Skip to content

ci: make the reproducibility gate able to fail #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zah wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: make the reproducibility gate able to fail #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 32 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -286,12 +286,40 @@ jobs:

- name: Test reproducible builds
run: |
set -euo pipefail

nix build .#rust-echo-service -o result-1
nix build .#attestation-agent -o result-2
nix build .#rust-echo-service -o result-1-rebuild
nix build .#attestation-agent -o result-2-rebuild
diff -r result-1 result-1-rebuild || echo "Build not reproducible for rust-echo-service"
diff -r result-2 result-2-rebuild || echo "Build not reproducible for attestation-agent"

# `--rebuild` re-executes the derivation and makes Nix compare the fresh
# output against the one already in the store. Without it the second
# `nix build` is a no-op that resolves to the *same* store path, so the
# comparison below would trivially succeed no matter what.
nix build .#rust-echo-service --rebuild -o result-1-rebuild
nix build .#attestation-agent --rebuild -o result-2-rebuild

# A differing pair prints the full diff (diagnostics) and makes the step
# exit non-zero. This gate must never report success on a real diff.
pairs=(
"rust-echo-service|result-1|result-1-rebuild"
"attestation-agent|result-2|result-2-rebuild"
)
rc=0
for entry in "${pairs[@]}"; do
IFS='|' read -r component first second <<< "$entry"
echo "=== Reproducibility check: $component ($first vs $second) ==="
if diff -r "$first" "$second"; then
echo "OK: $component is reproducible"
else
echo "FAIL: build not reproducible for $component (diff shown above)"
rc=1
fi
done

if [ "$rc" -ne 0 ]; then
echo "Reproducibility gate failed: at least one component produced differing outputs."
fi
exit "$rc"

- name: Upload documentation
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
Expand Down
Loading