build-prod.yaml

# © Crown Copyright GCHQ
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Build for production
concurrency:
  group: production
  cancel-in-progress: true
on:
  push:
    branches:
      - main
jobs:
  build-nix-bootstrap:
    name: Build nix-bootstrap
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: cachix/install-nix-action@v18
        with:
          nix_path: "nixpkgs=channel:nixpkgs-unstable"
      - name: Check version number has been updated
        run: >
          (git fetch --all && git diff "$(git describe --tags --abbrev=0)" -- package.yaml | grep version) ||
          (echo "You must bump the nix-bootstrap version number in package.yaml!" && exit 1)
      - name: Get new version number
        run: echo "version_number=$(grep -E '^version' package.yaml | cut -d' ' -f2)" >> $GITHUB_ENV
      - name: Run pre-commit hooks
        run: nix build '.#runChecks'
      - name: Build nix-bootstrap
        run: nix build
      - name: Check for vulnerabilities
        run: nix run .\#ciPackages.vulnix -- -C -w vulnerability-whitelist.toml result/
      - name: Build release artefact
        run: nix run .\#ciPackages.buildBinaryCache
      - uses: actions/upload-artifact@v4
        with:
          name: "release-${{ env.version_number }}"
          path: releases/
      - uses: rickstaa/action-create-tag@v1
        with:
          tag: "${{ env.version_number }}"
          message: "Release version ${{ env.version_number }}"
      - name: Create release
        run: >
          printf '%s %s -r %s -t %s %s releases/' '-u' "$GITHUB_REPOSITORY_OWNER" "${GITHUB_REPOSITORY#*/}"
          "${{ secrets.GITHUB_TOKEN }}" "${{ env.version_number }}" | xargs -d ' ' nix run nixpkgs\#legacyPackages.x86_64-linux.ghr --