switch to hercules ci

bors.toml

@@ -1,10 +1,5 @@
 cut_body_after = "" # don't include text from the PR body in the merge commit message
 status = [
-  # garnix
-  "Evaluate flake.nix",
-  "package netboot-nixos-2211 [x86_64-linux]",
-  "package kexec-installer-nixos-2211 [x86_64-linux]",
-  "package kexec-installer-nixos-unstable [x86_64-linux]",
-  "check kexec-installer-unstable [x86_64-linux]",
-  "package netboot-nixos-unstable [x86_64-linux]"
+  "ci/hercules/onPush/default",
+  "ci/hercules/evaluation",
 ]

build-images.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -p nix -p coreutils -p bash -p gh -i bash
+#!nix-shell -I nixpkgs=channel:nixos-unstable-small -p nix -p coreutils -p bash -p gh -i bash
 # shellcheck shell=bash
 set -xeuo pipefail
 shopt -s lastpipe
@@ -26,12 +26,14 @@ build_kexec_installer() {
 }
 
 main() {
-  declare -r tag=${1:-nixos-unstable} arch=${2:-x86_64-linux}
+  declare -r tag=$1
   tmp="$(mktemp -d)"
   trap 'rm -rf -- "$tmp"' EXIT
   (
-    build_kexec_installer "${tag}" "${arch}" "${tmp}"
-    build_netboot_image "${tag}" "${arch}" "${tmp}"
+    for arch in x86_64-linux aarch64-linux; do
+      build_kexec_installer "${tag}" "${arch}" "${tmp}"
+      build_netboot_image "${tag}" "${arch}" "${tmp}"
+    done
   ) | readarray -t assets
   for asset in "${assets[@]}"; do
     pushd "$(dirname "${asset}")"
@@ -40,9 +42,11 @@ main() {
   done
   assets+=("${TMP}/sha256sums")
 
+  cat "${TMP}/sha256sums"
+
   # Since we cannot atomically update a release, we delete the old one before
-  gh release delete "${tag}" </dev/null || true
-  gh release create --title "${tag} (build $(date +"%Y-%m-%d"))" "${tag}" "${assets[@]}" </dev/null
+  #gh release delete "${tag}" </dev/null || true
+  #gh release create --title "${tag} (build $(date +"%Y-%m-%d"))" "${tag}" "${assets[@]}" </dev/null
 }
 
 main "$@"

flake.nix

@@ -4,19 +4,44 @@
   inputs.nixos-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
   inputs.nixos-2211.url = "github:NixOS/nixpkgs/release-22.11";
 
+  inputs.hercules-ci-effects.url = "github:hercules-ci/hercules-ci-effects";
+  inputs.hercules-ci-effects.inputs.hercules-ci-agent.follows = "";
+  inputs.hercules-ci-effects.inputs.nixpkgs.follows = "nixos-unstable";
+
   nixConfig.extra-substituters = [
-    "https://cache.garnix.io"
+    "https://nix-community.cachix.org"
   ];
   nixConfig.extra-trusted-public-keys = [
-    "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+    "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
   ];
 
-  outputs = { self, nixos-unstable, nixos-2211 }:
+  outputs = { self, nixos-unstable, nixos-2211, hercules-ci-effects, ... }:
     let
       supportedSystems = [ "aarch64-linux" "x86_64-linux" ];
       forAllSystems = nixos-unstable.lib.genAttrs supportedSystems;
     in
     {
+      effects = { src ? { ref = null; }, ... }:
+        let
+          pkgs = nixos-unstable.legacyPackages.x86_64-linux;
+          hciEffects = hercules-ci-effects.lib.withPkgs pkgs;
+        in
+        {
+          release = hciEffects.runIf (src.ref != "refs/heads/master") (
+            hciEffects.mkEffect {
+              name = "release";
+              inputs = with pkgs; [ nix ];
+              src = pkgs.lib.cleanSource ./.;
+              secretsMap.githubToken = { type = "GitToken"; };
+              effectScript = ''
+                export GH_TOKEN="$(readSecretString githubToken .token)"
+                nix-shell build-images.sh nixos-unstable
+                nix-shell build-images.sh nixos-21.11
+              '';
+            }
+          );
+        };
+
       packages = forAllSystems (system:
         let
           netboot = nixpkgs: (import (nixpkgs + "/nixos/release.nix") { }).netboot.${system};