test-nixos.yaml

# SPDX-License-Identifier: MIT

on:
  push:
    branches:
      - cidev
  workflow_dispatch:

env:
  REPO_USERNAME: ${{ github.actor }}
  REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read

jobs:
  test-nixos:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@main

      - name: Install Nix
        uses: nixbuild/nix-quick-install-action@master
        with:
          nix_conf: |
            experimental-features = nix-command flakes
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o= nixbuild.net/CHEAKK-1:IvfuR1Ldmkef8pMcSuCl9N2jppEb8KpBzdoB8uKQdxE= nix-csi.cachix.org-1:i4w33gR4efO67jpz8U7g/MdvRQ6mQ3LEF9fB8tES60g=
            builders = ssh-ng://eu.nixbuild.net aarch64-linux ; ssh-ng://eu.nixbuild.net x86_64-linux
            substituters = https://cache.nixos.org?priority=1 https://nix-csi.cachix.org?priority=2 https://cache.lix.systems?priority=3 ssh-ng://eu.nixbuild.net?priority=4
            sandbox = relaxed

      - name: Configure SSH Keys
        shell: bash
        run: |
          echo "${{ secrets.NIXBUILD_KEY }}" | install -D -m 600 /dev/stdin ~/.ssh/nixbuild_key
          install -m 644 "${{ github.workspace }}/.github/assets/ssh-config" ~/.ssh/config

      - name: Debug - GHA runner network state (before)
        shell: bash
        run: |
          echo "=== IP Addresses ==="
          ip addr
          echo ""
          echo "=== Routing Table ==="
          ip route
          echo ""
          echo "=== Network Interfaces ==="
          ip link
          echo ""
          echo "=== Iptables Rules (filter) ==="
          sudo iptables -L -v
          echo ""
          echo "=== Iptables Rules (nat) ==="
          sudo iptables -t nat -L -v
          echo ""
          echo "=== Iptables Rules (mangle) ==="
          sudo iptables -t mangle -L -v
          echo ""
          echo "=== Netstat listening ports ==="
          sudo ss -tlnp || netstat -tlnp || echo "ss/netstat not available"
          echo ""
          echo "=== Kernel IP forwarding ==="
          cat /proc/sys/net/ipv4/ip_forward

      - name: Start nixos test (background)
        run: |
          nix run --file . nixosNatTest.containerd.driverInteractive --option sandbox false -- --no-interactive > /tmp/test.log 2>&1 &
          echo $! > /tmp/test.pid
          echo "Test running in background (PID: $(cat /tmp/test.pid))"
          sleep 5

      - name: Setup upterm session (test runs in parallel)
        uses: owenthereal/action-upterm@v1
        with:
          wait-timeout-minutes: 5
          limit-access-to-actor: true

      - name: Wait for test to complete
        run: |
          TEST_PID=$(cat /tmp/test.pid)
          if wait $TEST_PID; then
            echo "✓ Test passed"
          else
            echo "✗ Test failed with exit code: $?"
          fi
          echo ""
          echo "=== Test Output ==="
          tail -100 /tmp/test.log

      - name: Debug - GHA runner network state (after)
        if: failure()
        shell: bash
        run: |
          echo "=== IP Addresses ==="
          ip addr
          echo ""
          echo "=== Routing Table ==="
          ip route
          echo ""
          echo "=== Network Interfaces ==="
          ip link
          echo ""
          echo "=== Iptables Rules (filter) ==="
          sudo iptables -L -v
          echo ""
          echo "=== Iptables Rules (nat) ==="
          sudo iptables -t nat -L -v
          echo ""
          echo "=== Iptables Rules (mangle) ==="
          sudo iptables -t mangle -L -v
          echo ""
          echo "=== Check for vde interfaces ==="
          ip link | grep -i vde || echo "No vde interfaces found"
          echo ""
          echo "=== Kernel IP forwarding ==="
          cat /proc/sys/net/ipv4/ip_forward
          echo ""
          echo "=== Dmesg last 50 lines ==="
          sudo dmesg | tail -50

      - name: Setup upterm session
        if: failure()
        uses: owenthereal/action-upterm@v1