ci!: deploy workflow

2026-09-07 10:59:36 +00:00
parent 2fbd776fc1
commit 8cfc7463c6
5 changed files with 173 additions and 3 deletions
@@ -0,0 +1,62 @@
+---
+# yamllint disable rule:line-length
+name: deploy neuro
+
+on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-neuro
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: deploy neuro from performance node
+    if: ${{ gitea.ref == 'refs/heads/master' }}
+    runs-on: gross-nix-x86-perf
+    timeout-minutes: 30
+    env:
+      NIX_CONFIG: |
+        extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
+        extra-trusted-public-keys = hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+      DEPLOY_REVISION: ${{ gitea.sha }}
+    steps:
+      - name: Checkout dispatched revision
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af6832  # v4.2.2
+        with:
+          ref: ${{ gitea.sha }}
+          persist-credentials: false
+
+      - name: Show runner and cache configuration
+        run: |
+          set -eu
+          uname -a
+          nix --version
+          nix config show substituters
+          nix config show trusted-public-keys
+
+      - name: Deploy neuro
+        env:
+          NEURO_SSH_PRIVATE_KEY: ${{ secrets.NEURO_SSH_PRIVATE_KEY }}
+          NEURO_SSH_KNOWN_HOSTS: ${{ secrets.NEURO_SSH_KNOWN_HOSTS }}
+        run: |
+          set -eu
+          test -n "$NEURO_SSH_PRIVATE_KEY"
+          test -n "$NEURO_SSH_KNOWN_HOSTS"
+          ssh_home=$(mktemp -d)
+          trap 'rm -rf "$ssh_home"' EXIT
+          install -d -m 700 "$ssh_home/.ssh"
+          printf '%s\n' "$NEURO_SSH_PRIVATE_KEY" > "$ssh_home/.ssh/id_ed25519"
+          printf '%s\n' "$NEURO_SSH_KNOWN_HOSTS" > "$ssh_home/.ssh/known_hosts"
+          chmod 600 "$ssh_home/.ssh/id_ed25519" "$ssh_home/.ssh/known_hosts"
+          export HOME="$ssh_home"
+          export NIX_SSHOPTS="-o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519"
+          ssh -o BatchMode=yes -o ConnectTimeout=10 \
+            -o StrictHostKeyChecking=yes \
+            -o UserKnownHostsFile="$HOME/.ssh/known_hosts" \
+            -o IdentitiesOnly=yes \
+            -i "$HOME/.ssh/id_ed25519" \
+            neuro true
+          # Deploy tool intentionally uses requested GitHub flake; revision matches checkout.
+          nix run --refresh "github:hectic-lab/util.nix/${DEPLOY_REVISION}#deploy" -- \
+            push -- --flake '.#neuro|x86_64-linux' --target-host neuro --use-remote-sudo