mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-30 11:07:33 +00:00
DanConwayDev
b0207aaf2b
Build reusable tool bundles before publisher and container commands. This exposes the pinned CLI, daemon and runtime dependencies to provider caching instead of realizing them without a cache-publication checkpoint. The release CLI check retains its verified executable in its output too. Use workflow/job/step command names throughout. Nix built both bundles, all release command wrappers and release script/CLI checks on de1. No publisher or Docker daemon ran during those builds. The Dockerfile integration test intentionally retains its existing online build policy. Assisted-by: GPT-6
55 lines
2.0 KiB
YAML
55 lines
2.0 KiB
YAML
version: 1
|
|
system: x86_64-linux
|
|
name: Container deployment e2e
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
paths:
|
|
- ".dockerignore"
|
|
- "Cargo.lock"
|
|
- "Cargo.toml"
|
|
- "Dockerfile"
|
|
- "build.rs"
|
|
- "compose*.yaml"
|
|
- "deploy/**"
|
|
- "flake.lock"
|
|
- "flake.nix"
|
|
- ".ngit/nix/workflows/default.nix"
|
|
- ".ngit/nix/workflows/ci.nix"
|
|
- ".ngit/nix/workflows/ci-container.nix"
|
|
- ".ngit/nix/workflows/container_deployment.yaml"
|
|
- "scripts/build-container-layout.sh"
|
|
- "scripts/test-container-deployment.sh"
|
|
- "scripts/test-container-release.sh"
|
|
- "src/**"
|
|
pull_request:
|
|
|
|
jobs:
|
|
container-deployment:
|
|
steps:
|
|
- tools: {build: packages.x86_64-linux.ci-container-tools}
|
|
- test
|
|
# Builds the release image with a job-owned Docker daemon inside the
|
|
# provider's disposable VM; see .ngit/nix/workflows/ci-container.nix.
|
|
requirements:
|
|
resources:
|
|
memory-mib: {gte: 4096}
|
|
environment:
|
|
/configuration/guest/job-uid: {eq: 0}
|
|
/configuration/guest/no-new-privileges: {eq: false}
|
|
/configuration/guest/module-autoload: {eq: true}
|
|
/configuration/guest/kernel-features/NAMESPACES: {eq: true}
|
|
/configuration/guest/kernel-features/PID_NS: {eq: true}
|
|
/configuration/guest/kernel-features/NET_NS: {eq: true}
|
|
/configuration/guest/kernel-features/CGROUPS: {eq: true}
|
|
/configuration/guest/kernel-features/MEMCG: {eq: true}
|
|
/configuration/guest/kernel-features/OVERLAY_FS: {eq: true}
|
|
/configuration/guest/kernel-features/BRIDGE: {eq: true}
|
|
/configuration/guest/kernel-features/VETH: {eq: true}
|
|
/configuration/guest/kernel-features/NETFILTER: {eq: true}
|
|
/configuration/guest/kernel-features/NF_NAT: {eq: true}
|
|
/configuration/guest/kernel-features/NF_TABLES: {eq: true}
|
|
/configuration/guest/kernel-features/SECCOMP_FILTER: {eq: true}
|
|
public-outputs:
|
|
summary: summary.txt
|