ci: drop vestigial nix-daemon stop step in nix-eval

.github/actions/nix-install-ephemeral/action.yml

@@ -5,6 +5,10 @@ inputs:
     description: AWS region for the Nix binary cache S3 bucket
     required: false
     default: us-east-1
+  installer:
+    description: upstream (default) or determinate
+    required: false
+    default: upstream
   nix-signing-key:
     description: Key used to sign uploads to binary cache, required if push-to-cache is true
     required: false
@@ -49,6 +53,7 @@ runs:
       env:
         AWS_REGION: ${{ inputs.aws-region }}
         GITHUB_TOKEN: ${{ github.token }}
+        INSTALLER: ${{ inputs.installer }}
         NIX_SIGN_SECRET_KEY: ${{ inputs.nix-signing-key }}
         PUSH_TO_CACHE: ${{ steps.resolve-push-to-cache.outputs.value }}
 

.github/actions/nix-install-ephemeral/setup-nix.sh

@@ -31,6 +31,7 @@ cat >"$tmpdir/nix.conf" <<-EOF
 	extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
 	extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
 	max-jobs = 5
+	stalled-download-timeout = 5
 EOF
 
 if [[ -e /dev/kvm ]]; then
@@ -46,8 +47,16 @@ fi
 
 maybesudo NIXCONFDIR="$nixconfdir" ./setup-github-access.sh >>"$tmpdir/nix.conf"
 
-curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- $daemon --yes --nix-extra-conf-file "$tmpdir/nix.conf"
-cat "$nixconfdir/nix.conf"
+if [[ ${INSTALLER:-upstream} == determinate ]]; then
+	echo 'extra-experimental-features = parallel-eval' >>"$tmpdir/nix.conf"
+	url=https://install.determinate.systems/nix/tag/v3.22.4
+	args=(install --no-confirm --extra-conf "$tmpdir/nix.conf")
+else
+	url=https://releases.nixos.org/nix/nix-2.34.6/install
+	args=("$daemon" --yes --nix-extra-conf-file "$tmpdir/nix.conf")
+fi
+curl --proto '=https' --tlsv1.2 -sSfL "$url" | sh -s -- "${args[@]}"
+cat "$nixconfdir"/nix*.conf
 
 # Add nix to PATH for subsequent steps
 echo "$path" >>"${GITHUB_PATH:?}"

.github/workflows/nix-build.yml

@@ -19,44 +19,106 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  nix-eval:
+  nix-eval-x86_64-linux:
+    name: Nix Eval (x86_64-linux)
     runs-on: blacksmith-32vcpu-ubuntu-2404
     outputs:
       packages_matrix: ${{ steps.gen-matrix.outputs.packages_matrix }}
       checks_matrix: ${{ steps.gen-matrix.outputs.checks_matrix }}
     steps:
       - name: Checkout Repo
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Install nix
+        uses: ./.github/actions/nix-install-ephemeral
+        with:
+          installer: determinate
+          push-to-cache: true
+          nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
+
+      - name: Evaluate flake (parallel)
+        run: |
+          set -Eeu -o pipefail
+          ./scripts/parallel-nix-eval-jobs.sh | tee jobs.jsonl
 
+      - name: Generate Nix Matrix
+        id: gen-matrix
+        run: |
+          set -Eeu -o pipefail
+          nix run .#github-matrix -- --stdout <jobs.jsonl | tee matrix.json
+          echo "packages_matrix=$(jq -c .packages.x86_64_linux matrix.json)" >>"$GITHUB_OUTPUT"
+          echo "checks_matrix=$(jq -c .checks.x86_64_linux matrix.json)" >>"$GITHUB_OUTPUT"
+
+  nix-eval-aarch64-linux:
+    name: Nix Eval (aarch64-linux)
+    runs-on: blacksmith-32vcpu-ubuntu-2404-arm
+    outputs:
+      packages_matrix: ${{ steps.gen-matrix.outputs.packages_matrix }}
+      checks_matrix: ${{ steps.gen-matrix.outputs.checks_matrix }}
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Install nix
         uses: ./.github/actions/nix-install-ephemeral
         with:
+          installer: determinate
           push-to-cache: true
           nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
 
+      - name: Evaluate flake (parallel)
+        run: |
+          set -Eeu -o pipefail
+          ./scripts/parallel-nix-eval-jobs.sh | tee jobs.jsonl
+
       - name: Generate Nix Matrix
         id: gen-matrix
         run: |
           set -Eeu -o pipefail
-          nix run --accept-flake-config .\#github-matrix -- checks legacyPackages
+          nix run .#github-matrix -- --stdout <jobs.jsonl | tee matrix.json
+          echo "packages_matrix=$(jq -c .packages.aarch64_linux matrix.json)" >>"$GITHUB_OUTPUT"
+          echo "checks_matrix=$(jq -c .checks.aarch64_linux matrix.json)" >>"$GITHUB_OUTPUT"
+
+  nix-eval-aarch64-darwin:
+    name: Nix Eval (aarch64-darwin)
+    runs-on: blacksmith-6vcpu-macos-26
+    outputs:
+      packages_matrix: ${{ steps.gen-matrix.outputs.packages_matrix }}
+      checks_matrix: ${{ steps.gen-matrix.outputs.checks_matrix }}
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Install nix
+        uses: ./.github/actions/nix-install-ephemeral
+        with:
+          installer: determinate
+          push-to-cache: true
+          nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
+
+      - name: Evaluate flake (parallel)
+        run: |
+          set -Eeu -o pipefail
+          ./scripts/parallel-nix-eval-jobs.sh | tee jobs.jsonl
 
-          sudo systemctl stop nix-daemon.socket || true
-          sudo systemctl stop nix-daemon.service || true
-          sudo pkill -9 nix-daemon || true
-          sleep 2
+      - name: Generate Nix Matrix
+        id: gen-matrix
+        run: |
+          set -Eeu -o pipefail
+          nix run .#github-matrix -- --stdout <jobs.jsonl | tee matrix.json
+          echo "packages_matrix=$(jq -c .packages.aarch64_darwin matrix.json)" >>"$GITHUB_OUTPUT"
+          echo "checks_matrix=$(jq -c .checks.aarch64_darwin matrix.json)" >>"$GITHUB_OUTPUT"
 
   nix-build-packages-aarch64-linux:
     name: >-
       ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }}
       (aarch64-linux)
-    needs: nix-eval
+    needs: nix-eval-aarch64-linux
     runs-on: ${{ matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }}
-    if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_linux != null }}
     strategy:
       fail-fast: false
       max-parallel: 25
-      matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_linux }}
+      matrix: ${{ fromJSON(needs.nix-eval-aarch64-linux.outputs.packages_matrix) }}
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
@@ -79,14 +141,13 @@ jobs:
       ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }}
       (aarch64-linux)
     needs:
-      - nix-eval
+      - nix-eval-aarch64-linux
       - nix-build-packages-aarch64-linux
     runs-on: ${{ matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }}
-    if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_linux != null }}
     strategy:
       fail-fast: false
       max-parallel: 25
-      matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_linux }}
+      matrix: ${{ fromJSON(needs.nix-eval-aarch64-linux.outputs.checks_matrix) }}
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
@@ -108,13 +169,12 @@ jobs:
     name: >-
       ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }}
       (aarch64-darwin)
-    needs: nix-eval
+    needs: nix-eval-aarch64-darwin
     runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }}
-    if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_darwin != null }}
     strategy:
       fail-fast: false
       max-parallel: 25
-      matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_darwin }}
+      matrix: ${{ fromJSON(needs.nix-eval-aarch64-darwin.outputs.packages_matrix) }}
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
@@ -140,14 +200,13 @@ jobs:
       ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }}
       (aarch64-darwin)
     needs:
-      - nix-eval
+      - nix-eval-aarch64-darwin
       - nix-build-packages-aarch64-darwin
     runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }}
-    if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_darwin != null }}
     strategy:
       fail-fast: false
       max-parallel: 25
-      matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_darwin }}
+      matrix: ${{ fromJSON(needs.nix-eval-aarch64-darwin.outputs.checks_matrix) }}
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
@@ -169,13 +228,12 @@ jobs:
     name: >-
       ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }}
       (x86_64-linux)
-    needs: nix-eval
+    needs: nix-eval-x86_64-linux
     runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }}
-    if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).x86_64_linux != null }}
     strategy:
       fail-fast: false
       max-parallel: 25
-      matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).x86_64_linux }}
+      matrix: ${{ fromJSON(needs.nix-eval-x86_64-linux.outputs.packages_matrix) }}
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
@@ -198,14 +256,13 @@ jobs:
       ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }}
       (x86_64-linux)
     needs:
-      - nix-eval
+      - nix-eval-x86_64-linux
       - nix-build-packages-x86_64-linux
     runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }}
-    if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).x86_64_linux != null }}
     strategy:
       fail-fast: false
       max-parallel: 25
-      matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).x86_64_linux }}
+      matrix: ${{ fromJSON(needs.nix-eval-x86_64-linux.outputs.checks_matrix) }}
     steps:
       - name: Checkout Repo
         if: ${{ matrix.attr != '' }}
@@ -237,24 +294,60 @@ jobs:
           jq -rn --argjson needs '${{ toJSON(needs) }}' '$needs|to_entries[]|select(.value.result!="success")|"::error::"+.key+": "+.value.result'
           exit 1
 
-  run-testinfra:
-    needs:
-      - nix-eval
-      - nix-build-packages-aarch64-linux
-      - nix-build-packages-aarch64-darwin
-      - nix-build-packages-x86_64-linux
+  run-testinfra-aarch64-linux:
+    needs: nix-build-packages-aarch64-linux
     uses: ./.github/workflows/testinfra-ami-build.yml
+    with:
+      arch: arm64
     secrets:
       DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
       NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
 
-  run-tests:
+  run-testinfra-x86_64-linux:
+    needs: nix-build-packages-x86_64-linux
+    uses: ./.github/workflows/testinfra-ami-build.yml
+    with:
+      arch: amd64
+    secrets:
+      DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
+      NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
+
+  report-disk-usage:
     needs:
-      - nix-eval
-      - nix-build-packages-aarch64-linux
-      - nix-build-packages-aarch64-darwin
-      - nix-build-packages-x86_64-linux
+      - run-testinfra-aarch64-linux
+      - run-testinfra-x86_64-linux
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Download AMI disk usage
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: ami-disk-usage-*
+          path: ami-disk-usage
+          merge-multiple: true
+
+      - name: Report AMI disk usage
+        run: |
+          cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+          ### AMI Root Disk Usage
+
+          | Version | Arch | Human | Bytes |
+          | ------- | ---- | ----- | ----- |
+          EOF
+          cat ami-disk-usage/ami-disk-usage-*.json |
+          sort -V |
+          jq -rs '.[]|{version,arch,human,bytes}|"| \(join("|")) |"' >>"$GITHUB_STEP_SUMMARY"
+
+  run-tests-aarch64-linux:
+    needs: nix-build-packages-aarch64-linux
+    uses: ./.github/workflows/test.yml
+    with:
+      arch: arm64
+
+  run-tests-x86_64-linux:
+    needs: nix-build-packages-x86_64-linux
     uses: ./.github/workflows/test.yml
+    with:
+      arch: amd64
 
   docker-image-test:
     needs: nix-build-packages-aarch64-linux
@@ -270,8 +363,11 @@ jobs:
     needs:
       - docker-image-test
       - nix-build-checks
-      - run-testinfra
-      - run-tests
+      - report-disk-usage
+      - run-testinfra-aarch64-linux
+      - run-testinfra-x86_64-linux
+      - run-tests-aarch64-linux
+      - run-tests-x86_64-linux
     steps:
       - name: Check dependent job results
         if: contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped')

.github/workflows/test.yml

@@ -1,7 +1,19 @@
 name: Test Database
 on:
   workflow_dispatch:
+    inputs:
+      arch:
+        type: choice
+        options:
+          - amd64
+          - arm64
+        required: true
   workflow_call:
+    inputs:
+      arch:
+        description: amd64 or arm64
+        type: string
+        required: true
 
 permissions:
   contents: read
@@ -12,6 +24,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
+      runner: ${{ steps.set-runner.outputs.runner }}
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
@@ -21,17 +34,23 @@ jobs:
         run: |
           VERSIONS=$(nix run nixpkgs#yq-go -- -o=json -I=0 '.postgres_major' ansible/vars.yml)
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
+      - name: Set runner
+        id: set-runner
+        env:
+          ARCH: ${{ inputs.arch }}
+        run: |
+          case "$ARCH" in
+            amd64) runner=large-linux-x86 ;;
+            arm64) runner=large-linux-arm ;;
+            *) echo "::error::unknown arch '$ARCH'"; exit 1 ;;
+          esac
+          echo "runner=$runner" >> "$GITHUB_OUTPUT"
   build:
     needs: prepare
     strategy:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
-        include:
-          - runner: large-linux-x86
-            arch: amd64
-          - runner: large-linux-arm
-            arch: arm64
-    runs-on: ${{ matrix.runner }}
+    runs-on: ${{ needs.prepare.outputs.runner }}
     timeout-minutes: 180
     env:
       POSTGRES_PORT: 5478