From d1327acd40366496dbb235fe51bad2a3d7376ff2 Mon Sep 17 00:00:00 2001 From: Stefan Kober Date: Mon, 27 Jul 2026 10:18:55 +0200 Subject: [PATCH 1/3] github: setup cachix binary cache Signed-off-by: Stefan Kober On-behalf-of: SAP stefan.kober@sap.com --- .github/workflows/qa.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index b233711..8862344 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -14,6 +14,10 @@ jobs: steps: - uses: actions/checkout@v6 - uses: cachix/install-nix-action@v31 + - uses: cachix/cachix-action@v17 + with: + name: openstack-nix + authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" - name: Build run: | set -euxo pipefail From 6e2636037b9d99603726f2e24b9ec923e8cb4931 Mon Sep 17 00:00:00 2001 From: Stefan Kober Date: Mon, 27 Jul 2026 11:28:41 +0200 Subject: [PATCH 2/3] github: split nixos tests to different jobs This allows us to retry a single job when some flakyness is happening, instead of having to retry all jobs Signed-off-by: Stefan Kober On-behalf-of: SAP stefan.kober@sap.com --- .github/workflows/qa.yml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index 8862344..c3341fd 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -9,7 +9,7 @@ jobs: - uses: cachix/install-nix-action@v31 - name: Nix Flake Checks run: nix flake check --all-systems - nixos-tests: + nixos-basic-test: runs-on: large_runner_16core_64gb steps: - uses: actions/checkout@v6 @@ -28,6 +28,22 @@ jobs: - name: Basic setup run: | nix run .#tests.x86_64-linux.openstack-default-setup.driver + nixos-live-migration-test: + runs-on: large_runner_16core_64gb + steps: + - uses: actions/checkout@v6 + - uses: cachix/install-nix-action@v31 + - uses: cachix/cachix-action@v17 + with: + name: openstack-nix + authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}" + - name: Build + run: | + set -euxo pipefail + nix build --show-trace \ + --option max-jobs 1 \ + --option cores 4 \ + .#tests.x86_64-linux.openstack-live-migration.driver - name: Live migration run: | nix run .#tests.x86_64-linux.openstack-live-migration.driver From 5c6e239c38ac0ef990a63146f60eec13cea459af Mon Sep 17 00:00:00 2001 From: Stefan Kober Date: Mon, 27 Jul 2026 11:52:10 +0200 Subject: [PATCH 3/3] github: harden workflow permissions Signed-off-by: Stefan Kober On-behalf-of: SAP stefan.kober@sap.com --- .github/workflows/qa.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index c3341fd..8c759b1 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -1,5 +1,7 @@ name: QA on: [ pull_request ] +permissions: + contents: read jobs: flake-check: name: Nix Flake Checks @@ -32,6 +34,8 @@ jobs: runs-on: large_runner_16core_64gb steps: - uses: actions/checkout@v6 + with: + persist-credentials: false - uses: cachix/install-nix-action@v31 - uses: cachix/cachix-action@v17 with: