docs(policy): ban ReScript explicitly and pin production installs #18
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | ||
| # This workflow is managed by gh actions-lock. | ||
| name: Publish Nixpkgs | ||
| on: | ||
| repository_dispatch: | ||
| types: [publish-nixpkgs] | ||
| workflow_dispatch: | ||
| inputs: | ||
| version: | ||
| description: 'Version (e.g., 1.0.2)' | ||
| required: true | ||
| tag: | ||
| description: 'Git tag (e.g., v1.0.2)' | ||
| required: true | ||
| permissions: | ||
| contents: read | ||
| env: | ||
| TAP_REPO: hyperpolymath/homebrew-tap | ||
| jobs: | ||
| update-guix: | ||
| name: Update Guix Expression in Tap | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - name: Check for TAP_GITHUB_TOKEN | ||
| id: check-secret | ||
| run: | | ||
| if [ -z "${{ secrets.TAP_GITHUB_TOKEN }}" ]; then | ||
| echo "skip=true" >> $GITHUB_OUTPUT | ||
| echo "::warning::TAP_GITHUB_TOKEN not configured. Skipping Guix update." | ||
| else | ||
| echo "skip=false" >> $GITHUB_OUTPUT | ||
| fi | ||
| - name: Checkout homebrew-tap | ||
| if: steps.check-secret.outputs.skip != 'true' | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | ||
| with: | ||
| repository: ${{ env.TAP_REPO }} | ||
| token: ${{ secrets.TAP_GITHUB_TOKEN }} | ||
| - name: Install Guix | ||
| if: steps.check-secret.outputs.skip != 'true' | ||
| with: | ||
| nix_path: nixpkgs=channel:nixos-unstable | ||
| - name: Get inputs | ||
| if: steps.check-secret.outputs.skip != 'true' | ||
| id: inputs | ||
| run: | | ||
| if [ "${{ github.event_name }}" = "repository_dispatch" ]; then | ||
| echo "version=${{ github.event.client_payload.version }}" >> $GITHUB_OUTPUT | ||
| echo "tag=${{ github.event.client_payload.tag }}" >> $GITHUB_OUTPUT | ||
| else | ||
| echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT | ||
| echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT | ||
| fi | ||
| - name: Calculate source hash | ||
| if: steps.check-secret.outputs.skip != 'true' | ||
| id: hash | ||
| run: | | ||
| TAG="${{ steps.inputs.outputs.tag }}" | ||
| # Use guix-prefetch-url to get the hash in SRI format | ||
| HASH=$(guix-prefetch-url --unpack "https://github.com/hyperpolymath/bunsenite/archive/refs/tags/${TAG}.tar.gz" 2>/dev/null) | ||
| SRI_HASH=$(guix hash to-sri --type sha256 "$HASH") | ||
| echo "hash=$SRI_HASH" >> $GITHUB_OUTPUT | ||
| echo "Calculated hash: $SRI_HASH" | ||
| - name: Update Guix expression | ||
| if: steps.check-secret.outputs.skip != 'true' | ||
| run: | | ||
| VERSION="${{ steps.inputs.outputs.version }}" | ||
| TAG="${{ steps.inputs.outputs.tag }}" | ||
| HASH="${{ steps.hash.outputs.hash }}" | ||
| mkdir -p guix | ||
| # Create default.guix for the package | ||
| cat > guix/bunsenite.guix << EOF | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| { lib | ||
| , rustPlatform | ||
| , fetchFromGitHub | ||
| }: | ||
| rustPlatform.buildRustPackage rec { | ||
| pname = "bunsenite"; | ||
| version = "${VERSION}"; | ||
| src = fetchFromGitHub { | ||
| owner = "hyperpolymath"; | ||
| repo = "bunsenite"; | ||
| rev = "${TAG}"; | ||
| hash = "${HASH}"; | ||
| }; | ||
| cargoLock = { | ||
| lockFile = "\${src}/Cargo.lock"; | ||
| }; | ||
| buildFeatures = [ "full" ]; | ||
| meta = with lib; { | ||
| description = "Nickel configuration file parser with multi-language FFI bindings"; | ||
| homepage = "https://github.com/hyperpolymath/bunsenite"; | ||
| license = with licenses; [ mit /* Palimpsest-0.8 */ ]; | ||
| maintainers = [ ]; | ||
| mainProgram = "bunsenite"; | ||
| }; | ||
| } | ||
| EOF | ||
| # Create flake.guix for standalone use | ||
| cat > guix/flake.guix << EOF | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| { | ||
| description = "Bunsenite - Nickel configuration file parser with FFI bindings"; | ||
| inputs = { | ||
| nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; | ||
| flake-utils.url = "github:numtide/flake-utils"; | ||
| }; | ||
| outputs = { self, nixpkgs, flake-utils }: | ||
| flake-utils.lib.eachDefaultSystem (system: | ||
| let | ||
| pkgs = nixpkgs.legacyPackages.\${system}; | ||
| bunsenite = pkgs.callPackage ./bunsenite.guix { }; | ||
| in | ||
| { | ||
| packages = { | ||
| default = bunsenite; | ||
| bunsenite = bunsenite; | ||
| }; | ||
| apps.default = flake-utils.lib.mkApp { | ||
| drv = bunsenite; | ||
| }; | ||
| devShells.default = pkgs.mkShell { | ||
| buildInputs = [ bunsenite ]; | ||
| }; | ||
| } | ||
| ); | ||
| } | ||
| EOF | ||
| # Create overlay for use in other flakes | ||
| cat > guix/overlay.guix << EOF | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| final: prev: { | ||
| bunsenite = final.callPackage ./bunsenite.guix { }; | ||
| } | ||
| EOF | ||
| echo "Generated Guix files:" | ||
| cat guix/bunsenite.guix | ||
| - name: Commit and push | ||
| if: steps.check-secret.outputs.skip != 'true' | ||
| run: | | ||
| VERSION="${{ steps.inputs.outputs.version }}" | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "github-actions[bot]@users.noreply.github.com" | ||
| git add guix/ | ||
| git diff --staged --quiet || git commit -m "guix: bunsenite ${VERSION}" | ||
| git push | ||
| create-nixpkgs-pr: | ||
| name: Create nixpkgs PR (Optional) | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| needs: update-guix | ||
| if: ${{ inputs.submit_nixpkgs == true }} | ||
| steps: | ||
| - name: Check for NIXPKGS_GITHUB_TOKEN | ||
| id: check-secret | ||
| run: | | ||
| if [ -z "${{ secrets.NIXPKGS_GITHUB_TOKEN }}" ]; then | ||
| echo "skip=true" >> $GITHUB_OUTPUT | ||
| echo "::warning::NIXPKGS_GITHUB_TOKEN not configured. Skipping nixpkgs PR." | ||
| else | ||
| echo "skip=false" >> $GITHUB_OUTPUT | ||
| fi | ||
| - name: Create nixpkgs PR | ||
| if: steps.check-secret.outputs.skip != 'true' | ||
| run: | | ||
| echo "To submit to nixpkgs:" | ||
| echo "1. Fork NixOS/nixpkgs" | ||
| echo "2. Add bunsenite.guix to pkgs/by-name/bu/bunsenite/package.guix" | ||
| echo "3. Create PR with title: bunsenite: init at ${VERSION}" | ||
| echo "" | ||
| echo "This requires manual review by nixpkgs maintainers." | ||
