feat(ci): add a permission for write packages #27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI/CD for Nix Dotfiles | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| build-docker-image: | |
| if: | | |
| github.event_name == 'push' || github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| image_name: ${{ steps.build.outputs.image_name }} | |
| build_ran: "true" | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for file changes | |
| id: check_files | |
| run: | | |
| MODIFIED_FILES=$(git diff --name-only HEAD^ HEAD | \ | |
| grep -E 'nix_test_env/Dockerfile|nix_test_env/docker_entrypoint.sh') | |
| if [ -n "$MODIFIED_FILES" ]; then | |
| echo "build_ran=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "build_ran=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Build docker image | |
| id: build | |
| run: | | |
| IMAGE_NAME="nix-test-env:$(git rev-parse --short HEAD)" | |
| docker build -t ${IMAGE_NAME} -f ./nix_test_env/Dockerfile . | |
| echo "image_name=${IMAGE_NAME}" >> $GITHUB_OUTPUT | |
| - name: Save Docker image to GitHub Container Registry | |
| run: | | |
| IMAGE_NAME="ghcr.io/${{ github.repository }}/nix-test-env:$(git rev-parse --short HEAD)" | |
| echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin | |
| docker tag ${{ steps.build.outputs.image_name }} ${IMAGE_NAME} | |
| docker push ${IMAGE_NAME} | |
| tests: | |
| runs-on: ubuntu-latest | |
| if: | | |
| (github.event_name == 'push' || github.event_name == 'pull_request') && | |
| (needs.build-docker-image.outputs.build_ran == 'true' || | |
| needs.build-docker-image.outputs.build_ran == '') | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Pull Docker image from GitHub Container Registry | |
| run: | | |
| IMAGE_NAME="ghcr.io/${{ github.repository }}/nix-test-env:$(git rev-parse --short HEAD)" | |
| echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin | |
| docker pull ${IMAGE_NAME} | |
| - name: Run container | |
| id: container | |
| run: | | |
| CONTAINER_NAME="nix-test-container" | |
| docker run --name ${CONTAINER_NAME} -d \ | |
| --entrypoint /usr/local/bin/docker_entrypoint.sh \ | |
| ${{ needs.build-docker-image.outputs.image_name }} tail -f /dev/null | |
| echo "container_name=${CONTAINER_NAME}" >> $GITHUB_OUTPUT | |
| - name: Run home-manager switch | |
| run: | | |
| docker exec ${{ steps.container.outputs.container_name }} bash \ | |
| home-manager switch | |
| - name: Run Git config test in container | |
| run: | | |
| docker exec ${{ steps.container.outputs.container_name }} bash -ec " | |
| git config --global user.name | grep -q 'PedroBrantes' | |
| " | |
| - name: Run Editor env test in container | |
| run: | | |
| docker exec ${{ steps.container.outputs.container_name }} bash -ec " | |
| printenv EDITOR | grep -q 'nvim' | |
| " | |
| - name: Clean up container | |
| run: docker rm -f ${{ steps.container.outputs.container_name }} |