build.yaml

name: "Build and Cache NixOS Configurations"

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  # Start EC2 runners for each system in parallel
  start-runners:
    timeout-minutes: 5
    name: Start EC2 runner (${{ matrix.system }})
    runs-on: ubuntu-latest
    permissions:
      actions: write
    strategy:
      matrix:
        system: [norway, china, japan]
    steps:
      - name: Start EC2 runner
        id: start-ec2-runner
        uses: NextChapterSoftware/ec2-action-builder@v1.10
        with:
          github_token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          aws_access_key_id: ${{ secrets.DEPLOY_AWS_ACCESS_KEY_ID }}
          aws_secret_access_key: ${{ secrets.DEPLOY_AWS_SECRET_ACCESS_KEY }}
          aws_region: "ap-southeast-2"
          ec2_instance_type: c6i.4xlarge
          ec2_root_disk_size_gb: "100"
          ec2_ami_id: ami-09e143e99e8fa74f9
          ec2_subnet_id: "subnet-e54cb9ad"
          ec2_security_group_id: "sg-c4dfe0b2"
          ec2_instance_ttl: 120
          ec2_spot_instance_strategy: BestEffort

  # Build each system in parallel on separate runners
  build:
    timeout-minutes: 90
    name: Build ${{ matrix.system }}
    needs: start-runners
    runs-on: ${{ github.run_id }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - system: norway
            config: jacob-norway
            description: "Primary Laptop"
          - system: china
            config: jacob-china
            description: "Home Server"
          - system: japan
            config: jacob-japan
            description: "Steam Deck"
    steps:
      - name: Setup runner environment
        run: |
          mkdir -p /home/runner
          chmod -R 755 /home/runner
          echo "HOME=/home/runner" >> $GITHUB_ENV

      - uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v25
        with:
          nix_path: nixpkgs=channel:nixos-unstable
          # Use latest Nix to avoid bug in 2.18.x causing modules-shrunk build failures
          install_url: https://releases.nixos.org/nix/nix-2.28.3/install
          extra_nix_config: |
            experimental-features = nix-command flakes
            accept-flake-config = true

      - name: Setup Cachix
        uses: cachix/cachix-action@v14
        with:
          name: jpyke3
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

      - name: Setup Magic Nix Cache
        uses: DeterminateSystems/magic-nix-cache-action@v2

      - name: Connect to Tailscale
        uses: tailscale/github-action@v2
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:ci

      - name: Verify Tailscale connectivity
        run: |
          echo "Waiting for Tailscale to establish connection..."
          sleep 5
          tailscale status

          # Verify we can reach the Attic cache
          if ! ping -c 3 jacob-china; then
            echo "::warning::Cannot reach jacob-china via Tailscale"
          fi

          # Verify Attic is accessible
          if curl -sf http://jacob-china:5000/ > /dev/null 2>&1; then
            echo "Attic cache is accessible"
          else
            echo "::warning::Attic cache not responding"
          fi

      - name: Setup Attic client
        run: |
          nix profile install nixpkgs#attic-client
          attic login main http://jacob-china:5000 ${{ secrets.ATTIC_TOKEN }}

      - name: Prefetch Citrix workspace tarball (norway only)
        if: matrix.system == 'norway'
        run: |
          echo "Downloading Citrix workspace tarball via Tailscale..."
          # Fetch directly from jacob-china via Tailscale (nginx serves the file)
          # Using HTTP since Tailscale already provides encryption
          curl -L -o linuxx64-24.5.0.76.tar.gz \
            "http://jacob-china/citrix/linuxx64-24.5.0.76.tar.gz" \
            -H "Host: files.pyk.ee"

          # Verify download
          if [ ! -s linuxx64-24.5.0.76.tar.gz ]; then
            echo "::error::Failed to download Citrix tarball"
            exit 1
          fi

          # Add to Nix store with correct hash
          nix-prefetch-url file://$PWD/linuxx64-24.5.0.76.tar.gz
          rm linuxx64-24.5.0.76.tar.gz

      - name: Build ${{ matrix.config }} (${{ matrix.description }})
        run: |
          echo "Building ${{ matrix.config }}..."
          nix build .#nixosConfigurations.${{ matrix.config }}.config.system.build.toplevel \
            --no-link --print-out-paths > build-paths.txt
          echo "Build complete"
          cat build-paths.txt

      - name: Push to Attic cache
        run: |
          echo "Pushing ${{ matrix.config }} closure to Attic cache..."

          # Check Attic connectivity first
          if ! attic cache info main; then
            echo "::warning::Cannot connect to Attic cache, skipping push"
            exit 0
          fi

          # Push closure with verbose output to diagnose failures
          # Use -j for parallel uploads
          attic push -j 5 main $(cat build-paths.txt) 2>&1 || {
            echo "::error::Attic push failed"
            exit 1
          }
          echo "Push complete"

      - name: Build summary
        if: always()
        run: |
          echo "=== Build Summary for ${{ matrix.config }} ==="
          echo "System: ${{ matrix.description }}"
          echo "Paths built:"
          cat build-paths.txt 2>/dev/null || echo "No paths (build may have failed)"
          if [ -f closure-paths.txt ]; then
            echo "Closure size: $(wc -l < closure-paths.txt) paths"
          fi