Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add cachix binary cache publish step to release #3759

Merged
merged 13 commits into from
Oct 30, 2023
Merged

Add cachix binary cache publish step to release #3759

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
f7cf00c
test cachix binary cache publish
goodlyrottenapple Oct 26, 2023
71b51de
fix jq
goodlyrottenapple Oct 26, 2023
862fd93
print cachix version
goodlyrottenapple Oct 26, 2023
29c52b4
fix env
goodlyrottenapple Oct 26, 2023
2028509
fix env2
goodlyrottenapple Oct 26, 2023
62703b1
pin all variations of the k package + robust publish
goodlyrottenapple Oct 26, 2023
bcd71f0
refresh
goodlyrottenapple Oct 26, 2023
ec10cd9
Merge branch 'develop' into sam/cachix-binary
goodlyrottenapple Oct 27, 2023
7d141f9
move cachix push job into release
goodlyrottenapple Oct 27, 2023
2dcfd39
merge develop
goodlyrottenapple Oct 27, 2023
fa52c12
Merge branch 'develop' into sam/cachix-binary
goodlyrottenapple Oct 27, 2023
d41f43b
remove needs: nix-flake-release
goodlyrottenapple Oct 30, 2023
db3d3b4
Merge branch 'develop' into sam/cachix-binary
goodlyrottenapple Oct 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 0 additions & 53 deletions .github/workflows/master-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,62 +5,9 @@ on:
- master

jobs:

nix-flake-release:
name: 'Nix flake release'
strategy:
matrix:
include:
- runner: ubuntu-20.04
os: ubuntu-20.04
- runner: macos-13
os: macos-13
- runner: MacM1
os: self-macos-12
runs-on: ${{ matrix.runner }}
timeout-minutes: 60
steps:
- name: 'Check out code'
uses: actions/checkout@v3

- name: 'Upgrade bash'
if: ${{ contains(matrix.os, 'macos') }}
run: brew install bash

- name: 'Install Nix'
if: ${{ !startsWith(matrix.os, 'self') }}
uses: cachix/install-nix-action@v22
with:
install_url: https://releases.nixos.org/nix/nix-2.13.3/install
extra_nix_config: |
access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
substituters = http://cache.nixos.org https://hydra.iohk.io
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=

- name: 'Install Cachix'
if: ${{ !startsWith(matrix.os, 'self') }}
uses: cachix/cachix-action@v12
with:
name: k-framework
authToken: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
skipPush: true

- name: 'Build and cache K Framework'
uses: workflow/nix-shell-action@v3
env:
GC_DONT_GC: 1
CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
with:
packages: jq
script: |
k=$(nix build .#k --json | jq -r '.[].outputs | to_entries[].value')
drv=$(nix-store --query --deriver ${k})
nix-store --query --requisites --include-outputs ${drv} | cachix push k-framework

Comment on lines -9 to -59
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should not have been in master push. It has instead been replaced by the cachix-release job in release.yml

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@goodlyrottenapple we need to remove the needs: ... clause from later in the job under gh-release.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah thanks for the spot!

gh-release:
name: 'Publish GitHub Prerelease'
runs-on: ubuntu-latest
needs: nix-flake-release
steps:
- name: 'Check out code'
uses: actions/checkout@v3
Expand Down
46 changes: 34 additions & 12 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,17 +43,25 @@ jobs:
cd ${CURDIR}
gh release upload --repo runtimeverification/k --clobber v${version} ${tarball}

nix-release:
name: 'Nix Release'
runs-on: ubuntu-20.04
environment: production
Comment on lines -46 to -49
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was only ever used for integration tests in the haskell-backend https://github.com/runtimeverification/haskell-backend/blob/858004428c6e9ff4a2e5733aee3b4d8909a3e13f/test.nix#L26-L36
but has long since been replaced with a different mechanism

cachix-release:
name: 'k-framework-binary cachix release'
strategy:
matrix:
include:
- runner: ubuntu-20.04
os: ubuntu-20.04
- runner: macos-13
os: macos-13
- runner: MacM1
os: self-macos-12
runs-on: ${{ matrix.runner }}
timeout-minutes: 60
steps:
- name: Check out code
- name: 'Check out code'
uses: actions/checkout@v3
with:
submodules: recursive

- name: Install Nix
- name: 'Install Nix'
if: ${{ !startsWith(matrix.os, 'self') }}
uses: cachix/install-nix-action@v22
with:
install_url: https://releases.nixos.org/nix/nix-2.13.3/install
Expand All @@ -62,10 +70,24 @@ jobs:
substituters = http://cache.nixos.org https://hydra.iohk.io
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=

- name: Upload release.nix
uses: runtimeverification/[email protected]
- name: 'Install Cachix'
if: ${{ !startsWith(matrix.os, 'self') }}
uses: cachix/cachix-action@v12

- name: 'Publish K to k-framework-binary cache'
uses: workflow/nix-shell-action@v3
env:
CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}'
GC_DONT_GC: '1'
with:
token: ${{ secrets.GITHUB_TOKEN }}
packages: jq
script: |
export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH"
kup publish k-framework-binary .#k --keep-days 180
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ehildenb @Baltoli not sure how long we want to keep these pinned? They won't be GCd as long as they are pinned in the cache... ive chosen a somewhat arbitrary 180 days. Might even be too long?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess the limiting thing here is the maximum time between updates for a downstream project; if something were to go longer than 180 days without an update then is the downside risk just that their CI / build process will need to build K from source if going via Nix? (as opposed to breaking a build). My gut feeling is that we should go for a shorter time, but that also depends on what the risk is on the other side - will we get charged extra by cachix? Will we fill up a disk somewhere more quickly?

(sorry for the lengthy answer, just trying to understand the tradeoff space here)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, kup will still install fine but will have to rely on the old cache and therefore will build for a bit longer. This can be mitigated in a few different ways. If the downstream CI is not ephemeral, then this should not matter anyway, otherwise we could either manually re-pin without the --keep-days argument which means that version will be pinned indefinitely, or we/they can set up another cachix cach and copy whatever they need into that cache...

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we paying for cachix? I remember in the past there was an issue where we would run out of space and they would start to delete old stuff. Is that going to be an issue that interacts poorly with these changes?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are paying for cachix, yes. We have a plan that allows us quite a bit of storage across several repositories, @F-WRunTime has more details.

kup publish k-framework-binary .#k.openssl --keep-days 180
kup publish k-framework-binary .#k.procps --keep-days 180
kup publish k-framework-binary .#k.openssl.procps --keep-days 180
kup publish k-framework-binary .#k.procps.openssl --keep-days 180
Baltoli marked this conversation as resolved.
Show resolved Hide resolved

ubuntu-jammy:
name: 'K Ubuntu Jammy Package'
Expand Down Expand Up @@ -315,7 +337,7 @@ jobs:
name: 'Publish Release'
runs-on: [self-hosted, linux, normal]
environment: production
needs: [nix-release, macos-build, macos-test, source-tarball, ubuntu-jammy, set-release-id]
needs: [cachix-release, macos-build, macos-test, source-tarball, ubuntu-jammy, set-release-id]
steps:
- name: 'Check out code'
uses: actions/checkout@v3
Expand Down
14 changes: 12 additions & 2 deletions .github/workflows/test-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,9 +226,19 @@ jobs:
with:
name: k-framework
authToken: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
skipPush: true

- name: 'Build K Framework'
run: GC_DONT_GC=1 nix build --print-build-logs .
- name: 'Build K Framework and push build time dependencies to cachix'
env:
CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
NIX_PATH: 'nixpkgs=http://nixos.org/channels/nixos-22.05/nixexprs.tar.xz'
GC_DONT_GC: '1'
run: |
nix --version
export JQ=$(nix-build '<nixpkgs>' -A jq --no-link)/bin/jq
k=$(nix build . --print-build-logs --json | $JQ -r '.[].outputs | to_entries[].value')
drv=$(nix-store --query --deriver ${k})
nix-store --query --requisites ${drv} | cachix push k-framework

- name: 'Smoke test K'
run: GC_DONT_GC=1 nix build --print-build-logs .#smoke-test
Expand Down