Forgejo Actions (#5)

Reviewed-on: #5

.forgejo/workflows/auto-update.yaml

@@ -7,14 +7,14 @@ on:
   workflow_dispatch: {}
 
 jobs:
-  check-updates:
+  prepare:
     runs-on: nix
     outputs:
       changed: ${{ steps.changes.outputs.changed }}
-      hosts: ${{ steps.hosts.outputs.hosts }}
+      branch_name: ${{ steps.commit.outputs.branch_name }}
     steps:
       - name: Checkout repository
-        uses: forgejo/checkout@v4
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -31,96 +31,15 @@ jobs:
         run: |
           if git diff --quiet flake.lock; then
             echo "changed=false" >> $FORGEJO_OUTPUT
+            echo "No changes to flake.lock"
           else
             echo "changed=true" >> $FORGEJO_OUTPUT
+            echo "flake.lock has been updated"
           fi
 
-      - name: Extract LXC hosts
-        id: hosts
-        if: steps.changes.outputs.changed == 'true'
-        run: |
-          HOSTS=$(nix eval --json .#colmena --apply 'x: builtins.filter (n: n != "meta" && builtins.elem "lxc" (x.${n}.deployment.tags or [])) (builtins.attrNames x)')
-          echo "hosts=$HOSTS" >> $FORGEJO_OUTPUT
-          echo "Discovered hosts: $HOSTS"
-
-      - name: Upload flake.lock
-        if: steps.changes.outputs.changed == 'true'
-        uses: forgejo/upload-artifact@v4
-        with:
-          name: flake-lock
-          path: flake.lock
-          retention-days: 1
-
-  build:
-    needs: check-updates
-    if: needs.check-updates.outputs.changed == 'true'
-    runs-on: nix
-    strategy:
-      fail-fast: false
-      matrix:
-        host: ${{ fromJson(needs.check-updates.outputs.hosts) }}
-    steps:
-      - name: Checkout repository
-        uses: forgejo/checkout@v4
-
-      - name: Download updated flake.lock
-        uses: forgejo/download-artifact@v4
-        with:
-          name: flake-lock
-
-      - name: Build ${{ matrix.host }}
-        id: build
-        run: |
-          echo "Building host: ${{ matrix.host }}"
-          nix build .#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel --no-link 2>&1 | tee build-output.txt
-        continue-on-error: true
-
-      - name: Upload build log on failure
-        if: failure() || steps.build.outcome == 'failure'
-        uses: forgejo/upload-artifact
-        with:
-          name: build-failure-${{ matrix.host }}
-          path: build-output.txt
-          retention-days: 7
-
-      - name: Check build result
-        run: |
-          if [ "${{ steps.build.outcome }}" == "failure" ]; then
-            echo "Build failed for ${{ matrix.host }}"
-            exit 1
-          fi
-
-  report:
-    needs: [check-updates, build]
-    if: always() && needs.check-updates.outputs.changed == 'true'
-    runs-on: nix
-    steps:
-      - name: Checkout repository
-        uses: forgejo/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "Flake Update Bot"
-          git config user.email "bot@noreply.local"
-
-      - name: Download updated flake.lock
-        uses: forgejo/download-artifact@v4
-        with:
-          name: flake-lock
-
-      - name: Download failure artifacts
-        if: needs.build.result == 'failure'
-        uses: forgejo/download-artifact@v4
-        with:
-          pattern: build-failure-*
-          path: failures
-          merge-multiple: false
-        continue-on-error: true
-
       - name: Create branch and commit
-        id: branch
+        id: commit
+        if: steps.changes.outputs.changed == 'true'
         run: |
           BRANCH_NAME="auto-update/$(date +%Y-%m-%d)"
           git checkout -b "$BRANCH_NAME"
@@ -128,14 +47,150 @@ jobs:
           git commit -m "chore: update flake inputs $(date +%Y-%m-%d)"
           git push origin "$BRANCH_NAME"
           echo "branch_name=$BRANCH_NAME" >> $FORGEJO_OUTPUT
+          echo "Created and pushed branch: $BRANCH_NAME"
+
+      - name: Extract LXC hosts
+        if: steps.changes.outputs.changed == 'true'
+        run: |
+          set -euo pipefail
+          HOSTS=$(nix eval --json .#colmena --apply 'x: builtins.filter (n: n != "meta" && builtins.elem "lxc" (x.${n}.deployment.tags or [])) (builtins.attrNames x)')
+          
+          # Validate the output is a non-empty JSON array
+          if ! echo "$HOSTS" | jq -e '. | if type == "array" and length > 0 then true else false end' > /dev/null 2>&1; then
+            echo "Error: No LXC hosts found or invalid JSON output: $HOSTS"
+            exit 1
+          fi
+          
+          echo "$HOSTS" > hosts.json
+          echo "Discovered hosts: $HOSTS"
+
+      - name: Upload hosts list
+        if: steps.changes.outputs.changed == 'true'
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: hosts-list
+          path: hosts.json
+          retention-days: 1
+
+  build:
+    needs: prepare
+    if: needs.prepare.outputs.changed == 'true'
+    runs-on: nix
+    steps:
+      - name: Checkout update branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.prepare.outputs.branch_name }}
+
+      - name: Download hosts list
+        uses: forgejo/download-artifact@v4
+        with:
+          name: hosts-list
+
+      - name: Build all hosts
+        id: build
+        run: |
+          set -euo pipefail
+          
+          if [ ! -f hosts.json ]; then
+            echo "Error: hosts.json not found"
+            exit 1
+          fi
+          
+          HOSTS=$(cat hosts.json)
+          echo "Building hosts: $HOSTS"
+          
+          FAILED_HOSTS=""
+          SUCCESS_HOSTS=""
+          
+          for HOST in $(echo "$HOSTS" | jq -r '.[]'); do
+            echo ""
+            echo "=========================================="
+            echo "Building: $HOST"
+            echo "=========================================="
+            
+            if nix build ".#nixosConfigurations.${HOST}.config.system.build.toplevel" --no-link --quiet 2>&1 | tee "build-${HOST}.txt"; then
+              echo "✓ Build succeeded: $HOST"
+              SUCCESS_HOSTS="$SUCCESS_HOSTS $HOST"
+            else
+              echo "✗ Build failed: $HOST"
+              FAILED_HOSTS="$FAILED_HOSTS $HOST"
+            fi
+          done
+          
+          echo ""
+          echo "=========================================="
+          echo "Build Summary"
+          echo "=========================================="
+          echo "Succeeded:$SUCCESS_HOSTS"
+          echo "Failed:$FAILED_HOSTS"
+          
+          # Save results for report job
+          echo "$FAILED_HOSTS" > failed-hosts.txt
+          echo "$SUCCESS_HOSTS" > success-hosts.txt
+          
+          if [ -n "$FAILED_HOSTS" ]; then
+            echo "Some builds failed"
+            exit 1
+          fi
+        continue-on-error: true
+
+      - name: Upload build logs
+        if: always()
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: build-logs
+          path: build-*.txt
+          retention-days: 7
+
+      - name: Upload build results
+        if: always()
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: build-results
+          path: |
+            failed-hosts.txt
+            success-hosts.txt
+          retention-days: 1
+
+      - name: Check build result
+        run: |
+          if [ "${{ steps.build.outcome }}" == "failure" ]; then
+            echo "Some builds failed - check build-logs artifact"
+            exit 1
+          fi
+
+  report:
+    needs: [prepare, build]
+    if: always() && needs.prepare.outputs.changed == 'true'
+    runs-on: nix
+    steps:
+      - name: Download hosts list
+        uses: forgejo/download-artifact@v4
+        with:
+          name: hosts-list
+
+      - name: Download build results
+        uses: forgejo/download-artifact@v4
+        with:
+          name: build-results
+        continue-on-error: true
+
+      - name: Download build logs
+        if: needs.build.result == 'failure'
+        uses: forgejo/download-artifact@v4
+        with:
+          name: build-logs
+          path: logs
+        continue-on-error: true
 
       - name: Create Pull Request
         if: needs.build.result == 'success'
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
         run: |
-          HOSTS='${{ needs.check-updates.outputs.hosts }}'
+          HOSTS=$(cat hosts.json)
-          HOST_LIST=$(echo "$HOSTS" | jq -r '.[] | "- " + .' | tr '\n' '\n')
+          HOST_LIST=$(echo "$HOSTS" | jq -r '.[] | "- " + .')
           
           curl -X POST \
             -H "Authorization: token $FORGEJO_TOKEN" \
@@ -143,7 +198,7 @@ jobs:
             -d '{
               "title": "chore: weekly flake update",
               "body": "Automated flake update from CI.\n\nThis PR updates all flake inputs and has been verified to build successfully.\n\n**Hosts built:**\n'"$(echo "$HOST_LIST" | sed 's/$/\\n/g' | tr -d '\n')"'\n\nGenerated on: '"$(date -Iseconds)"'",
-              "head": "'"${{ steps.branch.outputs.branch_name }}"'",
+              "head": "'"${{ needs.prepare.outputs.branch_name }}"'",
               "base": "master"
             }' \
             "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/pulls"
@@ -153,31 +208,27 @@ jobs:
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
         run: |
-          # Collect failed hosts from artifact directories
           FAILED_HOSTS=""
           FAILURE_DETAILS=""
           
-          if [ -d "failures" ]; then
+          # Read failed hosts from build results
-            for dir in failures/build-failure-*; do
+          if [ -f "failed-hosts.txt" ]; then
-              if [ -d "$dir" ]; then
+            for HOST in $(cat failed-hosts.txt); do
-                HOST=$(basename "$dir" | sed 's/build-failure-//')
               FAILED_HOSTS="$FAILED_HOSTS\n- $HOST"
               
-                if [ -f "$dir/build-output.txt" ]; then
+              # Get build log if available
-                  # Get last 50 lines of build output
+              if [ -f "logs/build-${HOST}.txt" ]; then
-                  LOG_TAIL=$(tail -50 "$dir/build-output.txt" | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
+                LOG_TAIL=$(tail -50 "logs/build-${HOST}.txt" | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
                 FAILURE_DETAILS="$FAILURE_DETAILS\n\n<details>\n<summary>$HOST build log (last 50 lines)</summary>\n\n\`\`\`\n$LOG_TAIL\n\`\`\`\n</details>"
               fi
-              fi
             done
           fi
           
-          # If no failure artifacts found, list from matrix
           if [ -z "$FAILED_HOSTS" ]; then
             FAILED_HOSTS="\n- (Unable to determine failed hosts - check workflow logs)"
           fi
           
-          ISSUE_BODY="Weekly flake update failed to build some hosts.\n\n**Branch:** \`${{ steps.branch.outputs.branch_name }}\`\n**Run:** ${{ github.server_url }}/${{ github.repository }}/forgejo/runs/${{ github.run_id }}\n\n**Failed hosts:**$FAILED_HOSTS\n$FAILURE_DETAILS\n\nGenerated on: $(date -Iseconds)"
+          ISSUE_BODY="Weekly flake update failed to build some hosts.\n\n**Branch:** \`${{ needs.prepare.outputs.branch_name }}\`\n**Run:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n\n**Failed hosts:**$FAILED_HOSTS\n$FAILURE_DETAILS\n\nGenerated on: $(date -Iseconds)"
           
           curl -X POST \
             -H "Authorization: token $FORGEJO_TOKEN" \
@@ -192,4 +243,4 @@ jobs:
         if: always()
         run: |
           nix-collect-garbage -d
-          rm -rf result .direnv failures
+          rm -rf result .direnv logs

modules/services/forgejo.nix

@@ -88,7 +88,7 @@ in
           };
           actions = {
             ENABLED = true;
-            DEFAULT_ACTIONS_URL = "github";
+            DEFAULT_ACTIONS_URL = "https://code.forgejo.org";
             ARTIFACT_RETENTION_DAYS = 90;
           };
         } cfg.settings;