59 lines (59 loc) · 2.06 KB
/
main.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
on:
push:
branches: [ master ]
pull_request:
branches: [ master ]
jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2.3.4
- uses: nixbuild/nix-quick-install-action@v6
- uses: nixbuild/nixbuild-action@v5
with:
nixbuild_ssh_key: ${{ secrets.nixbuild_ssh_key }}
- name: black
run: nix-shell --pure --run "black --check ."
- name: bandit
run: nix-shell --pure --run "bandit -r ."
tests:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2.3.4
- uses: nixbuild/nix-quick-install-action@v6
- uses: nixbuild/nixbuild-action@v5
with:
nixbuild_ssh_key: ${{ secrets.nixbuild_ssh_key }}
- run: nix-shell --pure --run "pytest --cov=nixos_security_tracker --cov=tracker --cov-report=term --cov-report=html:coverage-report | tee pytest.log"
- name: publish coverage report
run: |
$(nix-build .github/workflows/publish-coverage.nix)
env:
NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2.3.4
- uses: nixbuild/nix-quick-install-action@v6
- uses: nixbuild/nixbuild-action@v5
with:
nixbuild_ssh_key: ${{ secrets.nixbuild_ssh_key }}
- run: nix-build
- run: nix-build -A staticFiles
- run: nix-build -A manage
vm-test:
# only instantiate but do not run/build the test as there is currently no way to use
# KVM on neither GitHub Actions nor nixbuild.net
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2.3.4
- uses: nixbuild/nix-quick-install-action@v6
with:
nix_conf: "system-features = nixos-test benchmark big-parallel kvm"
- uses: nixbuild/nixbuild-action@v5
with:
nixbuild_ssh_key: ${{ secrets.nixbuild_ssh_key }}
- run: nix-build test.nix -A driver
- run: nix-build --max-jobs 1 test.nix