From a1de5fd714abce27ee4dec806a7d99f3cd11f282 Mon Sep 17 00:00:00 2001
From: Simon Scatton <sscatton@nvidia.com>
Date: Tue, 9 Jun 2026 15:58:04 +0200
Subject: [PATCH] ci: factor nix build workflow action

---
 .github/actions/setup-nix/action.yml | 36 ++++++++++++++++
 .github/workflows/nix-ci.yml         | 61 +++++++++++++++-------------
 2 files changed, 68 insertions(+), 29 deletions(-)
 create mode 100644 .github/actions/setup-nix/action.yml

diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
new file mode 100644
index 000000000..db8c77fed
--- /dev/null
+++ b/.github/actions/setup-nix/action.yml
@@ -0,0 +1,36 @@
+name: Setup Nix
+description: Install Nix, configure Cachix, and build a flake target.
+
+inputs:
+  build:
+    description: Flake output namespace, such as packages or checks.
+    required: true
+  system:
+    description: Nix system to build for.
+    required: true
+  target:
+    description: Package or check target to build.
+    required: true
+  cachix_auth_token:
+    description: Cachix write token.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install Nix
+      uses: DeterminateSystems/nix-installer-action@main
+      with:
+        extra-conf: |
+          accept-flake-config = true
+
+    - name: Set up Cachix
+      uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+      with:
+        name: openshell
+        authToken: ${{ inputs.cachix_auth_token }}
+        skipAddingSubstituter: true
+
+    - name: Build target
+      shell: bash
+      run: nix build ".#${{ inputs.build }}.${{ inputs.system }}.${{ inputs.target }}" --no-link --no-update-lock-file
diff --git a/.github/workflows/nix-ci.yml b/.github/workflows/nix-ci.yml
index cb753a678..eb6d89349 100644
--- a/.github/workflows/nix-ci.yml
+++ b/.github/workflows/nix-ci.yml
@@ -28,7 +28,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: &targets
+        target:
           - system: x86_64-linux
             runner: linux-amd64-cpu8
           - system: aarch64-linux
@@ -41,26 +41,15 @@ jobs:
           - openshell-driver-podman
           - openshell-driver-vm
     steps:
-      - &checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - &install-nix
-        name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-        with:
-          extra-conf: |
-            accept-flake-config = true
-
-      - &setup-cachix
-        name: Set up Cachix
-        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        with:
-          name: openshell
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          skipAddingSubstituter: true
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Build package
-        run: nix build ".#packages.${{ matrix.target.system }}.${{ matrix.package }}" --no-link --no-update-lock-file
+        uses: ./.github/actions/setup-nix
+        with:
+          build: packages
+          system: ${{ matrix.target.system }}
+          target: ${{ matrix.package }}
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   test:
     name: Test ${{ matrix.check }} (${{ matrix.target.system }})
@@ -69,7 +58,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: *targets
+        target:
+          - system: x86_64-linux
+            runner: linux-amd64-cpu8
+          - system: aarch64-linux
+            runner: linux-arm64-cpu8
         check:
           - openshell-bootstrap-test
           - openshell-cli-test
@@ -89,12 +82,15 @@ jobs:
           - openshell-tui-test
           - openshell-vfio-test
     steps:
-      - *checkout
-      - *install-nix
-      - *setup-cachix
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Run test
-        run: nix build ".#checks.${{ matrix.target.system }}.${{ matrix.check }}" --no-link --no-update-lock-file
+        uses: ./.github/actions/setup-nix
+        with:
+          build: checks
+          system: ${{ matrix.target.system }}
+          target: ${{ matrix.check }}
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   lint:
     name: Lint ${{ matrix.lint }} (${{ matrix.target.system }})
@@ -102,7 +98,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: *targets
+        target:
+          - system: x86_64-linux
+            runner: linux-amd64-cpu8
+          - system: aarch64-linux
+            runner: linux-arm64-cpu8
         lint:
           - rustfmt
           - openshell-bootstrap-clippy
@@ -123,9 +123,12 @@ jobs:
           - openshell-tui-clippy
           - openshell-vfio-clippy
     steps:
-      - *checkout
-      - *install-nix
-      - *setup-cachix
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Run lint
-        run: nix build ".#checks.${{ matrix.target.system }}.${{ matrix.lint }}" --no-link --no-update-lock-file
+        uses: ./.github/actions/setup-nix
+        with:
+          build: checks
+          system: ${{ matrix.target.system }}
+          target: ${{ matrix.lint }}
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}