Skip to content

Commit 4f1095d

Browse files
elezarelezar
committed
fix(ci): prepare Nix development shells in setup-nix
Signed-off-by: Evan Lezar <elezar@nvidia.com>
1 parent 76cfd0e commit 4f1095d

11 files changed

Lines changed: 64 additions & 13 deletions

File tree

‎.agents/skills/watch-github-actions/SKILL.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,11 @@ gh run list --json databaseId,status,headBranch,url --jq '.[] | {id: .databaseId
125125

126126
## View Job Logs
127127

128+
`setup-nix` retries development-shell preparation once when `prepare-shell`
129+
is enabled. Inspect both attempts in the job log; `setup-rust` assumes the
130+
shell has already been prepared. Cargo, lint, and test commands are not retried.
131+
Skipped dependent E2E suites indicate blocked coverage.
132+
128133
For `Trivy Changes`, inspect the `Resolve PR baseline` step for the base and head
129134
SHAs. PR runs compare the tested merge commit with its
130135
first parent; change detection and scans must use the same pair. On reruns, do

‎.github/actions/setup-nix/action.yml‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,23 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Setup Nix
5-
description: Install Nix and configure the OpenShell Cachix cache
5+
description: Install Nix, configure Cachix, and optionally prepare the development shell
66

77
inputs:
88
cachix-auth-token:
99
description: Token used to write build outputs to Cachix
1010
required: false
1111
default: ""
1212

13+
prepare-shell:
14+
description: Prepare the development shell, retrying once on failure
15+
required: false
16+
default: "false"
17+
shell-installable:
18+
description: Development shell to prepare
19+
required: false
20+
default: "."
21+
1322
runs:
1423
using: composite
1524
steps:
@@ -22,3 +31,16 @@ runs:
2231
name: openshell
2332
authToken: ${{ inputs.cachix-auth-token }}
2433
skipPush: ${{ inputs.cachix-auth-token == '' }}
34+
35+
- name: Prepare Nix development shell
36+
if: inputs.prepare-shell == 'true'
37+
shell: bash
38+
env:
39+
NIX_SHELL_INSTALLABLE: ${{ inputs.shell-installable }}
40+
run: |
41+
# HTTP 416 is not retried by Nix; a fresh invocation restarts downloads.
42+
if nix develop "$NIX_SHELL_INSTALLABLE" -c true; then
43+
exit 0
44+
fi
45+
echo "::warning::Nix shell preparation failed; retrying once."
46+
nix develop "$NIX_SHELL_INSTALLABLE" -c true

‎.github/actions/setup-rust/action.yml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Setup Rust
5-
description: Configure the Nix development shell and Rust caches
5+
description: Configure Rust caches after setup-nix has prepared the development shell
66

77
inputs:
88
cache-key:
@@ -23,10 +23,6 @@ runs:
2323
shell_drv=$(nix eval --raw --impure .#devShells --apply 'shells: shells.${builtins.currentSystem}.default.drvPath')
2424
echo "hash=$(nix hash file --type sha256 --base16 "$shell_drv")" >> "$GITHUB_OUTPUT"
2525
26-
- name: Realize Nix development shell
27-
shell: bash
28-
run: nix develop -c true
29-
3026
- name: Cache Rust target and registry
3127
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
3228
with:

‎.github/workflows/branch-checks.yml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -114,14 +114,11 @@ jobs:
114114
steps:
115115
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
116116

117-
- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
118-
with:
119-
github_access_token: ${{ secrets.GITHUB_TOKEN }}
120-
121-
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
117+
- uses: ./.github/actions/setup-nix
122118
with:
123-
name: openshell
124-
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
119+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
120+
prepare-shell: "true"
121+
shell-installable: .#devShells.x86_64-linux.default
125122

126123
- name: Check dependencies
127124
run: cargo deny check licenses bans sources
@@ -137,6 +134,7 @@ jobs:
137134

138135
- uses: ./.github/actions/setup-nix
139136
with:
137+
prepare-shell: "true"
140138
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
141139

142140
- name: Format
@@ -158,6 +156,7 @@ jobs:
158156

159157
- uses: ./.github/actions/setup-nix
160158
with:
159+
prepare-shell: "true"
161160
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
162161

163162
- name: Verify Cargo lockfiles
@@ -185,6 +184,7 @@ jobs:
185184

186185
- uses: ./.github/actions/setup-nix
187186
with:
187+
prepare-shell: "true"
188188
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
189189

190190
- uses: ./.github/actions/setup-rust
@@ -221,6 +221,7 @@ jobs:
221221

222222
- uses: ./.github/actions/setup-nix
223223
with:
224+
prepare-shell: "true"
224225
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
225226

226227
- uses: ./.github/actions/setup-rust
@@ -257,6 +258,7 @@ jobs:
257258

258259
- uses: ./.github/actions/setup-nix
259260
with:
261+
prepare-shell: "true"
260262
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
261263

262264
- uses: ./.github/actions/setup-rust
@@ -306,6 +308,7 @@ jobs:
306308

307309
- uses: ./.github/actions/setup-nix
308310
with:
311+
prepare-shell: "true"
309312
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
310313

311314
- uses: ./.github/actions/setup-rust
@@ -330,6 +333,7 @@ jobs:
330333

331334
- uses: ./.github/actions/setup-nix
332335
with:
336+
prepare-shell: "true"
333337
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
334338

335339
- uses: ./.github/actions/setup-rust
@@ -356,6 +360,7 @@ jobs:
356360

357361
- uses: ./.github/actions/setup-nix
358362
with:
363+
prepare-shell: "true"
359364
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
360365

361366
- uses: ./.github/actions/setup-rust

‎.github/workflows/branch-e2e.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@ jobs:
144144
ref: ${{ github.sha }}
145145
- uses: ./.github/actions/setup-nix
146146
with:
147+
prepare-shell: "true"
147148
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
148149
- uses: ./.github/actions/build-rust-binary
149150
with:
@@ -184,6 +185,7 @@ jobs:
184185
ref: ${{ github.sha }}
185186
- uses: ./.github/actions/setup-nix
186187
with:
188+
prepare-shell: "true"
187189
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
188190
- uses: ./.github/actions/build-rust-binary
189191
with:

‎.github/workflows/build-binaries.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ jobs:
5151
ref: ${{ inputs.checkout-ref || github.sha }}
5252
- uses: ./.github/actions/setup-nix
5353
with:
54+
prepare-shell: "true"
5455
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
5556
- uses: ./.github/actions/build-rust-binary
5657
with:

‎.github/workflows/build-vm-driver.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ jobs:
5252

5353
- uses: ./.github/actions/setup-nix
5454
with:
55+
prepare-shell: "true"
5556
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
5657

5758
- name: Download openshell-sandbox

‎.github/workflows/trivy-changes.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,8 @@ jobs:
110110

111111
- name: Set up Nix
112112
uses: ./.github/actions/setup-nix
113+
with:
114+
prepare-shell: "true"
113115

114116
- name: Test report comparison
115117
run: tasks/scripts/trivy-scan-test.sh

‎.github/workflows/trivy-scan.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ jobs:
105105
- name: Set up Nix
106106
uses: ./.github/actions/setup-nix
107107
with:
108+
prepare-shell: "true"
108109
cachix-auth-token: ${{ github.event_name != 'pull_request' && secrets.CACHIX_AUTH_TOKEN || '' }}
109110

110111
- name: Test scan reporting

‎.github/workflows/workflow-security.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ jobs:
5454
- name: Set up Nix
5555
uses: ./.github/actions/setup-nix
5656
with:
57+
prepare-shell: "true"
5758
cachix-auth-token: ${{ github.event_name != 'pull_request' && secrets.CACHIX_AUTH_TOKEN || '' }}
5859

5960
- name: Run Actionlint
@@ -141,6 +142,7 @@ jobs:
141142
- name: Set up Nix
142143
uses: ./.github/actions/setup-nix
143144
with:
145+
prepare-shell: "true"
144146
cachix-auth-token: ${{ github.event_name != 'pull_request' && secrets.CACHIX_AUTH_TOKEN || '' }}
145147

146148
- name: Run Zizmor

0 commit comments

Comments
 (0)