itlxrd/psysonic
1
0
Fork 0
mirror of https://github.com/kilyabin/psysonic.git synced 2026-07-22 14:35:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci(nix): push store paths to Cachix during verify-nix

Browse Source 
Wires cachix/cachix-action@v15 into the verify-nix job. The action
watches the nix store for the duration of the workflow and uploads
new paths to the `psysonic` cache on cachix.org automatically.

Using Cachix-managed signing (no signing key on our side) — Cachix
signs server-side with the cache's built-in keypair. End users will
pick up the public key automatically via `cachix use psysonic`, so
no manual nix.conf configuration is required.

Consequence: after the next `v*` release, `nix profile install
github:Psychotoxical/psysonic` pulls a prebuilt binary from Cachix
instead of recompiling Rust + npm deps locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Psychotoxical
2026-04-17 23:51:11 +02:00
parent e102320e32
commit ee437fca5a
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+16 -6
View File
@@ -160,12 +160,13 @@ jobs:
\( -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" \) \ \( -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" \) \
| xargs gh release upload "app-v${VERSION}" --clobber | xargs gh release upload "app-v${VERSION}" --clobber
# Verifies that `nix build .#psysonic` still works against the current source # Verifies that `nix build .#psysonic` still works against the current source,
# and refreshes `nix/upstream-sources.json` (npmDepsHash) + `flake.lock` # refreshes `nix/upstream-sources.json` (npmDepsHash) + `flake.lock`
# (nixpkgs pin). Commits the refreshed files back to `main` when they change. # (nixpkgs pin), and pushes the resulting store paths to the public Cachix
# binary cache so end users can `nix profile install github:Psychotoxical/psysonic`
# without having to compile locally.
# #
# Tarball publishing / Cachix upload are intentionally out of scope here — # The refreshed lock/hash files are committed back to `main` when they change.
# those will live in a dedicated workflow tied to a binary cache setup.
verify-nix: verify-nix:
needs: create-release needs: create-release
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
@@ -183,6 +184,15 @@ jobs:
- name: install Nix - name: install Nix
uses: DeterminateSystems/nix-installer-action@v15 uses: DeterminateSystems/nix-installer-action@v15
# cachix-action with no signingKey = Cachix-managed signing (Cachix signs
# server-side). The action watches the nix store during subsequent build
# steps and uploads new paths automatically.
- name: configure Cachix (managed signing)
uses: cachix/cachix-action@v15
with:
name: psysonic
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
- name: compute npmDepsHash from package-lock.json - name: compute npmDepsHash from package-lock.json
id: npm-hash id: npm-hash
run: | run: |
@@ -202,7 +212,7 @@ jobs:
- name: refresh flake.lock (nixpkgs pin) - name: refresh flake.lock (nixpkgs pin)
run: nix flake update --accept-flake-config run: nix flake update --accept-flake-config
- name: verify nix build - name: verify nix build + push to Cachix
run: nix build .#psysonic --accept-flake-config --no-link --print-build-logs run: nix build .#psysonic --accept-flake-config --no-link --print-build-logs
- name: commit + push refreshed lock and hash (if changed) - name: commit + push refreshed lock and hash (if changed)