ci: build kernels with nix build

Author: JakeHillion

.github/workflows/build-kernel.nix

@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, fetchgit
+, virtme-ng
+, linuxManualConfig
+, linuxPackages_latest
+, name
+, repo
+, branch
+, commitHash
+, narHash
+, version
+}:
+
+let
+  src = fetchgit {
+    url = repo;
+    rev = commitHash;
+    branchName = branch;
+
+    hash = narHash;
+  };
+
+  configfile = stdenv.mkDerivation {
+    inherit src;
+    name = name + "-configfile";
+
+    buildInputs = linuxPackages_latest.kernel.buildInputs;
+    nativeBuildInputs = linuxPackages_latest.kernel.nativeBuildInputs;
+
+    buildPhase = ''
+      ${virtme-ng}/bin/virtme-ng -v --kconfig --config ${./sched-ext.config}
+    '';
+    installPhase = ''
+      mv .config $out
+    '';
+  };
+
+in
+linuxManualConfig {
+  inherit src version configfile;
+}

.github/workflows/flake.nix

@@ -11,39 +11,29 @@
 
   outputs = { self, nixpkgs, flake-utils, nix-develop-gha, ... }:
     flake-utils.lib.eachSystem [ "x86_64-linux" ]
-      (system: {
-        packages.nix-develop-gha = nix-develop-gha.packages."${system}".default;
-
-        devShells =
-          let
-            pkgs = import nixpkgs { inherit system; };
-            common = with pkgs; [ gnutar zstd ];
-          in
-          {
+      (system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+        in
+        {
+          devShells = let common = with pkgs; [ gnutar zstd ]; in {
             update-kernels = pkgs.mkShell {
               buildInputs = with pkgs; common ++ [
                 jq
               ];
             };
+          };
 
-            build-kernel = pkgs.mkShell {
-              buildInputs = with pkgs; common ++ [
-                bc
-                bison
-                cpio
-                elfutils
-                flex
-                git
-                jq
-                openssl
-                pahole
-                perl
-                virtme-ng
-                zlib
-              ];
-            };
+          packages = {
+            kernels = builtins.mapAttrs
+              (name: details: (pkgs.callPackage ./build-kernel.nix {
+                inherit name;
+                inherit (details) repo branch commitHash narHash;
+                version = details.kernelVersion;
+              }))
+              (builtins.fromJSON (builtins.readFile ./../../kernel-versions.json));
           };
-      }) // flake-utils.lib.eachDefaultSystem (system:
+        }) // flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = import nixpkgs { inherit system; };
       in
@@ -60,6 +50,8 @@
                 pyproject = false;
                 dontUnpack = true;
 
+                dependencies = with pkgs; [ gnumake ];
+
                 installPhase = "install -Dm755 ${./update-kernels.py} $out/bin/update-kernels";
               };
             in

.github/workflows/update-kernels.py

@@ -17,6 +17,25 @@ def get_hash_for_repo_branch(repo, branch):
     return result.stdout.split("\t")[0]
 
 
+def get_nar_hash_and_version(repo, branch, hash):
+    result = subprocess.run(
+        ["nix", "flake", "prefetch", "--json", f"git+{repo}?ref={branch}&rev={hash}"],
+        check=True,
+        stdout=subprocess.PIPE,
+        text=True,
+    )
+    j = json.loads(result.stdout)
+
+    result = subprocess.run(
+        ["make", "kernelversion"],
+        cwd=j["storePath"],
+        check=True,
+        stdout=subprocess.PIPE,
+        text=True,
+    )
+    return (j["hash"], result.stdout.rstrip())
+
+
 if __name__ == "__main__":
     parser = argparse.ArgumentParser(description="Update kernel locks")
     parser.add_argument(
@@ -51,6 +70,10 @@ def get_hash_for_repo_branch(repo, branch):
         v["commitHash"] = new_hash
         v["lastModified"] = int(time.time())
 
+        (narHash, kver) = get_nar_hash_and_version(v["repo"], v["branch"], v["commitHash"])
+        v["narHash"] = narHash
+        v["kernelVersion"] = kver
+
         diff = True
 
     if not diff:

kernel-versions.json

@@ -3,18 +3,24 @@
     "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext.git",
     "branch": "for-next",
     "commitHash": "d780271744822e3b8daf08416514d0296f235b98",
-    "lastModified": 1742302520
+    "lastModified": 1742305077,
+    "narHash": "sha256-75seLIhtyG+C8a/2xT0HkbHSXrhaAArfzwDFR6l1A5k=",
+    "kernelVersion": "6.13.0"
   },
   "bpf/bpf-next": {
     "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git",
     "branch": "master",
     "commitHash": "f3f8649585a445414521a6d5b76f41b51205086d",
-    "lastModified": 1742302520
+    "lastModified": 1742305078,
+    "narHash": "sha256-c3CIPMt27J6Y2MKAyc0WF7crY2HITilWOSjCEFQleww=",
+    "kernelVersion": "6.14.0-rc3"
   },
   "stable/linux-rolling-stable": {
     "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
     "branch": "linux-rolling-stable",
     "commitHash": "d2ac0b15a0ef6dc8ec73cd748ecf2919a265b0be",
-    "lastModified": 1742302520
+    "lastModified": 1742305155,
+    "narHash": "sha256-4Q3liUWBdP9RFDqec59I+hwBX7NHFP2EZD2ImFv1DVc=",
+    "kernelVersion": "6.13.7"
   }
 }