: cachix/install-nix-action@v30
        with:
          enable_kvm: true
          extra_nix_config: |
            show-trace = true
            experimental-features = nix-command flakes
            accept-flake-config = true
            system-features = nixos-test benchmark big-parallel kvm
            secret-key-files = /home/runner/cache-priv-key.pem
            extra-substituters = https://nixcache.cy7.sh https://cache.lix.systems
            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=

      - name: Install Lix
        run: |
          sudo --preserve-env=PATH $(which nix) run \
          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
          upgrade-nix
          nix --version

      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: build
        run: |
          # package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
          # nix build -L "$package"
          nix run nixpkgs#nixos-rebuild build -- -L --flake ".#${{ matrix.machine }}"

      - name: cache
        # https://stackoverflow.com/a/58859404
        if: '!cancelled()'
        run: |
          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
          nix run github:cything/nixcp/2025-04-12 -- \
            push \
            --bucket nixcache \
            --signing-key /home/runner/cache-priv-key.pem \
            --endpoint https://s3.cy7.sh \
            -u https://nix-community.cachix.org \
            $package

  build-homes:
    strategy:
      fail-fast: false
      matrix:
        home:
          - yt@ytnix
          - yt@chunk
        os:
          - ubuntu-latest
          # - macos-latest
    runs-on: ${{ matrix.os }}

    steps:
      - name: Maximize build disk space
        uses: easimon/maximize-build-space@v10
        with:
          overprovision-lvm: true
          swap-size-mb: 1024
          remove-dotnet: 'true'
          remove-android: 'true'
          remove-haskell: 'true'
          remove-codeql: 'true'
          remove-docker-images: 'true'
          build-mount-path: /nix

      - name: setup binary cache key
        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem

      - name: Install Nix
        uses: cachix/install-nix-action@v30
        with:
          enable_kvm: true
          extra_nix_config: |
            show-trace = true
            experimental-features = nix-command flakes
            accept-flake-config = true
            system-features = nixos-test benchmark big-parallel kvm
            secret-key-files = /home/runner/cache-priv-key.pem
            extra-substituters = https://nixcache.cy7.sh https://cache.lix.systems
            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=

      - name: Install Lix
        run: |
          sudo --preserve-env=PATH $(which nix) run \
          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
          upgrade-nix
          nix --version

      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: build
        run: |
          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
          nix build -L "$package"

      - name: cache
        # https://stackoverflow.com/a/58859404
        if: '!cancelled()'
        run: |
          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
          nix run github:cything/nixcp/2025-04-12 -- \
            push \
            --bucket nixcache \
            --signing-key /home/runner/cache-priv-key.pem \
            --endpoint https://s3.cy7.sh \
            -u https://nix-community.cachix.org \
            $package