From 3500ff0e484f809678f993a80a48b75e4f5a3f81 Mon Sep 17 00:00:00 2001 From: Hakula Chen Date: Sun, 1 Nov 2026 18:52:35 +0800 Subject: [PATCH 1/4] ci(release): retain pinned Nix packages in Cachix --- .github/workflows/release.yml | 43 +++++++++++++++++++++++++++++++++-- RELEASING.md | 2 ++ 2 files changed, 43 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4bd8e69b5..ed027f254 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -206,10 +206,42 @@ jobs: if-no-files-found: error overwrite: true + nix: + name: Pin Nix package (${{ matrix.system }}) + if: github.ref_type == 'tag' && !inputs.notes + needs: tagged-ci + runs-on: ${{ matrix.runner }} + timeout-minutes: 40 + strategy: + fail-fast: false + matrix: + include: + - system: x86_64-linux + runner: ubuntu-latest + - system: aarch64-darwin + runner: macos-latest + steps: + - name: Checkout + uses: actions/checkout@v7 + + - name: Set up Nix + uses: ./.github/actions/setup-nix + with: + cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }} + + - name: Build and pin package + env: + CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} + SYSTEM: ${{ matrix.system }} + run: | + out=$(nix build --no-link --print-out-paths) + cachix push hakula "$out" + cachix pin hakula "oxide-code-${GITHUB_REF_NAME}-${SYSTEM}" "$out" --keep-revisions 1 + publish: name: Publish GitHub Release if: github.ref_type == 'tag' - needs: [tagged-ci, build] + needs: [tagged-ci, build, nix] runs-on: ubuntu-latest timeout-minutes: 10 permissions: @@ -248,7 +280,14 @@ jobs: options+=(--prerelease) fi - gh release create "$GITHUB_REF_NAME" release-assets/* "${options[@]}" + gh release create "$GITHUB_REF_NAME" \ + release-assets/oxide-code-x86_64-unknown-linux-gnu.tar.gz \ + release-assets/oxide-code-x86_64-unknown-linux-gnu.tar.gz.sha256 \ + release-assets/oxide-code-aarch64-apple-darwin.tar.gz \ + release-assets/oxide-code-aarch64-apple-darwin.tar.gz.sha256 \ + release-assets/oxide-code-x86_64-pc-windows-msvc.zip \ + release-assets/oxide-code-x86_64-pc-windows-msvc.zip.sha256 \ + "${options[@]}" formula: name: Check Homebrew Formula diff --git a/RELEASING.md b/RELEASING.md index e94a4ed6f..db5300088 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -2,6 +2,8 @@ Pushing a tag that matches `v[0-9]+.*` starts `.github/workflows/release.yml`, which waits for a passing CI run on the tagged commit, builds and checks every target, and publishes a GitHub Release with the tag's `CHANGELOG.md` section as its notes. A tag with a prerelease suffix, such as `v0.1.0-rc.1`, publishes a prerelease. +Before publication, the workflow pushes the flake's x86_64 Linux and Apple Silicon macOS packages to the `hakula` Cachix cache and pins each as `oxide-code--` to retain its closure. + ## Versioning - **Through 0.1.0:** tag `v0.1.0-alpha.N` from `main` whenever a user-visible batch or a fix for shipped behavior lands. Once only the release gates remain open in the [`v0.1.0` milestone](https://github.com/hakula139/oxide-code/milestone/1), tag `v0.1.0-rc.1`. There is no beta stage. From 49f6710d5e830121dd95456871cf2bdb6ad9800c Mon Sep 17 00:00:00 2001 From: Hakula Chen Date: Sun, 1 Nov 2026 18:55:06 +0800 Subject: [PATCH 2/4] ci(nix): share release cache publication with tag repair --- .github/workflows/nix-cache.yml | 55 +++++++++++++++++++++++++++++++++ .github/workflows/release.yml | 34 ++++---------------- RELEASING.md | 2 ++ 3 files changed, 63 insertions(+), 28 deletions(-) create mode 100644 .github/workflows/nix-cache.yml diff --git a/.github/workflows/nix-cache.yml b/.github/workflows/nix-cache.yml new file mode 100644 index 000000000..b401194ac --- /dev/null +++ b/.github/workflows/nix-cache.yml @@ -0,0 +1,55 @@ +name: Nix Cache + +on: + workflow_call: + inputs: + tag: + description: Tag whose Nix packages to retain in Cachix + type: string + required: true + secrets: + CACHIX_AUTH_TOKEN: + required: true + workflow_dispatch: + inputs: + tag: + description: Tag whose Nix packages to retain in Cachix + type: string + required: true + +permissions: + contents: read + +jobs: + publish: + name: Pin (${{ matrix.system }}) + runs-on: ${{ matrix.runner }} + timeout-minutes: 40 + strategy: + fail-fast: false + matrix: + include: + - system: x86_64-linux + runner: ubuntu-latest + - system: aarch64-darwin + runner: macos-latest + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + ref: refs/tags/${{ inputs.tag }} + + - name: Set up Nix + uses: ./.github/actions/setup-nix + with: + cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }} + + - name: Build and pin package + env: + CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} + TAG: ${{ inputs.tag }} + SYSTEM: ${{ matrix.system }} + run: | + out=$(nix build --no-link --print-out-paths) + cachix push hakula "$out" + cachix pin hakula "oxide-code-${TAG}-${SYSTEM}" "$out" --keep-revisions 1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ed027f254..fc8676003 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -207,36 +207,14 @@ jobs: overwrite: true nix: - name: Pin Nix package (${{ matrix.system }}) + name: Pin Nix packages if: github.ref_type == 'tag' && !inputs.notes needs: tagged-ci - runs-on: ${{ matrix.runner }} - timeout-minutes: 40 - strategy: - fail-fast: false - matrix: - include: - - system: x86_64-linux - runner: ubuntu-latest - - system: aarch64-darwin - runner: macos-latest - steps: - - name: Checkout - uses: actions/checkout@v7 - - - name: Set up Nix - uses: ./.github/actions/setup-nix - with: - cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }} - - - name: Build and pin package - env: - CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} - SYSTEM: ${{ matrix.system }} - run: | - out=$(nix build --no-link --print-out-paths) - cachix push hakula "$out" - cachix pin hakula "oxide-code-${GITHUB_REF_NAME}-${SYSTEM}" "$out" --keep-revisions 1 + uses: ./.github/workflows/nix-cache.yml + with: + tag: ${{ github.ref_name }} + secrets: + CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} publish: name: Publish GitHub Release diff --git a/RELEASING.md b/RELEASING.md index db5300088..e01e2fc9d 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -4,6 +4,8 @@ Pushing a tag that matches `v[0-9]+.*` starts `.github/workflows/release.yml`, w Before publication, the workflow pushes the flake's x86_64 Linux and Apple Silicon macOS packages to the `hakula` Cachix cache and pins each as `oxide-code--` to retain its closure. +To restore a published tag's cache pin, run `gh workflow run nix-cache.yml -f tag=vX.Y.Z`. + ## Versioning - **Through 0.1.0:** tag `v0.1.0-alpha.N` from `main` whenever a user-visible batch or a fix for shipped behavior lands. Once only the release gates remain open in the [`v0.1.0` milestone](https://github.com/hakula139/oxide-code/milestone/1), tag `v0.1.0-rc.1`. There is no beta stage. From 3eb8aae63a5b46b111de9e017123b9fe3e167390 Mon Sep 17 00:00:00 2001 From: Hakula Chen Date: Sun, 1 Nov 2026 19:01:18 +0800 Subject: [PATCH 3/4] fix(release): require the emitted checksum sidecar names --- .github/workflows/release.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fc8676003..2eeaeb508 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -260,11 +260,11 @@ jobs: gh release create "$GITHUB_REF_NAME" \ release-assets/oxide-code-x86_64-unknown-linux-gnu.tar.gz \ - release-assets/oxide-code-x86_64-unknown-linux-gnu.tar.gz.sha256 \ + release-assets/oxide-code-x86_64-unknown-linux-gnu.sha256 \ release-assets/oxide-code-aarch64-apple-darwin.tar.gz \ - release-assets/oxide-code-aarch64-apple-darwin.tar.gz.sha256 \ + release-assets/oxide-code-aarch64-apple-darwin.sha256 \ release-assets/oxide-code-x86_64-pc-windows-msvc.zip \ - release-assets/oxide-code-x86_64-pc-windows-msvc.zip.sha256 \ + release-assets/oxide-code-x86_64-pc-windows-msvc.sha256 \ "${options[@]}" formula: From 6b00631f421d21a1c3b9cab697ca27556af3b655 Mon Sep 17 00:00:00 2001 From: Hakula Chen Date: Sun, 1 Nov 2026 19:04:56 +0800 Subject: [PATCH 4/4] style(ci): match the shared Cachix publication convention --- .github/workflows/nix-cache.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/nix-cache.yml b/.github/workflows/nix-cache.yml index b401194ac..e6782cd25 100644 --- a/.github/workflows/nix-cache.yml +++ b/.github/workflows/nix-cache.yml @@ -20,6 +20,9 @@ on: permissions: contents: read +env: + CACHIX_NAME: hakula + jobs: publish: name: Pin (${{ matrix.system }}) @@ -50,6 +53,6 @@ jobs: TAG: ${{ inputs.tag }} SYSTEM: ${{ matrix.system }} run: | - out=$(nix build --no-link --print-out-paths) - cachix push hakula "$out" - cachix pin hakula "oxide-code-${TAG}-${SYSTEM}" "$out" --keep-revisions 1 + store_path=$(nix build --no-link --print-out-paths --print-build-logs) + cachix push "$CACHIX_NAME" "$store_path" + cachix pin "$CACHIX_NAME" "oxide-code-${TAG}-${SYSTEM}" "$store_path" --keep-revisions 2