refactor: cleanup main

.gitattributes

@@ -0,0 +1,3 @@
+vendor/** filter=git-crypt diff=git-crypt
+.envrc filter=git-crypt diff=git-crypt
+nix-overlays/kakadu/v8_4_1-01382N.zip filter=git-crypt diff=git-crypt

.github/actions/checkout/action.yml

@@ -4,6 +4,9 @@ inputs:
   DASCHBOT_PAT:
     description: "daschbot's private access token"
     required: true
+  GIT_CRYPT_KEY:
+    description: "The key to decrypt files with git-crypt"
+    required: true
 
 runs:
   using: "composite"
@@ -12,6 +15,10 @@ runs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0
+    - name: Unlock secrets
+      uses: sliteteam/[email protected]
+      env:
+        GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
     - name: checkout private ci-assets
       uses: actions/checkout@v4
       with:

.github/workflows/docker-build.yml

@@ -19,15 +19,16 @@ jobs:
       - uses: dasch-swiss/sipi/.github/actions/checkout@main
         with:
           DASCHBOT_PAT: ${{ secrets.DASCHBOT_PAT }}
+      - uses: extractions/setup-just@v1
       - uses: dasch-swiss/sipi/.github/actions/setup-python@main
       - run: make install-requirements
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
-      - run: make docker-test-build-amd64 # two stage build, where test is run in the first stage
-      - run: make test-smoke-ci
+      - run: just docker-build-amd64 # two stage build, where test is run in the first stage
+      - run: just smoke-test-ci
 
   # Docker build for aarch64
   build_aarch64:
@@ -37,27 +38,34 @@ jobs:
       group: ${{ github.ref }}-docker-build-aarch64
       cancel-in-progress: true
     steps:
-      - uses: dasch-swiss/sipi/.github/actions/checkout@main
+      - name: checkout source
+        uses: actions/checkout@v4
         with:
-          DASCHBOT_PAT: ${{ secrets.DASCHBOT_PAT }}
+          fetch-depth: 0
+      - name: Unlock secrets
+        uses: sliteteam/[email protected]
+        env:
+          GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
+      - uses: extractions/setup-just@v1
       - uses: dasch-swiss/sipi/.github/actions/setup-python@main
       - run: make install-requirements
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
-      - run: make docker-test-build-aarch64 # two stage build, where test is run in the first stage
-      - run: make test-smoke-ci
+      - run: just docker-build-aarch64 # two stage build, where test is run in the first stage
+      - run: just smoke-test-ci
 
   # build documentation
   build_docs:
     name: docs test run
     runs-on: ubuntu-latest
     steps:
-      - uses: dasch-swiss/sipi/.github/actions/checkout@main
+      - name: checkout source
+        uses: actions/checkout@v4
         with:
-          DASCHBOT_PAT: ${{ secrets.DASCHBOT_PAT }}
+          fetch-depth: 0
       - uses: dasch-swiss/sipi/.github/actions/setup-python@main
       - run: make docs-install-requirements
       - run: make docs-build

.github/workflows/publish.yml

@@ -13,9 +13,14 @@ jobs:
       group: ${{ github.ref }}-publish-amd64
       cancel-in-progress: true
     steps:
-      - uses: dasch-swiss/sipi/.github/actions/checkout@main
+      - name: checkout source
+        uses: actions/checkout@v4
         with:
-          DASCHBOT_PAT: ${{ secrets.DASCHBOT_PAT }}
+          fetch-depth: 0
+      - name: Unlock secrets
+        uses: sliteteam/[email protected]
+        env:
+          GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
       - uses: dasch-swiss/sipi/.github/actions/setup-python@main
       - run: make install-requirements
       - uses: docker/setup-buildx-action@v3
@@ -36,9 +41,14 @@ jobs:
       group: ${{ github.ref }}-publish-aarch64
       cancel-in-progress: true
     steps:
-      - uses: dasch-swiss/sipi/.github/actions/checkout@main
+      - name: checkout source
+        uses: actions/checkout@v4
         with:
-          DASCHBOT_PAT: ${{ secrets.DASCHBOT_PAT }}
+          fetch-depth: 0
+      - name: Unlock secrets
+        uses: sliteteam/[email protected]
+        env:
+          GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
       - uses: dasch-swiss/sipi/.github/actions/setup-python@main
       - run: make install-requirements
       - uses: docker/setup-buildx-action@v3

.github/workflows/test.yml

@@ -29,24 +29,24 @@ jobs:
         compiler: [ gcc ]
         runs-on: [ buildjet-4vcpu-ubuntu-2204, buildjet-4vcpu-ubuntu-2204-arm ]
     steps:
-      - uses: dasch-swiss/sipi/.github/actions/checkout@main
+      - name: checkout source
+        uses: actions/checkout@v4
         with:
-          DASCHBOT_PAT: ${{ secrets.DASCHBOT_PAT }}
+          fetch-depth: 0
+      - uses: extractions/setup-just@v1
       - uses: cachix/install-nix-action@v26
         with:
+          nix_path: nixpkgs=channel:nixos-unstable
           github_access_token: ${{ secrets.GH_TOKEN }}
-      - run: |
-          nix \
-            --extra-experimental-features "nix-command flakes" \
-            --option filter-syscalls false \
-            develop --command bash -c "cmake -S . -B ./build -DCODE_COVERAGE=ON -DCMAKE_BUILD_TYPE=Debug --log-context && cmake --build ./build --parallel 4 && cd build && ctest --output-on-failure"
+      - name: fix git config
+        run: |
+          git config --global --unset http.proxy
+          git config --global --unset https.proxy
+      - name: Build and run tests
+        run: nix develop --command bash -c "cmake -S . -B ./build -DCODE_COVERAGE:BOOL=ON -DCMAKE_BUILD_TYPE:STRING=Debug --log-context && cmake --build ./build --parallel 4 && ctest --test-dir ./build/test --parallel --output-on-failure"
       - name: Gather code coverage
         if: ${{ matrix.runs-on == 'buildjet-4vcpu-ubuntu-2204' }}
-        run: |
-          nix \
-            --extra-experimental-features "nix-command flakes" \
-            --option filter-syscalls false \
-            develop --command bash -c "cd build && gcovr -j 1 --delete --root ../ --print-summary --xml-pretty --xml coverage.xml . --gcov-executable gcov --gcov-ignore-parse-errors=negative_hits.warn_once_per_file"
+        run: nix develop --command bash -c "cd build && gcovr -j 1 --delete --root ../ --print-summary --xml-pretty --xml coverage.xml . --gcov-executable gcov --gcov-ignore-parse-errors=negative_hits.warn_once_per_file"
       - name: Upload coverage reports to Codecov
         if: ${{ matrix.runs-on == 'buildjet-4vcpu-ubuntu-2204' }}
         uses: codecov/[email protected]

.gitignore

@@ -21,6 +21,7 @@ sipi
 sipi.log*
 /extsrcs/
 .direnv/
+/tmp/
 
 target
 __pycache__/
@@ -43,6 +44,7 @@ cmake-build-debug-inside-docker/
 cmake-build-dockerdebug/
 cmake-build-relwithdebinfo-inside-docker/
 cmake-build-relwithdebinfo-nix-develop/
+result/
 # ignore cache
 cache/
 
@@ -62,3 +64,4 @@ icc.zip
 /coverage
 /coverage.info
 *.gcov
+result