feat(workflows): Switch to a nix-based definition of workflows

.envrc

@@ -1 +1,2 @@
+watch_file workflows/*
 use nix

.forgejo/workflows/check-meta.yaml

@@ -1,25 +1,21 @@
-name: Check meta
-on:
-  pull_request:
-    branches:
-      - main
-  push:
-    paths:
-      - 'meta/*'
-
 jobs:
-  check_meta:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Check the validity of meta options
-        run: nix-build meta/verify.nix -A meta
-
   check_dns:
     runs-on: nix
     steps:
-      - uses: actions/checkout@v3
+    - uses: actions/checkout@v3
-
+    - name: Check the validity of the DNS configuration
-      - name: Check the validity of the DNS configuration
+      run: nix-build meta/verify.nix -A dns --no-out-link
-        run: nix-build meta/verify.nix -A dns --no-out-link
+  check_meta:
+    runs-on: nix
+    steps:
+    - uses: actions/checkout@v3
+    - name: Check the validity of meta options
+      run: nix-build meta/verify.nix -A meta
+name: Check meta
+'on':
+  pull_request:
+    branches:
+    - main
+  push:
+    paths:
+    - meta/*

.forgejo/workflows/check-workflows.yaml

@@ -0,0 +1,15 @@
+jobs:
+  check_workflows:
+    runs-on: nix
+    steps:
+    - uses: actions/checkout@v3
+    - name: Check that the workflows are up to date
+      run: nix-shell --run '[ $(git status --porcelain) -eq 0 ]'
+name: Check workflows
+'on':
+  pull_request:
+    branches:
+    - main
+  push:
+    paths:
+    - workflows/*

.forgejo/workflows/ds-fr.yaml

@@ -1,56 +0,0 @@
-name: ds-fr update
-on:
-  schedule:
-    - cron: "26 18 * * wed"
-
-jobs:
-  npins_update:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          token: ${{ secrets.TEA_DGNUM_CHORES_TOKEN }}
-
-      - name: Update DS and open PR if necessary
-        run: |
-          # Fetch the latest release tag
-          VERSION=$(curl -L \
-            -H "Accept: application/vnd.github+json" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/demarches-simplifiees/demarches-simplifiees.fr/releases/latest \
-          | jq -r '.tag_name')
-
-          # Move to the ds-fr directory
-          cd machines/compute01/ds-fr/package
-
-          # Run the update script
-          ./update.sh -v "$VERSION"
-
-          if [ ! -z "$(git diff --name-only)" ]; then
-            echo "[+] Changes detected, pushing updates."
-
-            git switch -C ds-update
-
-            git add .
-
-            git config user.name "DGNum Chores"
-            git config user.email "tech@dgnum.eu"
-
-            git commit --message "chore(ds-fr): Update"
-            git push --set-upstream origin ds-update --force
-
-            # Connect to the server with the cli
-            tea login add \
-              -n dgnum-chores \
-              -t '${{ secrets.TEA_DGNUM_CHORES_TOKEN }}' \
-              -u https://git.dgnum.eu
-
-            # Create a pull request if needed
-            # i.e. no PR with the same title exists
-            if [ -z "$(tea pr ls -f='title,author' -o simple | grep 'chore(ds-fr): Update dgnum-chores')" ]; then
-              tea pr create \
-                --description "Automatic ds-fr update" \
-                --title "chore(ds-fr): Update" \
-                --head ds-update
-            fi
-          fi

.forgejo/workflows/eval-nodes.yaml

@@ -0,0 +1,119 @@
+jobs:
+  bridge01:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: bridge01
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache bridge01
+      run: nix-shell --run cache-node
+  compute01:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: compute01
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache compute01
+      run: nix-shell --run cache-node
+  geo01:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: geo01
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache geo01
+      run: nix-shell --run cache-node
+  geo02:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: geo02
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache geo02
+      run: nix-shell --run cache-node
+  rescue01:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: rescue01
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache rescue01
+      run: nix-shell --run cache-node
+  storage01:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: storage01
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache storage01
+      run: nix-shell --run cache-node
+  vault01:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: vault01
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache vault01
+      run: nix-shell --run cache-node
+  web01:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: web01
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache web01
+      run: nix-shell --run cache-node
+  web02:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: web02
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache web02
+      run: nix-shell --run cache-node
+  web03:
+    runs-on: nix
+    steps:
+    - uses: actions/checkous@v3
+    - env:
+        BUILD_NODE: web03
+        STORE_ENDPOINT: https://tvix-store.dgnum.eu/infra-signing/
+        STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        STORE_USER: admin
+      name: Build and cache web03
+      run: nix-shell --run cache-node
+name: Build all the nodes
+'on':
+  pull_request:
+    branches:
+    - main
+  push:
+    branches:
+    - main

.forgejo/workflows/eval.yaml

@@ -1,200 +0,0 @@
-name: build configuration
-on:
-  pull_request:
-    types: [opened, synchronize, edited, reopened]
-    branches:
-      - main
-  push:
-    branches:
-      - main
-
-jobs:
-  build_and_cache_compute01:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "compute01"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_compute01
-          path: paths.txt
-
-  build_and_cache_storage01:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "storage01"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_storage01
-          path: paths.txt
-
-  build_and_cache_rescue01:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "rescue01"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_rescue01
-          path: paths.txt
-
-  build_and_cache_geo01:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "geo01"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_geo01
-          path: paths.txt
-
-  build_and_cache_geo02:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "geo02"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_geo02
-          path: paths.txt
-
-  build_and_cache_vault01:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "vault01"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_vault01
-          path: paths.txt
-
-  build_and_cache_web01:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "web01"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_web01
-          path: paths.txt
-
-  build_and_cache_web02:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "web02"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_web02
-          path: paths.txt
-
-  build_and_cache_web03:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "web03"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_web02
-          path: paths.txt
-
-  build_and_cache_bridge01:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Build and cache the node
-        run: nix-shell --run cache-node
-        env:
-          STORE_ENDPOINT: "https://tvix-store.dgnum.eu/infra-signing/"
-          STORE_USER: "admin"
-          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
-          BUILD_NODE: "bridge01"
-
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: outputs_web02
-          path: paths.txt

.forgejo/workflows/lint.yaml

@@ -1,11 +0,0 @@
-name: lint
-on: [push, pull_request]
-
-jobs:
-  check:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Run pre-commit on all files
-        run: nix-shell --run 'pre-commit run --all-files --hook-stage pre-push --show-diff-on-failure' -A shells.pre-commit ./.

.forgejo/workflows/npins-update.yaml

@@ -0,0 +1,25 @@
+jobs:
+  npins_update:
+    runs-on: nix
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        depth: 0
+        token: ${{ secrets.TEA_DGNUM_CHORES_TOKEN }}
+    - name: Update dependencies and open PR if necessary
+      run: "npins update\n\nif [ ! -z \"$(git diff --name-only)\" ]; then\n  echo\
+        \ \"[+] Changes detected, pushing updates.\"\n\n  git switch -C npins-update\n\
+        \n  git add npins\n\n  git config user.name \"DGNum Chores\"\n  git config\
+        \ user.email \"tech@dgnum.eu\"\n\n  git commit --message \"chore(npins): Update\"\
+        \n  git push --set-upstream origin npins-update --force\n\n  # Connect to\
+        \ the server with the cli\n  tea login add \\\n    -n dgnum-chores \\\n  \
+        \  -t \"${{ secrets.TEA_DGNUM_CHORES_TOKEN }}\" \\\n    -u https://git.dgnum.eu\n\
+        \n  # Create a pull request if needed\n  # i.e. no PR with the same title\
+        \ exists\n  if [ -z \"$(tea pr ls -f='title,author' -o simple | grep 'chore(npins):\
+        \ Update dgnum-chores')\" ]; then\n    tea pr create \\\n      --description\
+        \ \"Automatic npins update\" \\\n      --title \"chore(npins): Update\" \\\
+        \n      --head npins-update\n  fi\nfi\n"
+name: npins update
+'on':
+  schedule:
+  - cron: 25 15 * * *

.forgejo/workflows/pre-commit.yaml

@@ -0,0 +1,12 @@
+jobs:
+  check:
+    runs-on: nix
+    steps:
+    - uses: actions/checkout@v3
+    - name: Run pre-commit on all files
+      run: nix-shell --run 'pre-commit run --all-files --hook-stage pre-push --show-diff-on-failure'
+        -A shells.pre-commit ./.
+name: Run pre-commit on all files
+'on':
+- push
+- pull_request

default.nix

@@ -41,7 +41,14 @@
 }:
 
 let
-  git-checks = (import (builtins.storePath sources.git-hooks)).run {
+  inherit (pkgs.lib)
+    isFunction
+    mapAttrs'
+    nameValuePair
+    removeSuffix
+    ;
+
+  git-checks = (import sources.git-hooks).run {
     src = ./.;
 
     hooks = {
@@ -67,6 +74,20 @@ let
       commitizen.enable = true;
     };
   };
+
+  workflows = (import sources.nix-actions { inherit pkgs; }).install {
+    src = ./.;
+
+    workflows = mapAttrs' (
+      name: _:
+      nameValuePair (removeSuffix ".nix" name) (
+        let
+          w = import ./workflows/${name};
+        in
+        if isFunction w then w { inherit (pkgs) lib; } else w
+      )
+    ) (builtins.readDir ./workflows);
+  };
 in
 
 {
@@ -97,6 +118,7 @@ in
 
       shellHook = ''
         ${git-checks.shellHook}
+        ${workflows.shellHook}
       '';
 
       preferLocalBuild = true;

npins/sources.json

@@ -194,6 +194,20 @@
       "url": "https://github.com/RaitoBezarius/microvm.nix/archive/49899c9a4fdf75320785e79709bf1608c34caeb8.tar.gz",
       "hash": "0sz6azdpiz4bd36x23bcdhx6mwyqj8zl5cczjgv48xqfmysy8zwy"
     },
+    "nix-actions": {
+      "type": "GitRelease",
+      "repository": {
+        "type": "Git",
+        "url": "https://git.dgnum.eu/DGNum/nix-actions.git"
+      },
+      "pre_releases": false,
+      "version_upper_bound": null,
+      "release_prefix": null,
+      "version": "v0.2.1",
+      "revision": "36a74f5ff6d8cb07c5e198baec715fc27a795f8a",
+      "url": null,
+      "hash": "10dc607x3yy1k10nzfgij3qjn6v585yj5dnmnk71zsbmczvx52yb"
+    },
     "nix-modules": {
       "type": "Git",
       "repository": {

workflows/check-meta.nix

@@ -0,0 +1,31 @@
+{
+  name = "Check meta";
+  on = {
+    pull_request.branches = [ "main" ];
+    push.paths = [ "meta/*" ];
+  };
+
+  jobs = {
+    check_meta = {
+      runs-on = "nix";
+      steps = [
+        { uses = "actions/checkout@v3"; }
+        {
+          name = "Check the validity of meta options";
+          run = "nix-build meta/verify.nix -A meta";
+        }
+      ];
+    };
+
+    check_dns = {
+      runs-on = "nix";
+      steps = [
+        { uses = "actions/checkout@v3"; }
+        {
+          name = "Check the validity of the DNS configuration";
+          run = "nix-build meta/verify.nix -A dns --no-out-link";
+        }
+      ];
+    };
+  };
+}

workflows/check-workflows.nix

@@ -0,0 +1,20 @@
+{
+  name = "Check workflows";
+  on = {
+    pull_request.branches = [ "main" ];
+    push.paths = [ "workflows/*" ];
+  };
+
+  jobs = {
+    check_workflows = {
+      runs-on = "nix";
+      steps = [
+        { uses = "actions/checkout@v3"; }
+        {
+          name = "Check that the workflows are up to date";
+          run = "nix-shell --run '[ $(git status --porcelain) -eq 0 ]'";
+        }
+      ];
+    };
+  };
+}

workflows/eval-nodes.nix

@@ -0,0 +1,32 @@
+{ lib }:
+
+let
+  inherit (lib) attrNames genAttrs;
+
+  nodes = attrNames (builtins.readDir ../machines);
+in
+
+{
+  name = "Build all the nodes";
+  on = {
+    pull_request.branches = [ "main" ];
+    push.branches = [ "main" ];
+  };
+
+  jobs = genAttrs nodes (node: {
+    runs-on = "nix";
+    steps = [
+      { uses = "actions/checkous@v3"; }
+      {
+        name = "Build and cache ${node}";
+        run = "nix-shell --run cache-node";
+        env = {
+          STORE_ENDPOINT = "https://tvix-store.dgnum.eu/infra-signing/";
+          STORE_USER = "admin";
+          STORE_PASSWORD = "\${{ secrets.STORE_PASSWORD }}";
+          BUILD_NODE = node;
+        };
+      }
+    ];
+  });
+}

workflows/npins-update.nix

@@ -1,31 +1,24 @@
-name: npins update
+{
-on:
+  name = "npins update";
-  schedule:
+  on.schedule = [
     # Run at 11 o'clock every wednesday
-    - cron: "25 15 * * *"
+    { cron = "25 15 * * *"; }
+  ];
 
-jobs:
+  jobs.npins_update = {
-  npins_update:
+    runs-on = "nix";
-    runs-on: nix
+    steps = [
-    steps:
+      {
-      # - name: Install applications
+        uses = "actions/checkout@v3";
-      #   run: apt-get update && apt-get install sudo
+        "with" = {
-      #
+          depth = 0;
-      - uses: actions/checkout@v3
+          token = "\${{ secrets.TEA_DGNUM_CHORES_TOKEN }}";
-        with:
+        };
-          depth: 0
+      }
-          token: ${{ secrets.TEA_DGNUM_CHORES_TOKEN }}
-      #
-      # - uses: https://github.com/cachix/install-nix-action@v22
-      #   with:
-      #     nix_path: nixpkgs=channel:nixos-unstable
 
-      # - name: Install tea
+      {
-      #   run: |
+        name = "Update dependencies and open PR if necessary";
-      #     nix-env -f '<nixpkgs>' -i tea
+        run = ''
-
-      - name: Update dependencies and open PR if necessary
-        run: |
           npins update
 
           if [ ! -z "$(git diff --name-only)" ]; then
@@ -44,7 +37,7 @@ jobs:
             # Connect to the server with the cli
             tea login add \
               -n dgnum-chores \
-              -t '${{ secrets.TEA_DGNUM_CHORES_TOKEN }}' \
+              -t "''${{ secrets.TEA_DGNUM_CHORES_TOKEN }}" \
               -u https://git.dgnum.eu
 
             # Create a pull request if needed
@@ -56,3 +49,8 @@ jobs:
                 --head npins-update
             fi
           fi
+        '';
+      }
+    ];
+  };
+}

workflows/pre-commit.nix

@@ -0,0 +1,18 @@
+{
+  name = "Run pre-commit on all files";
+  on = [
+    "push"
+    "pull_request"
+  ];
+
+  jobs.check = {
+    runs-on = "nix";
+    steps = [
+      { uses = "actions/checkout@v3"; }
+      {
+        name = "Run pre-commit on all files";
+        run = "nix-shell --run 'pre-commit run --all-files --hook-stage pre-push --show-diff-on-failure' -A shells.pre-commit ./.";
+      }
+    ];
+  };
+}