nixos-config/.github/workflows/build-machines-and-homes.yml

name: build and cache machines and homes
on:
  workflow_dispatch:
  push:
  pull_request:

env:
  TERM: ansi
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}

jobs:
  build-machines:
    strategy:
      fail-fast: false
      matrix:
        machine:
          - chunk
          - ytnix
        os:
          - ubuntu-latest
    runs-on: ${{ matrix.os }}

    steps:
      - name: Maximize build disk space
        uses: easimon/maximize-build-space@v10
        with:
          overprovision-lvm: true
          swap-size-mb: 1024
          remove-dotnet: 'true'
          remove-android: 'true'
          remove-haskell: 'true'
          remove-codeql: 'true'
          remove-docker-images: 'true'
          build-mount-path: /nix

      - name: setup binary cache key
        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem

      - name: Install Nix
        uses: cachix/install-nix-action@v30
        with:
          enable_kvm: true
          extra_nix_config: |
            show-trace = true
            experimental-features = nix-command flakes
            accept-flake-config = true
            system-features = nixos-test benchmark big-parallel kvm
            secret-key-files = /home/runner/cache-priv-key.pem
            extra-substituters = https://nixcache.cy7.sh
            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=

      - name: Install Lix
        run: |
          sudo --preserve-env=PATH $(which nix) run \
          --experimental-features "nix-command flakes" \
          --extra-substituters https://cache.lix.systems --extra-trusted-public-keys "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" \
          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
          upgrade-nix \
          --extra-substituters https://cache.lix.systems --extra-trusted-public-keys "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
          nix --version

      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: build
        run: |
          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
          nix build -L "$package"

      - name: cache
        # https://stackoverflow.com/a/58859404
        if: '!cancelled()'
        run: |
          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
          derivations=()
          while IFS=$'\n' read derivation; do
              derivations+=("$derivation")
          done < <(nix path-info --derivation "$package")

          for derivation in "${derivations[@]}"; do
              nix copy -j8 \
                --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem' \
                $(nix-store --query --requisites --include-outputs "$derivation")
          done

  build-homes:
    strategy:
      fail-fast: false
      matrix:
        home:
          - yt@ytnix
          - yt@chunk
        os:
          - ubuntu-latest
          # - macos-latest
    runs-on: ${{ matrix.os }}

    steps:
      - name: Maximize build disk space
        uses: easimon/maximize-build-space@v10
        with:
          overprovision-lvm: true
          swap-size-mb: 1024
          remove-dotnet: 'true'
          remove-android: 'true'
          remove-haskell: 'true'
          remove-codeql: 'true'
          remove-docker-images: 'true'
          build-mount-path: /nix

      - name: setup binary cache key
        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem

      - name: Install Nix
        uses: cachix/install-nix-action@v30
        with:
          enable_kvm: true
          extra_nix_config: |
            show-trace = true
            experimental-features = nix-command flakes
            accept-flake-config = true
            system-features = nixos-test benchmark big-parallel kvm
            secret-key-files = /home/runner/cache-priv-key.pem
            extra-substituters = https://nixcache.cy7.sh
            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=

      - name: Install Lix
        run: |
          sudo --preserve-env=PATH $(which nix) run \
          --experimental-features "nix-command flakes" \
          --extra-substituters https://cache.lix.systems --extra-trusted-public-keys "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=" \
          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
          upgrade-nix \
          --extra-substituters https://cache.lix.systems --extra-trusted-public-keys "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
          nix --version

      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: build
        run: |
          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
          nix build -L "$package"

      - name: cache
        # https://stackoverflow.com/a/58859404
        if: '!cancelled()'
        run: |
          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
          derivations=()
          while IFS=$'\n' read derivation; do
              derivations+=("$derivation")
          done < <(nix path-info --derivation "$package")

          for derivation in "${derivations[@]}"; do
              nix copy -j8 \
                --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem' \
                $(nix-store --query --requisites --include-outputs "$derivation")
          done