From 7593e962f06a02f09ee2569951beb337491c96a3 Mon Sep 17 00:00:00 2001 From: JP Hutchins Date: Thu, 23 Jul 2026 12:22:29 -0700 Subject: [PATCH] build: pin nixpkgs and add a minimal CI that runs on the stacked PRs shell.nix: - pin nixpkgs to a fixed nixos-25.05 revision (rev + sha256) instead of the mutable refs/tags/22.11 tarball - rename the removed `pkgconfig` alias to `pkg-config`; drop the `darwin.apple_sdk.frameworks.Security` stub (a no-op in 25.05) .github/workflows/ci.yml (replacing the unmaintained Dhall generator: builder.dhall, ci.dhall, helpers.dhall, schema.dhall): - unfiltered `pull_request` trigger so CI runs on the whole stacked series, not only PRs targeting master - one ubuntu job: build with poetry + maturin and run pytest - kept intentionally small; the workflow tracks the tooling as the stack modernizes it (uv at #2, camas at #7) Co-Authored-By: claude-opus-4-8[1m] Claude-Session: https://claude.ai/code/session_019JtM6kqpbjzQB5CVosa5pt --- .github/workflows/builder.dhall | 130 --------------------- .github/workflows/ci.dhall | 85 -------------- .github/workflows/ci.yml | 201 ++++---------------------------- .github/workflows/helpers.dhall | 83 ------------- .github/workflows/schema.dhall | 1 - shell.nix | 32 ++--- 6 files changed, 33 insertions(+), 499 deletions(-) delete mode 100644 .github/workflows/builder.dhall delete mode 100644 .github/workflows/ci.dhall delete mode 100644 .github/workflows/helpers.dhall delete mode 100644 .github/workflows/schema.dhall diff --git a/.github/workflows/builder.dhall b/.github/workflows/builder.dhall deleted file mode 100644 index 21ba02e..0000000 --- a/.github/workflows/builder.dhall +++ /dev/null @@ -1,130 +0,0 @@ -let helpers = ./helpers.dhall - -let GithubActions = helpers.GithubActions - -let enums = helpers.enums - -let constants = helpers.constants - -let setup = helpers.setup - -let OsConfig = - { Type = - { pythonExec : Text - , container : Optional Text - , runs-on : GithubActions.RunsOn.Type - , pythonSetup : List GithubActions.Step.Type - , interpreterArg : Text - , strategy : Optional GithubActions.Strategy.Type - , osName : Text - , wheelsToInstall : Text - } - , default = - { pythonExec = "python" - , container = None Text - , pythonSetup = [] : List GithubActions.Step.Type - , interpreterArg = " --interpreter python${constants.matrixPython}" - , strategy = Some GithubActions.Strategy::{ - , fail-fast = Some True - , matrix = toMap { python-version = constants.supportedPythons } - } - } - } - -let osSpecificConfig = - { Linux = OsConfig::{ - , pythonExec = "python${constants.matrixPython}" - , container = Some constants.manylinuxContainer - , runs-on = GithubActions.RunsOn.Type.ubuntu-latest - , osName = "Linux" - , wheelsToInstall = "target/wheels/dhall*manylinux*.whl" - } - , Mac = OsConfig::{ - , runs-on = GithubActions.RunsOn.Type.macos-latest - , pythonSetup = [ setup.python constants.matrixPython ] - , osName = "Mac" - , wheelsToInstall = "target/wheels/dhall*.whl" - } - , Windows = OsConfig::{ - , runs-on = GithubActions.RunsOn.Type.windows-latest - , interpreterArg = "" - , strategy = None GithubActions.Strategy.Type - , osName = "Windows" - , wheelsToInstall = "--find-links=target\\wheels dhall" - } - } - -let mainBuilder = - λ(os : enums.SupportedOs) → - λ(release : enums.ReleaseType) → - let config = merge osSpecificConfig os - - let releaseStr = λ(x : Text) → merge { Release = x, Dev = "" } release - - let releaseCond = - merge - { Release = constants.releaseCreatedCondition - , Dev = "!(${constants.releaseCreatedCondition})" - } - release - - in GithubActions.Step::{ - , name = Some - "Build and test python package${releaseStr " (Release)"}" - , `if` = Some releaseCond - , run = Some - ( helpers.unlines - [ "${config.pythonExec} -m poetry run maturin build ${releaseStr - "--release"} --strip${config.interpreterArg}" - , "${config.pythonExec} -m poetry run maturin develop" - , "${config.pythonExec} -m poetry run pytest tests" - ] - ) - } - -in λ(os : enums.SupportedOs) → - let config = merge osSpecificConfig os - - in GithubActions.Job::{ - , name = Some "Build/test/publish ${config.osName}" - , runs-on = config.runs-on - , container = config.container - , needs = Some [ "lint" ] - , strategy = config.strategy - , steps = - config.pythonSetup - # [ setup.rust - , GithubActions.steps.actions/checkout - , helpers.installDeps enums.DependencySet.Full config.pythonExec - , mainBuilder os enums.ReleaseType.Dev - , mainBuilder os enums.ReleaseType.Release - , GithubActions.Step::{ - , name = Some "Install wheels" - , run = Some - "${config.pythonExec} -m pip install ${config.wheelsToInstall}" - } - , GithubActions.Step::{ - , name = Some "Release" - , uses = Some "softprops/action-gh-release@v1" - , `if` = Some - "${constants.releaseTagCondition} && ${constants.releaseCreatedCondition}" - , `with` = Some (toMap { files = "target/wheels/dhall*.whl" }) - , env = Some - ( toMap - { GITHUB_TOKEN = helpers.ghVar "secrets.GITHUB_TOKEN" - } - ) - } - , GithubActions.Step::{ - , name = Some "PyPI publish" - , `if` = Some - "${constants.releaseTagCondition} && ${constants.releaseCreatedCondition}" - , env = Some - ( toMap - { MATURIN_PASSWORD = helpers.ghVar "secrets.PYPI" } - ) - , run = Some - "${config.pythonExec} -m poetry run maturin publish --no-sdist --username __token__${config.interpreterArg}" - } - ] - } diff --git a/.github/workflows/ci.dhall b/.github/workflows/ci.dhall deleted file mode 100644 index 9c41cdf..0000000 --- a/.github/workflows/ci.dhall +++ /dev/null @@ -1,85 +0,0 @@ -let helpers = ./helpers.dhall - -let builder = ./builder.dhall - -let GithubActions = helpers.GithubActions - -let enums = helpers.enums - -let constants = helpers.constants - -let setup = helpers.setup - -in GithubActions.Workflow::{ - , name = "CI" - , on = GithubActions.On::{ - , push = Some GithubActions.Push::{ branches = Some [ "master" ] } - , pull_request = Some GithubActions.PullRequest::{ - , branches = Some [ "master" ] - } - , release = Some GithubActions.Release::{ - , types = Some [ GithubActions.types.Release/types.created ] - } - , schedule = Some [ { cron = "20 23 * * 6" } ] - } - , jobs = toMap - { lint = GithubActions.Job::{ - , name = Some "Lint check" - , runs-on = GithubActions.RunsOn.Type.ubuntu-latest - , steps = - [ GithubActions.steps.actions/checkout - , setup.dhall - , GithubActions.Step::{ - , name = Some "Check github actions workflow" - , `if` = Some "github.event.name != 'pull_request'" - , run = Some - ( helpers.unlines - [ "dhall lint .github/workflows/*.dhall" - , "yaml-to-dhall ./.github/workflows/schema.dhall < .github/workflows/ci.yml > expected.dhall" - , "dhall diff ./expected.dhall ./.github/workflows/ci.dhall" - ] - ) - } - , setup.python constants.latestPython - , helpers.installDeps enums.DependencySet.Lint "python" - , GithubActions.Step::{ - , name = Some "Check lint" - , run = Some - ( helpers.unlines - [ "isort . --check --diff", "black . --check" ] - ) - } - ] - } - , macBuild = builder enums.SupportedOs.Mac - , windowsBuild = builder enums.SupportedOs.Windows - , linuxBuild = builder enums.SupportedOs.Linux - , bump = GithubActions.Job::{ - , name = Some "Bump minor version" - , needs = Some [ "lint" ] - , `if` = Some constants.releaseCreatedCondition - , runs-on = GithubActions.RunsOn.Type.ubuntu-latest - , steps = - [ GithubActions.steps.actions/checkout - ⫽ { `with` = Some (toMap { ref = "master" }) } - , setup.python constants.latestPython - , setup.rust - , helpers.installDeps enums.DependencySet.Bump "python" - , GithubActions.Step::{ - , name = Some "Bump and push" - , run = Some - ( helpers.unlines - [ "cargo bump patch" - , "poetry version patch" - , "git config user.name github-actions" - , "git config user.email github-actions@github.com" - , "git add Cargo.toml pyproject.toml" - , "git commit -m \"Bump version (automatic commit)\"" - , "git push" - ] - ) - } - ] - } - } - } diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b8f1b7c..352df39 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,182 +1,27 @@ -jobs: - bump: - if: "github.event_name == 'release' && github.event.action == 'created'" - name: Bump minor version - needs: - - lint - runs-on: ubuntu-latest - steps: - - uses: "actions/checkout@v2" - with: - ref: master - - name: Setup python 3.10 - uses: "actions/setup-python@v3" - with: - python-version: '3.10' - - name: Install Rust - uses: "actions-rs/toolchain@v1" - with: - override: 'true' - toolchain: stable - - name: Install dependencies - run: "python -m pip install --upgrade pip\ncargo install cargo-bump\npython -m pip install poetry\ntouch Cargo.toml.orig\npython -m poetry install" - - name: Bump and push - run: "cargo bump patch\npoetry version patch\ngit config user.name github-actions\ngit config user.email github-actions@github.com\ngit add Cargo.toml pyproject.toml\ngit commit -m \"Bump version (automatic commit)\"\ngit push" - lint: - name: Lint check - runs-on: ubuntu-latest - steps: - - uses: "actions/checkout@v2" - - name: Install dhall - uses: "dhall-lang/setup-dhall@v4" - with: - version: '1.41.1' - - if: "github.event.name != 'pull_request'" - name: Check github actions workflow - run: "dhall lint .github/workflows/*.dhall\nyaml-to-dhall ./.github/workflows/schema.dhall < .github/workflows/ci.yml > expected.dhall\ndhall diff ./expected.dhall ./.github/workflows/ci.dhall" - - name: Setup python 3.10 - uses: "actions/setup-python@v3" - with: - python-version: '3.10' - - name: Install dependencies - run: "python -m pip install --upgrade pip\npython -m pip install black isort autoflake" - - name: Check lint - run: "isort . --check --diff\nblack . --check" - linuxBuild: - container: quay.io/pypa/manylinux_2_24_x86_64 - name: Build/test/publish Linux - needs: - - lint - runs-on: ubuntu-latest - steps: - - name: Install Rust - uses: "actions-rs/toolchain@v1" - with: - override: 'true' - toolchain: stable - - uses: "actions/checkout@v2" - - name: Install dependencies - run: "python${{ matrix.python-version }} -m pip install --upgrade pip\npython${{ matrix.python-version }} -m pip install poetry\ntouch Cargo.toml.orig\npython${{ matrix.python-version }} -m poetry install" - - if: "!(github.event_name == 'release' && github.event.action == 'created')" - name: Build and test python package - run: "python${{ matrix.python-version }} -m poetry run maturin build --strip --interpreter python${{ matrix.python-version }}\npython${{ matrix.python-version }} -m poetry run maturin develop\npython${{ matrix.python-version }} -m poetry run pytest tests" - - if: "github.event_name == 'release' && github.event.action == 'created'" - name: "Build and test python package (Release)" - run: "python${{ matrix.python-version }} -m poetry run maturin build --release --strip --interpreter python${{ matrix.python-version }}\npython${{ matrix.python-version }} -m poetry run maturin develop\npython${{ matrix.python-version }} -m poetry run pytest tests" - - name: Install wheels - run: "python${{ matrix.python-version }} -m pip install target/wheels/dhall*manylinux*.whl" - - env: - GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" - if: "startsWith(github.ref, 'refs/tags/') && github.event_name == 'release' && github.event.action == 'created'" - name: Release - uses: "softprops/action-gh-release@v1" - with: - files: "target/wheels/dhall*.whl" - - env: - MATURIN_PASSWORD: "${{ secrets.PYPI }}" - if: "startsWith(github.ref, 'refs/tags/') && github.event_name == 'release' && github.event.action == 'created'" - name: PyPI publish - run: "python${{ matrix.python-version }} -m poetry run maturin publish --no-sdist --username __token__ --interpreter python${{ matrix.python-version }}" - strategy: - fail-fast: true - matrix: - python-version: - - '3.7' - - '3.8' - - '3.9' - - '3.10' - - '3.11' - macBuild: - name: Build/test/publish Mac - needs: - - lint - runs-on: macos-latest - steps: - - name: "Setup python ${{ matrix.python-version }}" - uses: "actions/setup-python@v3" - with: - python-version: "${{ matrix.python-version }}" - - name: Install Rust - uses: "actions-rs/toolchain@v1" - with: - override: 'true' - toolchain: stable - - uses: "actions/checkout@v2" - - name: Install dependencies - run: "python -m pip install --upgrade pip\npython -m pip install poetry\ntouch Cargo.toml.orig\npython -m poetry install" - - if: "!(github.event_name == 'release' && github.event.action == 'created')" - name: Build and test python package - run: "python -m poetry run maturin build --strip --interpreter python${{ matrix.python-version }}\npython -m poetry run maturin develop\npython -m poetry run pytest tests" - - if: "github.event_name == 'release' && github.event.action == 'created'" - name: "Build and test python package (Release)" - run: "python -m poetry run maturin build --release --strip --interpreter python${{ matrix.python-version }}\npython -m poetry run maturin develop\npython -m poetry run pytest tests" - - name: Install wheels - run: "python -m pip install target/wheels/dhall*.whl" - - env: - GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" - if: "startsWith(github.ref, 'refs/tags/') && github.event_name == 'release' && github.event.action == 'created'" - name: Release - uses: "softprops/action-gh-release@v1" - with: - files: "target/wheels/dhall*.whl" - - env: - MATURIN_PASSWORD: "${{ secrets.PYPI }}" - if: "startsWith(github.ref, 'refs/tags/') && github.event_name == 'release' && github.event.action == 'created'" - name: PyPI publish - run: "python -m poetry run maturin publish --no-sdist --username __token__ --interpreter python${{ matrix.python-version }}" - strategy: - fail-fast: true - matrix: - python-version: - - '3.7' - - '3.8' - - '3.9' - - '3.10' - - '3.11' - windowsBuild: - name: Build/test/publish Windows - needs: - - lint - runs-on: windows-latest - steps: - - name: Install Rust - uses: "actions-rs/toolchain@v1" - with: - override: 'true' - toolchain: stable - - uses: "actions/checkout@v2" - - name: Install dependencies - run: "python -m pip install --upgrade pip\npython -m pip install poetry\ntouch Cargo.toml.orig\npython -m poetry install" - - if: "!(github.event_name == 'release' && github.event.action == 'created')" - name: Build and test python package - run: "python -m poetry run maturin build --strip\npython -m poetry run maturin develop\npython -m poetry run pytest tests" - - if: "github.event_name == 'release' && github.event.action == 'created'" - name: "Build and test python package (Release)" - run: "python -m poetry run maturin build --release --strip\npython -m poetry run maturin develop\npython -m poetry run pytest tests" - - name: Install wheels - run: "python -m pip install --find-links=target\\wheels dhall" - - env: - GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" - if: "startsWith(github.ref, 'refs/tags/') && github.event_name == 'release' && github.event.action == 'created'" - name: Release - uses: "softprops/action-gh-release@v1" - with: - files: "target/wheels/dhall*.whl" - - env: - MATURIN_PASSWORD: "${{ secrets.PYPI }}" - if: "startsWith(github.ref, 'refs/tags/') && github.event_name == 'release' && github.event.action == 'created'" - name: PyPI publish - run: python -m poetry run maturin publish --no-sdist --username __token__ name: CI + on: pull_request: - branches: - - master push: - branches: - - master - release: - types: - - created - schedule: - - cron: "20 23 * * 6" + branches: [master] + +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + ci: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@stable + - uses: actions/setup-python@v5 + with: + python-version: "3.11" + - run: pip install poetry + - run: poetry install --no-root + - run: poetry run maturin develop + - run: poetry run pytest tests diff --git a/.github/workflows/helpers.dhall b/.github/workflows/helpers.dhall deleted file mode 100644 index 4aa07cc..0000000 --- a/.github/workflows/helpers.dhall +++ /dev/null @@ -1,83 +0,0 @@ -let GithubActions = - https://raw.githubusercontent.com/regadas/github-actions-dhall/04e304c2a73cb3dcdd77449f807ad259128e0d5c/package.dhall - sha256:3af4c42342006a960fde1018fbcbe3333abd0fd3b108c0888f7cd5ff35937032 - -let Prelude = - https://prelude.dhall-lang.org/v21.1.0/package.dhall - sha256:0fed19a88330e9a8a3fbe1e8442aa11d12e38da51eb12ba8bcb56f3c25d0854a - -let unlines = Prelude.Text.concatSep "\n" - -let ghVar = λ(varName : Text) → "\${{ ${varName} }}" - -let constants = - { latestPython = "3.10" - , matrixPython = ghVar "matrix.python-version" - , manylinuxContainer = "quay.io/pypa/manylinux_2_24_x86_64" - , supportedPythons = [ "3.7", "3.8", "3.9", "3.10", "3.11" ] - , releaseCreatedCondition = - "github.event_name == 'release' && github.event.action == 'created'" - , releaseTagCondition = "startsWith(github.ref, 'refs/tags/')" - } - -let enums = - { DependencySet = < Full | Lint | Bump > - , SupportedOs = < Windows | Mac | Linux > - , ReleaseType = < Release | Dev > - } - -let setup = - { dhall = GithubActions.Step::{ - , uses = Some "dhall-lang/setup-dhall@v4" - , name = Some "Install dhall" - , `with` = Some (toMap { version = "1.41.1" }) - } - , python = - λ(version : Text) → - GithubActions.Step::{ - , uses = Some "actions/setup-python@v3" - , name = Some "Setup python ${version}" - , `with` = Some (toMap { python-version = version }) - } - , rust = GithubActions.Step::{ - , uses = Some "actions-rs/toolchain@v1" - , name = Some "Install Rust" - , `with` = Some (toMap { toolchain = "stable", override = "true" }) - } - } - -let installDeps = - λ(installType : enums.DependencySet) → - λ(pythonExec : Text) → - let fullDeps = - [ "${pythonExec} -m pip install poetry" - , "touch Cargo.toml.orig" - , "${pythonExec} -m poetry install" - ] - - let deps = - merge - { Full = fullDeps - , Lint = - [ "${pythonExec} -m pip install black isort autoflake" ] - , Bump = [ "cargo install cargo-bump" ] # fullDeps - } - installType - - in GithubActions.Step::{ - , name = Some "Install dependencies" - , run = Some - ( unlines - ([ "${pythonExec} -m pip install --upgrade pip" ] # deps) - ) - } - -in { unlines - , ghVar - , constants - , enums - , setup - , GithubActions - , Prelude - , installDeps - } diff --git a/.github/workflows/schema.dhall b/.github/workflows/schema.dhall deleted file mode 100644 index 68ea040..0000000 --- a/.github/workflows/schema.dhall +++ /dev/null @@ -1 +0,0 @@ -let helpers = ./helpers.dhall in helpers.GithubActions.Workflow.Type diff --git a/shell.nix b/shell.nix index 996654d..ac42d2c 100644 --- a/shell.nix +++ b/shell.nix @@ -1,12 +1,19 @@ -{ pkgs ? import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/refs/tags/22.11.tar.gz") {} }: +{ + pkgs ? + import + (fetchTarball { + url = "https://github.com/NixOS/nixpkgs/archive/ac62194c3917d5f474c1a844b6fd6da2db95077d.tar.gz"; + sha256 = "0v6bd1xk8a2aal83karlvc853x44dg1n4nk08jg3dajqyy0s98np"; + }) + { }, +}: pkgs.mkShell { buildInputs = with pkgs; [ poetry rustc cargo - darwin.apple_sdk.frameworks.Security - pkgconfig + pkg-config openssl ]; packages = with pkgs; [ @@ -18,22 +25,3 @@ pkgs.mkShell { rust-analyzer ]; } -# -# let -# myAppEnv = pkgs.poetry2nix.mkPoetryEnv { -# projectDir = ./.; -# editablePackageSources = { -# my-app = ./src; -# }; -# }; -# in myAppEnv.env.overrideAttrs (oldAttrs: { -# buildInputs = [ -# pkgs.rustc -# pkgs.cargo -# ]; -# packages = [ -# pkgs.python310Packages.pytest -# pkgs.black -# pkgs.isort -# ]; -# })