tiiuae / ghaf

TII SSRC Secure Technologies: Ghaf Framework
https://tiiuae.github.io/ghaf/
Apache License 2.0
39 stars 58 forks source link

build.yml: Use nix-fast-build to build on remote #874

Closed henrirosten closed 6 days ago

henrirosten commented 6 days ago

Description of changes

Start using nix-fast-build in the build.yml workflow to execute all build operations completely on the remote end.

Removes the step 'Maximize space available on rootfs' since with nix-fast-build, we no longer download the full build closure on the github-hosted runner. Furthermore, with the --no-download option, we also skip the download of the final build result (ghaf image), so we no longer need to free up the storage on the github runner.

This change also removes the upload to https://ghaf-dev.cachix.org from the build workflow: it is no longer needed, since builds are already cached on the remote builders' local nix store. Jenkins builds will take care of uploading the build binaries to a separate nix binary cache, maintained with ghaf-infra.

With the above summarized changes, build times on the build.yml workflow will significantly reduce. It should also completely remove the hash mismatch issues on the build workflow as builds and also evaluation operations are executed on the remote.

This change was tested on a fork, as an example, see: https://github.com/henrirosten/ghaf/actions/runs/11587433044.

Checklist for things done

Instructions for Testing