From f498a8b830c7af7fa1168320c8a36f7aaf8a7555 Mon Sep 17 00:00:00 2001 From: Utkarash Singh Date: Thu, 23 Jul 2026 23:16:16 +0100 Subject: [PATCH 1/6] chore: enable extension version restriction (warn) and cut AMIs supautils v3.4.0 (already on develop, #2311) ships supautils.restrict_extension_versions (off|warn|error, default off). Set it to warn in supautils.conf.j2: CREATE/ALTER EXTENSION version clauses from non-superuser roles are ignored with a WARNING and the extension's default_version is used instead. Superusers and supabase_admin (via privileged_extensions_superuser) are exempt. warn is rollout phase 1: fleet log warnings measure explicit-version usage before the separately-announced flip to error. Bumps postgres_release for fresh AMIs. Announcement (effective 2026-08-05): https://github.com/supabase/changelog/pull/128 Linear: PSQL-1159 --- ansible/files/postgresql_config/supautils.conf.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/files/postgresql_config/supautils.conf.j2 b/ansible/files/postgresql_config/supautils.conf.j2 index 58739905eb..16ce476d6e 100644 --- a/ansible/files/postgresql_config/supautils.conf.j2 +++ b/ansible/files/postgresql_config/supautils.conf.j2 @@ -9,6 +9,7 @@ supautils.drop_trigger_grants = '{"postgres":["auth.audit_log_entries","auth.flo # NOTE: keep nix/tests/prime-superuser.sql in sync with the "may be unsafe" + "deprecated" lists above. supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intarray, isn, ltree, moddatetime, orioledb, pg_buffercache, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers' supautils.extension_custom_scripts_path = '/etc/postgresql-custom/extension-custom-scripts' +supautils.restrict_extension_versions = 'warn' supautils.privileged_extensions_superuser = 'supabase_admin' supautils.privileged_role = 'supabase_privileged_role' supautils.privileged_role_allowed_configs = 'auto_explain.*, deadlock_timeout, log_duration, log_lock_waits, log_min_duration_statement, log_min_error_statement, log_min_messages, log_parameter_max_length, log_replication_commands, log_statement, log_temp_files, pg_net.batch_size, pg_net.ttl, pg_stat_statements.*, pgaudit.log, pgaudit.log_catalog, pgaudit.log_client, pgaudit.log_level, pgaudit.log_relation, pgaudit.log_rows, pgaudit.log_statement, pgaudit.log_statement_once, pgaudit.role, pgrst.*, plan_filter.*, safeupdate.enabled, session_replication_role, track_functions, track_io_timing, wal_compression' From a75048447e5fa13a0311f7cd8507903c896f9cad Mon Sep 17 00:00:00 2001 From: Utkarash Singh Date: Sat, 25 Jul 2026 00:56:30 +0100 Subject: [PATCH 2/6] test: assert warn-mode version restriction as platform roles The pg_regress suite runs against the rendered supautils.conf.j2 (via start-postgres-server) with migrations applied, so the new conf setting is asserted in the same PR that makes it: as the non-superuser postgres role a CREATE EXTENSION version clause is ignored with a WARNING and the default version is installed; supabase_admin (the configured privileged_extensions_superuser) keeps version pinning, warning-free. Skipped on the CLI variant, which lacks the postgres role (same as pg_net_worker_privileges). --- nix/checks.nix | 1 + .../expected/supautils_restrict_versions.out | 52 +++++++++++++++++++ nix/tests/sql/supautils_restrict_versions.sql | 38 ++++++++++++++ 3 files changed, 91 insertions(+) create mode 100644 nix/tests/expected/supautils_restrict_versions.out create mode 100644 nix/tests/sql/supautils_restrict_versions.sql diff --git a/nix/checks.nix b/nix/checks.nix index 776491bc80..d56a33306b 100644 --- a/nix/checks.nix +++ b/nix/checks.nix @@ -253,6 +253,7 @@ "extensions_schema" # tests extension loading "roles" # includes roles/schemas from extensions not in CLI (pgtle, pgmq, repack, topology) "pg_net_worker_privileges" # needs the authenticated/postgres roles from the full migrations, not present in the CLI prime file + "supautils_restrict_versions" # needs the postgres role + primed hstore from the full migrations/prime, not present in the CLI variant # Version-specific extension tests "z_17_ext_interface" "z_17_pg_stat_monitor" diff --git a/nix/tests/expected/supautils_restrict_versions.out b/nix/tests/expected/supautils_restrict_versions.out new file mode 100644 index 0000000000..514016f1e2 --- /dev/null +++ b/nix/tests/expected/supautils_restrict_versions.out @@ -0,0 +1,52 @@ +-- supautils.conf.j2 sets supautils.restrict_extension_versions = 'warn': +-- CREATE/ALTER EXTENSION version clauses from non-exempt roles are ignored +-- with a WARNING and the extension's default_version is used instead. +-- +-- This suite runs against the rendered supautils.conf.j2 with the real +-- migrations applied (see nix/tools/run-server.sh.in), so the restriction +-- can be asserted as the actual platform roles. The supautils regress suite +-- covers the GUC logic (all modes, ALTER, duplicate clauses); this test +-- covers the platform wiring. See PSQL-1159. +-- the platform config sets warn mode +show supautils.restrict_extension_versions; + supautils.restrict_extension_versions +--------------------------------------- + warn +(1 row) + +-- precondition: postgres is not a superuser, else it would be exempt +select rolsuper from pg_roles where rolname = 'postgres'; + rolsuper +---------- + f +(1 row) + +-- drop the hstore created by prime.sql so the creates below are observable +drop extension hstore; +-- non-exempt role: the version clause is ignored with a warning and the +-- default version is installed +set role postgres; +create extension hstore version '1.4'; +WARNING: only superusers can specify extension versions, ignoring version "1.4" and installing the default version +select extversion = default_version as installed_default + from pg_extension, pg_available_extensions + where extname = name and extname = 'hstore'; + installed_default +------------------- + t +(1 row) + +reset role; +drop extension hstore; +-- exempt role (supabase_admin, via supautils.privileged_extensions_superuser): +-- the version clause is honored, with no warning +create extension hstore version '1.4'; +select extversion from pg_extension where extname = 'hstore'; + extversion +------------ + 1.4 +(1 row) + +-- restore the state prime.sql created (hstore at default version) +drop extension hstore; +create extension hstore; diff --git a/nix/tests/sql/supautils_restrict_versions.sql b/nix/tests/sql/supautils_restrict_versions.sql new file mode 100644 index 0000000000..9f5d6f3a55 --- /dev/null +++ b/nix/tests/sql/supautils_restrict_versions.sql @@ -0,0 +1,38 @@ +-- supautils.conf.j2 sets supautils.restrict_extension_versions = 'warn': +-- CREATE/ALTER EXTENSION version clauses from non-exempt roles are ignored +-- with a WARNING and the extension's default_version is used instead. +-- +-- This suite runs against the rendered supautils.conf.j2 with the real +-- migrations applied (see nix/tools/run-server.sh.in), so the restriction +-- can be asserted as the actual platform roles. The supautils regress suite +-- covers the GUC logic (all modes, ALTER, duplicate clauses); this test +-- covers the platform wiring. See PSQL-1159. + +-- the platform config sets warn mode +show supautils.restrict_extension_versions; + +-- precondition: postgres is not a superuser, else it would be exempt +select rolsuper from pg_roles where rolname = 'postgres'; + +-- drop the hstore created by prime.sql so the creates below are observable +drop extension hstore; + +-- non-exempt role: the version clause is ignored with a warning and the +-- default version is installed +set role postgres; +create extension hstore version '1.4'; +select extversion = default_version as installed_default + from pg_extension, pg_available_extensions + where extname = name and extname = 'hstore'; +reset role; + +drop extension hstore; + +-- exempt role (supabase_admin, via supautils.privileged_extensions_superuser): +-- the version clause is honored, with no warning +create extension hstore version '1.4'; +select extversion from pg_extension where extname = 'hstore'; + +-- restore the state prime.sql created (hstore at default version) +drop extension hstore; +create extension hstore; From a16e18d5bb7f28298e87177737b5b88c6d6a1495 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Tue, 28 Jul 2026 11:24:04 -0400 Subject: [PATCH 3/6] ci/nix-install-ephemeral: Update for bare-bones arm-native-runner images The new images do not install anything so we no longer need force-clean. The new images don't have python nor aws installed either because we don't actually need them as evidenced by this patch. --- .../actions/nix-install-ephemeral/action.yml | 31 +++++++++---------- .github/workflows/qemu-image-build.yml | 1 - 2 files changed, 15 insertions(+), 17 deletions(-) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index af4c2292d4..27073df2c1 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -5,10 +5,6 @@ inputs: description: 'AWS region for the Nix binary cache S3 bucket' required: false default: 'us-east-1' - force-clean: - description: Whether to delete pre-existing nix paths - required: false - default: 'false' push-to-cache: description: 'Whether to push build outputs to the Nix binary cache' required: false @@ -28,10 +24,6 @@ runs: aws-region: ${{ inputs.aws-region }} output-credentials: true role-duration-seconds: 7200 - - name: Force Clean Pre-Existing Nix Paths - if: inputs.force-clean == 'true' - shell: bash - run: sudo rm -rf /nix /etc/nix "$HOME/.nix-profile" "$HOME/.nix-channels" "$HOME/.config/nix" - name: Ensure /etc/nix exists shell: bash run: sudo mkdir -p /etc/nix @@ -39,12 +31,20 @@ runs: if: ${{ inputs.push-to-cache == 'true' }} shell: bash run: | - sudo -H aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID - sudo -H aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY - sudo -H aws configure set aws_session_token $AWS_SESSION_TOKEN - sudo -H aws configure set region ${{ inputs.aws-region }} - sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()" - cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null + mkdir -p ~/.aws + cat > ~/.aws/config < ~/.aws/credentials </dev/null + sudo tee /etc/nix/upload-to-cache.sh >/dev/null <<'EOF' #!/usr/bin/env bash set -euo pipefail set -f @@ -53,8 +53,7 @@ runs: /nix/var/nix/profiles/default/bin/nix copy --max-jobs 5 --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' $OUT_PATHS EOF sudo chmod +x /etc/nix/upload-to-cache.sh - env: - NIX_SIGN_SECRET_KEY: ${{ env.NIX_SIGN_SECRET_KEY }} + cat /etc/nix/upload-to-cache.sh - name: Install Nix shell: bash run: | diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index 4210ba65ab..94e7af26bb 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -67,7 +67,6 @@ jobs: - name: Install Nix uses: ./.github/actions/nix-install-ephemeral with: - force-clean: "true" multi-user: "false" - name: Build QEMU artifact From af4f3878c685e571f72e88a855c1c71589adb730 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Tue, 28 Jul 2026 11:24:04 -0400 Subject: [PATCH 4/6] ci/nix-install-ephemeral: Drop multi-user input Having to pass this in was a temporary solution for qemu-image builds and doing so now for the nixos vm tests would be quite a pain, so lets drop it. Instead of an input lets detect the environment we are running in and do the right thing. --- .github/actions/nix-install-ephemeral/action.yml | 8 +++----- .github/workflows/qemu-image-build.yml | 2 -- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index 27073df2c1..c5ec007eee 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -9,10 +9,6 @@ inputs: description: 'Whether to push build outputs to the Nix binary cache' required: false default: 'false' - multi-user: - description: Whether to install nix in multi-user mode (default true) or single-user mode - required: false - default: 'true' runs: using: 'composite' steps: @@ -57,7 +53,8 @@ runs: - name: Install Nix shell: bash run: | - if [[ "${{ inputs.multi-user }}" == true ]]; then + if ! systemd-detect-virt --container --quiet; then + # *not* running in a container, assume vm and install multi-user mode daemon=--daemon nixconfdir=/etc/nix path=/nix/var/nix/profiles/default/bin @@ -66,6 +63,7 @@ runs: echo 'access-tokens = github.com=${{ github.token }}' | sudo tee $nixconfdir/github.nix.conf >/dev/null sudo chmod 400 $nixconfdir/github.nix.conf else + # *am* running in a container install single-user mode daemon=--no-daemon nixconfdir=$HOME/.config/nix path=$HOME/.nix-profile/bin diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index 94e7af26bb..8accaa378c 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -66,8 +66,6 @@ jobs: - name: Install Nix uses: ./.github/actions/nix-install-ephemeral - with: - multi-user: "false" - name: Build QEMU artifact run: BUILD_QEMU_IMAGE_HW_VIRT_ONLY=1 nix run .#build-qemu-image "${{ matrix.postgres_version }}" arm64 From 0d447d9d6123179035b01090cde3b184e5f5f780 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Mon, 27 Jul 2026 14:21:57 -0400 Subject: [PATCH 5/6] ci/nix-build: Use arm-native-runner for kvm builds on aarch64-linux blacksmith does not support nested virt on aarch64 hosts so we need an alternative. --- nix/packages/github-matrix/github_matrix.py | 2 +- nix/packages/github-matrix/tests/test_github_matrix.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nix/packages/github-matrix/github_matrix.py b/nix/packages/github-matrix/github_matrix.py index ec4f618d1d..3053cfcc79 100755 --- a/nix/packages/github-matrix/github_matrix.py +++ b/nix/packages/github-matrix/github_matrix.py @@ -258,7 +258,7 @@ class Specs(NamedTuple): case (True, _, "darwin", "aarch64"): return {"group": "self-hosted-runners-nix", "labels": ["aarch64-darwin"]} case (True, _, "linux", "aarch64"): - specs = Specs(16, "ubuntu-2404-arm") + return {"labels": ["arm-native-runner"]} case (True, _, "linux", "x86_64"): specs = Specs(16, "ubuntu-2404") diff --git a/nix/packages/github-matrix/tests/test_github_matrix.py b/nix/packages/github-matrix/tests/test_github_matrix.py index f2a6b14dd8..a4192826fd 100644 --- a/nix/packages/github-matrix/tests/test_github_matrix.py +++ b/nix/packages/github-matrix/tests/test_github_matrix.py @@ -132,7 +132,7 @@ class TestGetRunnerForPackage: ( "aarch64-linux", "kvm", - {"labels": ["blacksmith-16vcpu-ubuntu-2404-arm"]}, + {"labels": ["arm-native-runner"]}, ), ( "aarch64-linux", From bc1958eebe563b6be0cd1cbb0a32234f899f4f88 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Tue, 28 Jul 2026 13:14:15 -0400 Subject: [PATCH 6/6] DNM: quick test --- .../actions/nix-install-ephemeral/action.yml | 99 +-------- .../nix-install-ephemeral/setup-nix.sh | 72 +++++++ .github/workflows/nix-build.yml | 204 +----------------- 3 files changed, 86 insertions(+), 289 deletions(-) create mode 100755 .github/actions/nix-install-ephemeral/setup-nix.sh diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index c5ec007eee..e925997014 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -12,7 +12,7 @@ inputs: runs: using: 'composite' steps: - - name: aws-creds + - name: configure aws credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 if: ${{ inputs.push-to-cache == 'true' }} with: @@ -20,95 +20,16 @@ runs: aws-region: ${{ inputs.aws-region }} output-credentials: true role-duration-seconds: 7200 - - name: Ensure /etc/nix exists + - name: setup nix shell: bash - run: sudo mkdir -p /etc/nix - - name: Setup AWS credentials for Nix - if: ${{ inputs.push-to-cache == 'true' }} - shell: bash - run: | - mkdir -p ~/.aws - cat > ~/.aws/config < ~/.aws/credentials </dev/null - sudo tee /etc/nix/upload-to-cache.sh >/dev/null <<'EOF' - #!/usr/bin/env bash - set -euo pipefail - set -f - - export IFS=' ' - /nix/var/nix/profiles/default/bin/nix copy --max-jobs 5 --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' $OUT_PATHS - EOF - sudo chmod +x /etc/nix/upload-to-cache.sh - cat /etc/nix/upload-to-cache.sh - - name: Install Nix - shell: bash - run: | - if ! systemd-detect-virt --container --quiet; then - # *not* running in a container, assume vm and install multi-user mode - daemon=--daemon - nixconfdir=/etc/nix - path=/nix/var/nix/profiles/default/bin - tmpconf=/tmp/nix-extra.conf - - echo 'access-tokens = github.com=${{ github.token }}' | sudo tee $nixconfdir/github.nix.conf >/dev/null - sudo chmod 400 $nixconfdir/github.nix.conf - else - # *am* running in a container install single-user mode - daemon=--no-daemon - nixconfdir=$HOME/.config/nix - path=$HOME/.nix-profile/bin - tmpconf=$nixconfdir/nix.conf # --nix-extra-conf-files is ignored for single-user installs - - mkdir -p "$(dirname $tmpconf)" - echo 'access-tokens = github.com=${{ github.token }}' | tee $nixconfdir/github.nix.conf >/dev/null - chmod 400 $nixconfdir/github.nix.conf - fi - - cat >$tmpconf <<'NIXCONF' - always-allow-substitutes = true - extra-experimental-features = flakes nix-command - extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com - extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= - max-jobs = 4 - NIXCONF - - - if [[ -e /dev/kvm ]]; then - echo 'extra-system-features = kvm' >>$tmpconf - fi - - if [[ "${{ inputs.push-to-cache }}" == true ]]; then - echo 'post-build-hook = /etc/nix/upload-to-cache.sh' >>$tmpconf - fi - - echo "!include $nixconfdir/github.nix.conf" >>$tmpconf - - curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- $daemon --yes --nix-extra-conf-file $tmpconf - - sudo cat $nixconfdir/nix.conf - - # Add nix to PATH for subsequent steps - echo "$path" >> "$GITHUB_PATH" + run: >- + sudo + --preserve-env=AWS_ACCESS_KEY_ID,AWS_REGION,AWS_SECRET_ACCESS_KEY,AWS_SESSION_TOKEN,GITHUB_PATH,GITHUB_TOKEN,NIX_SIGN_SECRET,PUSH_TO_CACHE + ${{ github.action_path }}/setup-nix.sh + env: + AWS_REGION: ${{ inputs.aws-region }} + PUSH_TO_CACHE: ${{ inputs.push-to-cache == 'true' }} + NIX_SIGN_SECRET_KEY: ${{ env.NIX_SIGN_SECRET_KEY }} - name: Print Nix version shell: bash run: nix --version - - name: Setup KVM permissions - shell: bash - run: | - if [ -e /dev/kvm ]; then - sudo chown runner /dev/kvm - sudo chmod 666 /dev/kvm - echo "KVM configured: $(ls -l /dev/kvm)" - else - echo "KVM device not available" - fi diff --git a/.github/actions/nix-install-ephemeral/setup-nix.sh b/.github/actions/nix-install-ephemeral/setup-nix.sh new file mode 100755 index 0000000000..d168ee676a --- /dev/null +++ b/.github/actions/nix-install-ephemeral/setup-nix.sh @@ -0,0 +1,72 @@ +#!/usr/bin/env bash + +set -euo pipefail + +if ! systemd-detect-virt --container --quiet; then + # *not* running in a container, assume vm and install multi-user mode + daemon=--daemon + nixconfdir=/etc/nix + path=/nix/var/nix/profiles/default/bin + tmpconf=/tmp/nix-extra.conf +else + # *am* running in a container install single-user mode + daemon=--no-daemon + nixconfdir=$HOME/.config/nix + path=$HOME/.nix-profile/bin + tmpconf=$nixconfdir/nix.conf # --nix-extra-conf-files is ignored for single-user installs +fi + +mkdir -p "$nixconfdir" +echo "access-tokens = github.com=${GITHUB_TOKEN:?}" | tee "$nixconfdir/github.nix.conf" >/dev/null +chmod 400 "$nixconfdir/github.nix.conf" + +cat >"$tmpconf" <<-EOF + always-allow-substitutes = true + extra-experimental-features = flakes nix-command + extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com + extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= + max-jobs = 5 + !include $nixconfdir/github.nix.conf +EOF + +if [[ -e /dev/kvm ]]; then + chown runner /dev/kvm + chmod 666 /dev/kvm + echo "KVM configured: $(ls -l /dev/kvm)" + echo 'extra-system-features = kvm' >>"$tmpconf" +else + echo "KVM device not available" +fi + +if [[ ${PUSH_TO_CACHE:?} == true ]]; then + echo setup push to cache + mkdir -p ~/.aws + cat >~/.aws/config <<-EOF + [default] + region = ${AWS_REGION:?} + EOF + cat >~/.aws/credentials <<-EOF + [default] + aws_access_key_id = ${AWS_ACCESS_KEY_ID:?} + aws_secret_access_key = ${AWS_SECRET_ACCESS_KEY:?} + aws_session_token = ${AWS_SESSION_TOKEN:?} + EOF + set -x + printenv NIX_SIGN_SECRET_KEY | tee "$nixconfdir/nix-secret-key" >/dev/null + tee "$nixconfdir/upload-to-cache.sh" >/dev/null <<-EOF + #!/usr/bin/env bash + set -euo pipefail + set -f + + export IFS=' ' + $path/nix copy --max-jobs 5 --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' \$OUT_PATHS + EOF + chmod +x "$nixconfdir/upload-to-cache.sh" + echo "post-build-hook = $nixconfdir/upload-to-cache.sh" >>"$tmpconf" +fi + +curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- $daemon --yes --nix-extra-conf-file "$tmpconf" +cat "$nixconfdir/nix.conf" + +# Add nix to PATH for subsequent steps +echo "$path" >>"${GITHUB_PATH:?}" diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index 23466caf1e..5d8eb58f54 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -19,217 +19,21 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: - nix-eval: - uses: ./.github/workflows/nix-eval.yml - secrets: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - nix-build-packages-aarch64-linux: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (aarch64-linux) - needs: nix-eval - runs-on: ${{ matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_linux != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_linux }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - nix-build-checks-aarch64-linux: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (aarch64-linux) - needs: - - nix-eval - - nix-build-packages-aarch64-linux - runs-on: ${{ matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_linux != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_linux }} + name: vm-test-run-pg_hashids (aarch64-linux) + runs-on: arm-native-runner steps: - name: Checkout Repo - if: ${{ matrix.attr != '' }} uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Install nix - if: ${{ matrix.attr != '' }} uses: ./.github/actions/nix-install-ephemeral with: push-to-cache: 'true' env: DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} + GITHUB_TOKEN: ${{env.GITHUB_TOKEN}} - name: nix build - if: ${{ matrix.attr != '' }} uses: ./.github/actions/nix-build-retry with: - attr: .#${{ matrix.attr }} - - nix-build-packages-aarch64-darwin: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (aarch64-darwin) - needs: nix-eval - runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_darwin != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_darwin }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix (ephemeral) - if: ${{ matrix.attr != '' && matrix.runs_on.group != 'self-hosted-runners-nix' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: Install nix (self-hosted) - if: ${{ matrix.attr != '' && matrix.runs_on.group == 'self-hosted-runners-nix' }} - uses: ./.github/actions/nix-install-self-hosted - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - - nix-build-checks-aarch64-darwin: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (aarch64-darwin) - needs: - - nix-eval - - nix-build-packages-aarch64-darwin - runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_darwin != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_darwin }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - - nix-build-packages-x86_64-linux: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (x86_64-linux) - needs: nix-eval - runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).x86_64_linux != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).x86_64_linux }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - - nix-build-checks-x86_64-linux: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (x86_64-linux) - needs: - - nix-eval - - nix-build-packages-x86_64-linux - runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).x86_64_linux != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).x86_64_linux }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - - run-testinfra: - needs: - - nix-eval - - nix-build-packages-aarch64-linux - - nix-build-packages-aarch64-darwin - - nix-build-packages-x86_64-linux - uses: ./.github/workflows/testinfra-ami-build.yml - secrets: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - run-tests: - needs: - - nix-eval - - nix-build-packages-aarch64-linux - - nix-build-packages-aarch64-darwin - - nix-build-packages-x86_64-linux - uses: ./.github/workflows/test.yml - - docker-image-test: - needs: nix-build-packages-aarch64-linux - uses: ./.github/workflows/docker-image-test.yml - secrets: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} + attr: .#vm-test-run-pg_hashids