Skip to content

ci: scope Nix Build workflow to flake and dependency changes #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sangwa merged 1 commit into from
Mar 26, 2026
Merged

ci: scope Nix Build workflow to flake and dependency changes #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/nix-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ name: Nix Build
on:
pull_request:
branches: [main]
paths-ignore:
- "*.md"
- "**/*.md"
- LICENSE
- NOTICE
paths:
- flake.nix
- flake.lock
- go.mod
- go.sum

permissions: {}

Expand Down
4 changes: 2 additions & 2 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -445,8 +445,8 @@ When `go.mod` or `go.sum` change, the `vendorHash` in `flake.nix` must be update
## CI/CD

- **CI** (`.github/workflows/ci.yml`) — runs on pushes to non-main branches: `go fmt` check, `go test` with `DNSSEC_LIVE_TEST=1`, `go vet`, `go build`. Skipped for doc-only changes (`*.md`, `LICENSE`, `NOTICE`).
- **Nix Build** (`.github/workflows/nix-build.yml`) — runs on PRs targeting main: `nix build .#docker-image` (runs offline test suite via `doCheck`). Catches flake breakage before merge. Skipped for doc-only changes (`*.md`, `LICENSE`, `NOTICE`).
- Branch protection on main should require both `Test` and `Build` status checks to pass. If using GitHub rulesets, mark them as "skippable" so doc-only PRs are not blocked when the Nix Build workflow is skipped by `paths-ignore`.
- **Nix Build** (`.github/workflows/nix-build.yml`) — runs on PRs targeting main only when Nix or Go dependency files change (`flake.nix`, `flake.lock`, `go.mod`, `go.sum`). Pure Go source changes are already covered by CI; the Nix build catches flake recipe breakage and `vendorHash` mismatches.
- Branch protection on main should require both `Test` and `Build` status checks to pass. If using GitHub rulesets, mark them as "skippable" so PRs without Nix/dependency changes are not blocked when the Nix Build workflow is skipped by `paths`.
- **Release** (`.github/workflows/release.yml`) — runs on push to main, three sequential jobs:
1. **Build** — `nix build .#docker-image` (runs tests via `doCheck`), uploads image tarball as artifact
2. **Release** — Release Please creates/updates a release PR; on merge, creates a GitHub Release + tag
Expand Down