Skip to content

Commit 917e43c

Browse files
jchancojrjchancojr
authored
Merge branch 'develop' into INDATA-152
2 parents b811ef4 + 79cbab5 commit 917e43c

23 files changed

+156
-121
lines changed

‎.github/actionlint.yml‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎.github/actions/nix-install-ephemeral/action.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: 'Install Nix on ephemeral runners'
2+
description: 'Installs Nix and sets up AWS credentials to push to the Nix binary cache'
3+
inputs:
4+
push-to-cache:
5+
description: 'Whether to push build outputs to the Nix binary cache'
6+
required: false
7+
default: 'false'
8+
runs:
9+
using: 'composite'
10+
steps:
11+
- name: aws-creds
12+
uses: aws-actions/configure-aws-credentials@v4
13+
if: ${{ inputs.push-to-cache == 'true' }}
14+
with:
15+
role-to-assume: ${{ env.DEV_AWS_ROLE }}
16+
aws-region: "us-east-1"
17+
output-credentials: true
18+
role-duration-seconds: 7200
19+
- name: Setup AWS credentials for Nix
20+
if: ${{ inputs.push-to-cache == 'true' }}
21+
shell: bash
22+
run: |
23+
sudo -H aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
24+
sudo -H aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
25+
sudo -H aws configure set aws_session_token $AWS_SESSION_TOKEN
26+
sudo mkdir -p /etc/nix
27+
sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
28+
cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null
29+
#!/usr/bin/env bash
30+
set -euo pipefail
31+
set -f
32+
33+
export IFS=' '
34+
/nix/var/nix/profiles/default/bin/nix copy --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' $OUT_PATHS
35+
EOF
36+
sudo chmod +x /etc/nix/upload-to-cache.sh
37+
env:
38+
NIX_SIGN_SECRET_KEY: ${{ env.NIX_SIGN_SECRET_KEY }}
39+
- name: Install nix
40+
uses: cachix/install-nix-action@v31
41+
with:
42+
install_url: https://releases.nixos.org/nix/nix-2.32.2/install
43+
extra_nix_config: |
44+
substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
45+
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
46+
${{ inputs.push-to-cache == 'true' && 'post-build-hook = /etc/nix/upload-to-cache.sh' || '' }}

‎.github/workflows/ami-release-nix.yml‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
id: set-versions
3737
run: |
3838
VERSIONS=$(nix run nixpkgs#yq -- '.postgres_major[]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c 'split("\n")[:-1]')
39-
echo "postgres_versions=$VERSIONS" >> "$GITHUB_OUTPUT"
39+
echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
4040
4141
build:
4242
needs: prepare
@@ -67,21 +67,25 @@ jobs:
6767
substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
6868
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
6969
70+
- name: Run checks if triggered manually
71+
if: ${{ github.event_name == 'workflow_dispatch' }}
72+
run: |
73+
SUFFIX=$(nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
74+
if [[ -z "$SUFFIX" ]] ; then
75+
echo "Version must include non-numeric characters if built manually."
76+
exit 1
77+
fi
78+
7079
- name: Set PostgreSQL version environment variable
7180
run: |
72-
echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> "$GITHUB_ENV"
73-
echo "EXECUTION_ID=${{ github.run_id }}-${{ matrix.postgres_version }}" >> "$GITHUB_ENV"
81+
echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV
82+
echo "EXECUTION_ID=${{ github.run_id }}-${{ matrix.postgres_version }}" >> $GITHUB_ENV
7483
7584
- name: Generate common-nix.vars.pkr.hcl
7685
run: |
77-
PG_VERSION="$(nix run nixpkgs#yq -- -r '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)"
78-
BRANCH_NAME="$(echo "${{ github.ref }}" | sed 's|refs/heads/||')"
79-
if [[ "${{ github.event_name }}" == "workflow_dispatch" && "$BRANCH_NAME" != "develop" && "$BRANCH_NAME" != release/* ]]; then
80-
SUFFIX="${BRANCH_NAME//[^a-zA-Z0-9._-]/-}-${{ github.run_id }}"
81-
PG_VERSION="${PG_VERSION}-${SUFFIX}"
82-
echo "Added branch suffix to version: $SUFFIX"
83-
fi
84-
echo "postgres-version = \"$PG_VERSION\"" > common-nix.vars.pkr.hcl
86+
PG_VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
87+
PG_VERSION=$(echo "$PG_VERSION" | tr -d '"') # Remove any surrounding quotes
88+
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
8589
# Ensure there's a newline at the end of the file
8690
echo "" >> common-nix.vars.pkr.hcl
8791
@@ -106,9 +110,8 @@ jobs:
106110
- name: Grab release version
107111
id: process_release_version
108112
run: |
109-
VERSION=$(sed -e 's/postgres-version = "\(.*\)"/\1/g' common-nix.vars.pkr.hcl)
110-
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
111-
echo "::notice title=AMI Published::Postgres AMI version: $VERSION"
113+
VERSION=$(cat common-nix.vars.pkr.hcl | sed -e 's/postgres-version = "\(.*\)"/\1/g')
114+
echo "version=$VERSION" >> $GITHUB_OUTPUT
112115
113116
- name: Create nix flake revision tarball
114117
run: |

‎.github/workflows/dockerhub-release-matrix.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
outputs:
2121
matrix_config: ${{ steps.set-matrix.outputs.matrix_config }}
2222
steps:
23-
- uses: DeterminateSystems/nix-installer-action@main
23+
- uses: ./.github/actions/nix-install-ephemeral
2424
- name: Checkout Repo
2525
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
2626
- name: Generate build matrix
@@ -55,7 +55,7 @@ jobs:
5555
steps:
5656
- name: Checkout Repo
5757
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
58-
- uses: DeterminateSystems/nix-installer-action@main
58+
- uses: ./.github/actions/nix-install-ephemeral
5959
- name: Set PostgreSQL version environment variable
6060
run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV
6161

@@ -80,7 +80,7 @@ jobs:
8080
steps:
8181
- name: Checkout Repo
8282
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
83-
- uses: DeterminateSystems/nix-installer-action@main
83+
- uses: ./.github/actions/nix-install-ephemeral
8484
- run: docker context create builders
8585
- uses: docker/setup-buildx-action@v3
8686
with:
@@ -136,7 +136,7 @@ jobs:
136136
steps:
137137
- name: Checkout Repo
138138
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
139-
- uses: DeterminateSystems/nix-installer-action@main
139+
- uses: ./.github/actions/nix-install-ephemeral
140140
- uses: docker/setup-buildx-action@v3
141141
- uses: docker/login-action@v2
142142
with:
@@ -180,7 +180,7 @@ jobs:
180180
steps:
181181
- name: Checkout Repo
182182
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
183-
- uses: DeterminateSystems/nix-installer-action@main
183+
- uses: ./.github/actions/nix-install-ephemeral
184184

185185
- name: Debug Input from Prepare
186186
run: |

‎.github/workflows/manual-docker-release.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
outputs:
1818
matrix_config: ${{ steps.set-matrix.outputs.matrix_config }}
1919
steps:
20-
- uses: DeterminateSystems/nix-installer-action@main
20+
- uses: ./.github/actions/nix-install-ephemeral
2121
- name: Checkout Repo
2222
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
2323
- name: Generate build matrix
@@ -52,7 +52,7 @@ jobs:
5252
steps:
5353
- name: Checkout Repo
5454
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
55-
- uses: DeterminateSystems/nix-installer-action@main
55+
- uses: ./.github/actions/nix-install-ephemeral
5656
- name: Set PostgreSQL version environment variable
5757
run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV
5858

@@ -77,7 +77,7 @@ jobs:
7777
steps:
7878
- name: Checkout Repo
7979
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
80-
- uses: DeterminateSystems/nix-installer-action@main
80+
- uses: ./.github/actions/nix-install-ephemeral
8181
- run: docker context create builders
8282
- uses: docker/setup-buildx-action@v3
8383
with:
@@ -145,7 +145,7 @@ jobs:
145145
steps:
146146
- name: Checkout Repo
147147
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
148-
- uses: DeterminateSystems/nix-installer-action@main
148+
- uses: ./.github/actions/nix-install-ephemeral
149149
- uses: docker/setup-buildx-action@v3
150150
- uses: docker/login-action@v2
151151
with:
@@ -189,7 +189,7 @@ jobs:
189189
steps:
190190
- name: Checkout Repo
191191
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
192-
- uses: DeterminateSystems/nix-installer-action@main
192+
- uses: ./.github/actions/nix-install-ephemeral
193193

194194
- name: Debug Input from Prepare
195195
run: |

‎.github/workflows/nix-build.yml‎

Lines changed: 5 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -35,54 +35,12 @@ jobs:
3535
steps:
3636
- name: Checkout Repo
3737
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
38-
- name: aws-creds
39-
uses: aws-actions/configure-aws-credentials@v4
40-
if: ${{ github.secret_source == 'Actions' }}
38+
- uses: ./.github/actions/nix-install-ephemeral
4139
with:
42-
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
43-
aws-region: "us-east-1"
44-
output-credentials: true
45-
role-duration-seconds: 7200
46-
- name: Setup AWS credentials for Nix
47-
if: ${{ github.secret_source == 'Actions' }}
48-
run: |
49-
sudo -H aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
50-
sudo -H aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
51-
sudo -H aws configure set aws_session_token $AWS_SESSION_TOKEN
52-
- name: write secret key
53-
# use python so we don't interpolate the secret into the workflow logs, in case of bugs
54-
run: |
55-
sudo mkdir -p /etc/nix
56-
sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
40+
push-to-cache: ${{ github.secret_source == 'Actions' && 'true' || 'false' }}
5741
env:
42+
DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
5843
NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
59-
- name: Setup cache script
60-
if: ${{ github.secret_source == 'Actions' }}
61-
run: |
62-
cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null
63-
#!/usr/bin/env bash
64-
set -euf
65-
export IFS=' '
66-
/nix/var/nix/profiles/default/bin/nix copy --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' $OUT_PATHS
67-
EOF
68-
sudo chmod +x /etc/nix/upload-to-cache.sh
69-
- name: Install nix
70-
uses: cachix/install-nix-action@v27
71-
if: ${{ github.secret_source == 'Actions' }}
72-
with:
73-
install_url: https://releases.nixos.org/nix/nix-2.29.1/install
74-
extra_nix_config: |
75-
substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
76-
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
77-
post-build-hook = /etc/nix/upload-to-cache.sh
78-
- name: Install nix
79-
uses: cachix/install-nix-action@v27
80-
if: ${{ github.secret_source == 'None' }}
81-
with:
82-
install_url: https://releases.nixos.org/nix/nix-2.29.1/install
83-
extra_nix_config: |
84-
substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
85-
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
8644
- name: Aggressive disk cleanup for DuckDB build
8745
if: matrix.runner == 'macos-latest-xlarge'
8846
run: |
@@ -108,7 +66,8 @@ jobs:
10866
sudo rm -rf /tmp/* 2>/dev/null || true
10967
echo "=== AFTER CLEANUP ==="
11068
df -h
111-
- name: Build psql bundle
69+
-
70+
name: Build psql bundle
11271
run: >
11372
nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48"
11473
-- --skip-cached --no-nom ${{ matrix.runner == 'macos-latest-xlarge' && '--max-jobs 1' || '' }}

‎.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
- name: Checkout Repo
2020
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
2121

22-
- uses: DeterminateSystems/nix-installer-action@main
22+
- uses: ./.github/actions/nix-install-ephemeral
2323

2424
- name: Set PostgreSQL versions
2525
id: set-versions
@@ -38,7 +38,7 @@ jobs:
3838
- name: Checkout Repo
3939
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
4040

41-
- uses: DeterminateSystems/nix-installer-action@main
41+
- uses: ./.github/actions/nix-install-ephemeral
4242

4343
- name: Grab release version
4444
id: process_release_version

‎.github/workflows/publish-nix-pgupgrade-scripts.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
- name: Checkout Repo
2727
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
2828

29-
- uses: DeterminateSystems/nix-installer-action@main
29+
- uses: ./.github/actions/nix-install-ephemeral
3030

3131
- name: Set PostgreSQL versions
3232
id: set-versions
@@ -45,7 +45,7 @@ jobs:
4545
- name: Checkout Repo
4646
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
4747

48-
- uses: DeterminateSystems/nix-installer-action@main
48+
- uses: ./.github/actions/nix-install-ephemeral
4949

5050
- name: Grab release version
5151
id: process_release_version
@@ -96,8 +96,8 @@ jobs:
9696
- name: Checkout Repo
9797
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
9898

99-
- uses: DeterminateSystems/nix-installer-action@main
100-
99+
- uses: ./.github/actions/nix-install-ephemeral
100+
101101
- name: Grab release version
102102
id: process_release_version
103103
run: |

‎.github/workflows/qemu-image-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848
- name: Checkout Repo
4949
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
5050

51-
- uses: DeterminateSystems/nix-installer-action@main
51+
- uses: ./.github/actions/nix-install-ephemeral
5252

5353
- name: Run checks if triggered manually
5454
if: ${{ github.event_name == 'workflow_dispatch' }}

‎.github/workflows/test.yml‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,7 @@ jobs:
1515
steps:
1616
- name: Checkout Repo
1717
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
18-
- uses: DeterminateSystems/nix-installer-action@main
19-
with:
20-
extra-conf: |
21-
substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
22-
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
18+
- uses: ./.github/actions/nix-install-ephemeral
2319
- name: Set PostgreSQL versions
2420
id: set-versions
2521
run: |
@@ -43,11 +39,7 @@ jobs:
4339
steps:
4440
- name: Checkout Repo
4541
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
46-
- uses: DeterminateSystems/nix-installer-action@main
47-
with:
48-
extra-conf: |
49-
substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
50-
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
42+
- uses: ./.github/actions/nix-install-ephemeral
5143
- name: Set PostgreSQL version environment variable
5244
run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV
5345
- name: Strip quotes from pg major and set env var

0 commit comments

Comments
 (0)