claude@clouddev1
60dbb903cc
- Add `cargo test` before the darwin builds (gate is Linux-only; the macOS leg is test-then-build) — a full dry-run of release-macos bar the upload. - Add an `if: always()` prune step. The runner wipes the workspace each run, so cargo target/ never accumulates (no sweep). The persistent cache is the nix store: record the current toolchain in a persistent profile, keep the 2 newest generations (nix-env --delete-generations +2), reclaim the rest (nix-collect-garbage). Pairs with min-free/max-free in the runner nix.conf.
82 lines
3.8 KiB
YAML
82 lines
3.8 KiB
YAML
# THROWAWAY build smoke-test for the macOS (Tart) runner. Verifies both
|
|
# *-apple-darwin targets actually compile and link (incl. arboard's AppKit)
|
|
# through the flake on the real Mac, before the full release-macos workflow is
|
|
# wired. Delete once that lands.
|
|
#
|
|
# Push-triggered (workflow_dispatch only works for workflows on the default
|
|
# branch; our CI is on `ci`). Runs when the flake/toolchain or this file change.
|
|
# Bring the Mac up before pushing so the run isn't left queued.
|
|
name: macos-build-test
|
|
on:
|
|
push:
|
|
paths:
|
|
- '.gitea/workflows/macos-probe.yaml'
|
|
- 'flake.nix'
|
|
- 'rust-toolchain.toml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
# Label NAME only — `:host` in the runner registration is the execution
|
|
# backend (run on host), not part of the label.
|
|
runs-on: macos
|
|
env:
|
|
# Guarantee flakes regardless of the Mac's nix config.
|
|
NIX_CONFIG: "experimental-features = nix-command flakes"
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: test (macOS — the gate only covers Linux)
|
|
run: nix develop -c cargo test --no-fail-fast
|
|
- name: build, de-nix, sign, verify both darwin targets
|
|
run: |
|
|
set -e
|
|
for t in aarch64-apple-darwin x86_64-apple-darwin; do
|
|
echo "==================== $t ===================="
|
|
nix develop -c cargo build --release --target "$t"
|
|
f="target/$t/release/rdbms-playground"
|
|
|
|
# The darwin stdenv bakes a /nix/store libiconv load path into the
|
|
# binary. Rewrite it to the system libiconv (every Mac has it, ABI-
|
|
# compatible), then re-sign ad-hoc — install_name_tool invalidates
|
|
# the signature and arm64 won't run an unsigned/broken-sig binary.
|
|
for l in $(otool -L "$f" | awk '/\/nix\/store.*libiconv.*dylib/ {print $1}'); do
|
|
echo "rewrite $l -> /usr/lib/libiconv.2.dylib"
|
|
install_name_tool -change "$l" /usr/lib/libiconv.2.dylib "$f"
|
|
done
|
|
codesign --force --sign - "$f"
|
|
|
|
echo "--- linked libs ---"; otool -L "$f"
|
|
if otool -L "$f" | grep -q /nix/store; then
|
|
echo "ERROR: $t still links a /nix/store dylib"; exit 1
|
|
fi
|
|
codesign --verify --verbose=2 "$f" && echo "signature OK"
|
|
|
|
# Smoke-run the natively-runnable target (this VM is arm64).
|
|
if [ "$t" = "aarch64-apple-darwin" ]; then
|
|
echo "--- run --help ---"; "$f" --help | head -1
|
|
else
|
|
echo "(skip run: $t needs Rosetta)"
|
|
fi
|
|
echo "OK: $t portable"
|
|
done
|
|
echo "=== both darwin targets built, de-nixed, signed, verified ==="
|
|
|
|
- name: prune nix store — keep the last 2 toolchain generations
|
|
# The runner wipes the whole workspace before each run, so cargo target/
|
|
# never accumulates (no sweep needed). The persistent caches are the nix
|
|
# store (/nix) and ~/.cargo (in $HOME). Bound the nix store by generation:
|
|
# record the current devShell closure as a generation of a persistent
|
|
# profile (lives in $HOME, survives the workspace wipe), keep the 2 newest
|
|
# (current + previous), reclaim what the older ones referenced. No time
|
|
# window — never more than two toolchains regardless of flake.lock churn.
|
|
if: always()
|
|
run: |
|
|
echo "--- disk before ---"; df -h / | tail -1
|
|
P="$HOME/.cache/rdbms-ci/toolchain"
|
|
nix develop --profile "$P" -c true || true
|
|
nix-env -p "$P" --delete-generations +2 || true
|
|
nix-collect-garbage || true
|
|
echo "--- disk after ---"; df -h / | tail -1
|
|
# ~/.cargo/registry also persists but grows only on Cargo.lock bumps;
|
|
# bound it later with `cargo-cache --autoclean` if it ever matters.
|