feat/optimize matrix (docker)

.github/generate-matrix/action.yml

@@ -20,18 +20,17 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Nix
-      uses: cachix/install-nix-action@v25
-      with:
-        extra_nix_config: accept-flake-config = true
+    - name: Pull Docker Image
+      shell: bash
+      run: docker pull ghcr.io/metacraft-labs/docker-ci:latest
 
     - name: Generate CI Matrix
       id: generate-matrix
       shell: bash
       env:
         IS_INITIAL: ${{ inputs.is-initial }}
         CACHIX_CACHE: ${{ inputs.cachix-cache }}
-      run: nix develop .#ci -c ./scripts/ci-matrix.sh
+      run: docker run -v "$(pwd)":/mnt ghcr.io/metacraft-labs/docker-ci:latest ci
 
     - name: Upload CI Matrix
       uses: actions/upload-artifact@v4

.github/workflows/ci.yml

@@ -58,6 +58,7 @@ jobs:
         uses: cachix/install-nix-action@v25
         with:
           extra_nix_config: accept-flake-config = true
+          install_url: "https://releases.nixos.org/nix/nix-2.19.3/install"
 
       - uses: cachix/cachix-action@v14
         with:

packages/all-packages.nix

@@ -104,75 +104,82 @@
     };
     polkadot = polkadot-generic {};
     polkadot-fast = polkadot-generic {enableFastRuntime = true;};
+    minimalPkgs = callPackage ./minimal-packages/default.nix {};
+    ci-matrix = callPackage ./ci-matrix/default.nix {inherit minimalPkgs;};
   in {
-    legacyPackages.metacraft-labs =
-      rec {
-        gaiad = callPackage ./gaiad {};
-        cosmos-theta-testnet = callPackage ./cosmos-theta-testnet {inherit gaiad;};
-        blst = callPackage ./blst {};
-        bnb-beacon-node = callPackage ./bnb-beacon-node {};
-
-        circom = callPackage ./circom/default.nix {craneLib = craneLib-stable;};
-        circ = callPackage ./circ/default.nix {craneLib = craneLib-stable;};
-
-        emscripten = pkgs.emscripten.overrideAttrs (old: {
-          postInstall = ''
-            pushd $TMPDIR
-            echo 'int __main_argc_argv() { return 42; }' >test.c
-            for MEM in "-s ALLOW_MEMORY_GROWTH" ""; do
-              for LTO in -flto ""; do
-                for OPT in "-O2" "-O3" "-Oz" "-Os"; do
-                  $out/bin/emcc $MEM $LTO $OPT -s WASM=1 -s STANDALONE_WASM test.c
+    legacyPackages = {
+      metacraft-labs =
+        rec {
+          gaiad = callPackage ./gaiad {};
+          cosmos-theta-testnet = callPackage ./cosmos-theta-testnet {inherit gaiad;};
+          blst = callPackage ./blst {};
+          bnb-beacon-node = callPackage ./bnb-beacon-node {};
+
+          circom = callPackage ./circom/default.nix {craneLib = craneLib-stable;};
+          circ = callPackage ./circ/default.nix {craneLib = craneLib-stable;};
+
+          emscripten = pkgs.emscripten.overrideAttrs (old: {
+            postInstall = ''
+              pushd $TMPDIR
+              echo 'int __main_argc_argv() { return 42; }' >test.c
+              for MEM in "-s ALLOW_MEMORY_GROWTH" ""; do
+                for LTO in -flto ""; do
+                  for OPT in "-O2" "-O3" "-Oz" "-Os"; do
+                    $out/bin/emcc $MEM $LTO $OPT -s WASM=1 -s STANDALONE_WASM test.c
+                  done
                 done
               done
-            done
-          '';
-        });
+            '';
+          });
 
-        go-opera = callPackage ./go-opera/default.nix {};
+          go-opera = callPackage ./go-opera/default.nix {};
 
-        circom_runtime = callPackage ./circom_runtime/default.nix {};
+          circom_runtime = callPackage ./circom_runtime/default.nix {};
 
-        # Polkadot
-        inherit polkadot polkadot-fast;
+          # Polkadot
+          inherit polkadot polkadot-fast;
 
-        avalanche-cli = callPackage ./avalanche-cli/default.nix {};
+          avalanche-cli = callPackage ./avalanche-cli/default.nix {};
 
-        inherit corepack-shims;
-      }
-      // lib.optionalAttrs hostPlatform.isLinux rec {
-        wasmd = callPackage ./wasmd/default.nix {};
+          inherit corepack-shims;
+        }
+        // lib.optionalAttrs hostPlatform.isLinux rec {
+          wasmd = callPackage ./wasmd/default.nix {};
 
-        # Solana
-        solana-rust-artifacts = callPackage ./solana-rust-artifacts {};
+          # Solana
+          solana-rust-artifacts = callPackage ./solana-rust-artifacts {};
 
-        solana-bpf-tools = callPackage ./solana-bpf-tools {};
+          solana-bpf-tools = callPackage ./solana-bpf-tools {};
 
-        solana = callPackage ./solana-full-sdk {
-          inherit solana-rust-artifacts solana-bpf-tools;
-        };
+          solana = callPackage ./solana-full-sdk {
+            inherit solana-rust-artifacts solana-bpf-tools;
+          };
+
+          inherit cryptography36;
+
+          inherit py-ecc;
+          # inherit erdpy elrond-go elrond-proxy-go;
+
+          # EOS / Antelope
+          leap = callPackage ./leap/default.nix {};
+          eos-vm = callPackage ./eos-vm/default.nix {};
+          cdt = callPackage ./cdt/default.nix {};
+        }
+        // lib.optionalAttrs hostPlatform.isx86 rec {
+          inherit zqfield-bn254 ffiasm ffiasm-src rapidsnark;
 
-        inherit cryptography36;
-
-        inherit py-ecc;
-        # inherit erdpy elrond-go elrond-proxy-go;
-
-        # EOS / Antelope
-        leap = callPackage ./leap/default.nix {};
-        eos-vm = callPackage ./eos-vm/default.nix {};
-        cdt = callPackage ./cdt/default.nix {};
-      }
-      // lib.optionalAttrs hostPlatform.isx86 rec {
-        inherit zqfield-bn254 ffiasm ffiasm-src rapidsnark;
-
-        inherit cardano graphql;
-      }
-      // lib.optionalAttrs (hostPlatform.isx86 && hostPlatform.isLinux) rec {
-        pistache = callPackage ./pistache/default.nix {};
-        inherit zqfield-bn254;
-        rapidsnark-server = callPackage ./rapidsnark-server/default.nix {
-          inherit ffiasm zqfield-bn254 rapidsnark pistache;
+          inherit cardano graphql;
+        }
+        // lib.optionalAttrs (hostPlatform.isx86 && hostPlatform.isLinux) rec {
+          pistache = callPackage ./pistache/default.nix {};
+          inherit zqfield-bn254;
+          rapidsnark-server = callPackage ./rapidsnark-server/default.nix {
+            inherit ffiasm zqfield-bn254 rapidsnark pistache;
+          };
         };
-      };
+
+      inherit ci-matrix;
+      docker-image = callPackage ./docker-image/default.nix {inherit ci-matrix minimalPkgs;};
+    };
   };
 }

packages/avalanche-cli/default.nix

@@ -1,7 +1,7 @@
 {pkgs}:
 with pkgs;
   buildGoModule rec {
-    pname = "avalanche-cli";
+    pname = "test1234-avalanche-cli";
     version = "1.3.7";
 
     src = fetchFromGitHub {

packages/ci-matrix/default.nix

@@ -0,0 +1,38 @@
+{
+  pkgs,
+  minimalPkgs,
+}: let
+in
+  with pkgs;
+    minimalPkgs.stdenv.mkDerivation rec {
+      pname = "ci-matrix";
+      version = "N/A";
+
+      src = ../../scripts;
+
+      buildInputs = [minimalPkgs.bash minimalPkgs.glibc];
+
+      buildPhase = ''
+        cp $src/{ci-matrix,nix-eval-jobs,system-info}.sh .
+        sed -i 's|jq|${minimalPkgs.jq}/bin/jq|' *.sh
+        sed -i 's|nix-eval-jobs |${minimalPkgs.nix-eval-jobs}/bin/nix-eval-jobs |' *.sh
+        sed -i 's|"$root_dir/scripts/|"'$out'/bin/|' *.sh
+      '';
+      installPhase = ''
+        mkdir -p $out/bin
+        cp {ci-matrix,nix-eval-jobs,system-info}.sh $out/bin'';
+
+      postFixup = ''
+        sed -i 's|${pkgs.bash}|${bash}|' $out/bin/*
+      '';
+
+      doCheck = false;
+
+      passthru = {
+        jq = minimalPkgs.jq;
+        nix-eval-jobs = minimalPkgs.nix-eval-jobs;
+        nix = minimalPkgs.nix;
+      };
+
+      meta.mainProgram = "ci-matrix.sh";
+    }

packages/docker-image/default.nix

@@ -0,0 +1,138 @@
+{
+  pkgs,
+  dockerTools,
+  cacert,
+  ci-matrix,
+  minimalPkgs,
+  replaceDependency,
+}: let
+  image = (dockerTools.override {jq = minimalPkgs.jq;}).buildImageWithNixDb {
+    name = "ghcr.io/metacraft-labs/docker-ci";
+    tag = "latest";
+
+    contents = with pkgs; [
+      ./root
+      (replaceDependency
+        {
+          drv = minimalPkgs.bash;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      (replaceDependency
+        {
+          drv = minimalPkgs.gnugrep;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      (replaceDependency
+        {
+          drv = minimalPkgs.git;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      (replaceDependency
+        {
+          drv = minimalPkgs.jq;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      (replaceDependency
+        {
+          drv = minimalPkgs.nix;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      (replaceDependency
+        {
+          drv = minimalPkgs.nix-eval-jobs;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      (replaceDependency
+        {
+          drv = minimalPkgs.coreutils;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      (writeTextFile {
+        name = "nix.conf";
+        destination = "/etc/nix/nix.conf";
+        text = ''
+          accept-flake-config = true
+          experimental-features = nix-command flakes
+          filter-syscalls = false
+        '';
+      })
+
+      # runtime dependencies of nix
+      (replaceDependency
+        {
+          drv = pkgs.cacert;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      # for our ci
+      # cachix
+      (replaceDependency
+        {
+          drv = ci-matrix;
+          oldDependency = pkgs.glibc;
+          newDependency = minimalPkgs.glibc;
+        })
+
+      (replaceDependency
+        {
+          drv =
+            writeShellScriptBin "ci"
+            ''
+              cd /mnt
+              export CACHIX_CACHE=mcl-blockchain-packages
+              git config --global --add safe.directory /mnt
+              ci-matrix.sh
+            '';
+          oldDependency = pkgs.bash;
+          newDependency = minimalPkgs.bash;
+        })
+    ];
+
+    extraCommands = ''
+      # for /usr/bin/env
+      mkdir usr
+      ln -s ../bin usr/bin
+
+      # make sure /tmp exists
+      mkdir -m 1777 tmp
+
+      # need a HOME
+      mkdir -vp root
+    '';
+
+    config = {
+      Cmd = ["/bin/bash"];
+      Env = [
+        "ENV=/etc/profile.d/nix.sh"
+        "BASH_ENV=/etc/profile.d/nix.sh"
+        "NIX_BUILD_SHELL=/bin/bash"
+        "NIX_PATH=nixpkgs=${./fake_nixpkgs}"
+        "PAGER=cat"
+        "PATH=/usr/bin:/bin"
+        "SSL_CERT_FILE=${(replaceDependency
+          {
+            drv = pkgs.cacert;
+            oldDependency = pkgs.glibc;
+            newDependency = minimalPkgs.glibc;
+          })}/etc/ssl/certs/ca-bundle.crt"
+        "USER=root"
+      ];
+    };
+  };
+in
+  image

packages/docker-image/fake_nixpkgs/default.nix

@@ -0,0 +1,10 @@
+_:
+throw ''
+  This container doesn't include nixpkgs.
+
+  The best way to work around that is to pin your dependencies. See
+    https://nix.dev/tutorials/first-steps/towards-reproducibility-pinning-nixpkgs.html
+
+  Or if you must, override the NIX_PATH environment variable with eg:
+    "NIX_PATH=nixpkgs=channel:nixos-unstable"
+''

packages/docker-image/root/etc/group

@@ -0,0 +1,21 @@
+root:x:0:
+wheel:x:1:
+kmem:x:2:
+tty:x:3:
+messagebus:x:4:
+disk:x:6:
+audio:x:17:
+floppy:x:18:
+uucp:x:19:
+lp:x:20:
+cdrom:x:24:
+tape:x:25:
+video:x:26:
+dialout:x:27:
+utmp:x:29:
+adm:x:55:
+keys:x:96:
+users:x:100:
+input:x:174:
+nixbld:x:30000:nixbld1,nixbld10,nixbld11,nixbld12,nixbld13,nixbld14,nixbld15,nixbld16,nixbld17,nixbld18,nixbld19,nixbld2,nixbld20,nixbld21,nixbld22,nixbld23,nixbld24,nixbld25,nixbld26,nixbld27,nixbld28,nixbld29,nixbld3,nixbld30,nixbld31,nixbld32,nixbld4,nixbld5,nixbld6,nixbld7,nixbld8,nixbld9
+nogroup:x:65534: