Garnix -> Github Actions

It's much easier for forks to use GHA than it is to sign up for another proprietary service.
I was annoyed by this myself when I forked nix-eval-jobs to nix-unit.

.github/workflows/nix-github-actions.yml

@@ -0,0 +1,60 @@
+name: Nix actions
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - staging
+      - release-*
+
+jobs:
+  nix-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v23
+      - id: set-matrix
+        name: Generate Nix Matrix
+        run: |
+          set -Eeu
+          echo "matrix=$(nix eval --json '.#githubActions.matrix')" >> "$GITHUB_OUTPUT"
+
+  nix-build:
+    needs: nix-matrix
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix: ${{fromJSON(needs.nix-matrix.outputs.matrix)}}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v23
+      - run: nix build -L ".#${{ matrix.attr }}"
+  tests:
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, macos-latest ]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+          # Nix Flakes doesn't work on shallow clones
+          fetch-depth: 0
+    - uses: cachix/install-nix-action@v23
+      with:
+        github_access_token: ${{ secrets.GITHUB_TOKEN }}
+        extra_nix_config: |
+          accept-flake-config = true
+    - name: Build
+      run: nix develop -c bash -c 'meson build && cd build && ninja'
+    - name: Run tests
+      run: nix develop -c pytest ./tests
+
+  collect:
+    runs-on: ubuntu-latest
+    needs:
+      - nix-build
+      - tests
+    steps:
+      - run: true

.github/workflows/tests.yml

@@ -1,28 +0,0 @@
-name: "Tests"
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-      - staging
-      - release-*
-jobs:
-  tests:
-    strategy:
-      matrix:
-        os: [ ubuntu-latest, macos-latest ]
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v4
-      with:
-          # Nix Flakes doesn't work on shallow clones
-          fetch-depth: 0
-    - uses: cachix/install-nix-action@v23
-      with:
-        github_access_token: ${{ secrets.GITHUB_TOKEN }}
-        extra_nix_config: |
-          accept-flake-config = true
-    - name: Build
-      run: nix develop -c bash -c 'meson build && cd build && ninja'
-    - name: Run tests
-      run: nix develop -c pytest ./tests

.mergify.yml

@@ -3,11 +3,13 @@ queue_rules:
     merge_conditions:
       - author=renovate[bot]
       - check-success=collect
+
 defaults:
   actions:
     queue:
       allow_merging_configuration_change: true
       method: rebase
+
 pull_request_rules:
   - name: merge using the merge queue
     conditions:

flake.lock

@@ -20,6 +20,26 @@
         "type": "github"
       }
     },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1698974481,
+        "narHash": "sha256-yPncV9Ohdz1zPZxYHQf47S8S0VrnhV7nNhCawY46hDA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "4bb5e752616262457bc7ca5882192a564c0472d2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1698977350,
@@ -39,6 +59,7 @@
     "root": {
       "inputs": {
         "flake-parts": "flake-parts",
+        "nix-github-actions": "nix-github-actions",
         "nixpkgs": "nixpkgs",
         "treefmt-nix": "treefmt-nix"
       }

flake.nix

@@ -6,13 +6,8 @@
   inputs.flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
   inputs.treefmt-nix.url = "github:numtide/treefmt-nix";
   inputs.treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
-
+  inputs.nix-github-actions.url = "github:nix-community/nix-github-actions";
-  nixConfig.extra-substituters = [
+  inputs.nix-github-actions.inputs.nixpkgs.follows = "nixpkgs";
-    "https://cache.garnix.io"
-  ];
-  nixConfig.extra-trusted-public-keys = [
-    "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
-  ];
 
   outputs = inputs @ { flake-parts, ... }:
     let
@@ -24,6 +19,14 @@
       {
         systems = inputs.nixpkgs.lib.systems.flakeExposed;
         imports = [ inputs.treefmt-nix.flakeModule ];
+
+        flake.githubActions = inputs.nix-github-actions.lib.mkGithubMatrix {
+          checks = {
+            inherit (self.checks) x86_64-linux;
+            x86_64-darwin = builtins.removeAttrs self.checks.x86_64-darwin [ "treefmt" ];
+          };
+        };
+
         perSystem = { pkgs, self', ... }:
           let
             drvArgs = {
@@ -37,6 +40,10 @@
             packages.clangStdenv-nix-eval-jobs = pkgs.callPackage ./default.nix (drvArgs // { stdenv = pkgs.clangStdenv; });
             packages.default = self'.packages.nix-eval-jobs;
             devShells.default = pkgs.callPackage ./shell.nix drvArgs;
+
+            checks = builtins.removeAttrs self'.packages [ "default" ] // {
+              shell = self'.devShells.default;
+            };
           };
       };
 }