fix(shell): no console window for scripts spawned without one #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: nix | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - flake.nix | |
| - flake.lock | |
| - .nix/** | |
| - Cargo.toml | |
| - Cargo.lock | |
| - .github/workflows/nix.yml | |
| pull_request: | |
| branches: | |
| - main | |
| paths: | |
| - flake.nix | |
| - flake.lock | |
| - .nix/** | |
| - Cargo.toml | |
| - Cargo.lock | |
| - .github/workflows/nix.yml | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: nix-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| nix: | |
| runs-on: ubuntu-latest | |
| # An uncached build takes ~57 min, and the cache save in the post phase | |
| # adds a few more — 60 min is too tight on a cache miss. | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| # Keep build-time dependencies (crane's cargo-artifacts derivations, | |
| # flake inputs) alive through the cache action's pre-save GC. | |
| extra_nix_config: | | |
| keep-outputs = true | |
| keep-derivations = true | |
| # No purge inputs: purging needs `actions: write`, and this workflow | |
| # runs with a read-only token. GitHub's LRU cache eviction (10 GB per | |
| # repo) cleans up stale entries instead. | |
| - name: Restore and save Nix store | |
| uses: nix-community/cache-nix-action@v7 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock', '.nix/**', 'Cargo.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 6G | |
| # skia-bindings' build script does NOT validate the archive passed via | |
| # SKIA_BINARIES_URL (upstream `// TODO: verify key`), so a stale pin | |
| # builds successfully against outdated skia binaries instead of failing. | |
| # Enforce the version match explicitly. | |
| - name: Check skia-binaries pins match Cargo.lock | |
| run: | | |
| crate_version=$(grep -A1 'name = "skia-bindings"' Cargo.lock | sed -n 's/^version = "\(.*\)"/\1/p') | |
| test -n "$crate_version" || { echo "::error::skia-bindings not found in Cargo.lock"; exit 1; } | |
| grep -oE 'https://github.com/rust-skia/skia-binaries/releases/download/[^"]+' flake.nix | while read -r url; do | |
| tag=$(echo "$url" | cut -d/ -f8) | |
| if [ "$tag" != "$crate_version" ]; then | |
| echo "::error::flake.nix pins skia-binaries $tag but Cargo.lock has skia-bindings $crate_version: $url" | |
| exit 1 | |
| fi | |
| done | |
| echo "All skia-binaries pins match skia-bindings $crate_version" | |
| - name: Verify all pinned flake inputs (all platforms) | |
| run: nix flake archive | |
| - name: Evaluate flake outputs for all systems | |
| run: nix flake check --all-systems --no-build | |
| - name: Build packages (x86_64-linux) | |
| run: nix build .#vykar .#vykar-server .#vykar-gui --print-build-logs |