hcloud-dev.yaml

name: Hcloud Dev

on:
  workflow_dispatch: {}
  schedule:
  - cron: '0 6  * * MON,TUE,WED,THU,FRI'

jobs:
  create-runner:
    name: Create Hetzner Cloud Runner
    runs-on: ubuntu-latest
    outputs:
      server-name: ${{ steps.create-runner.outputs.server-name }}
    steps:
    - name: Create Hetzner Runner
      id: create-runner
      uses: Kwarf/hetzner-ephemeral-runner@v1
      with:
        action: create
        github-token: ${{ secrets.GH_TOKEN_HETZNER_RUNNER }}
        hetzner-token: ${{ secrets.HCLOUD_TOKEN }}
        server-location: hel1
        server-type: cx42

  start:
    permissions:
      contents: read
      id-token: write
    needs: create-runner
    runs-on: ${{ needs.create-runner.outputs.server-name }}
    steps:
    - uses: actions/checkout@v4

    - uses: google-github-actions/auth@v2
      with:
        project_id: hallowed-port-433217-t0
        workload_identity_provider: projects/507949509448/locations/global/workloadIdentityPools/github/providers/world
        export_environment_variables: 'true'
        create_credentials_file: 'true'

    - name: Set up Cloud SDK
      uses: google-github-actions/setup-gcloud@v2

    - uses: DeterminateSystems/nix-installer-action@v14
      with:
        extra-conf: |
          accept-flake-config = true

    - name: Run the Magic Nix Cache
      uses: DeterminateSystems/magic-nix-cache-action@v8

    - name: Tofu Apply
      id: tofu
      env:
        HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
        TAILSCALE_API_KEY: ${{ secrets.TAILSCALE_API_KEY }}
        CLOUD_DISK_PASSWORD: ${{ secrets.CLOUD_DISK_PASSWORD }}
        HCLOUD_DEV_SSH_HOSTKEY: ${{ secrets.HCLOUD_DEV_SSH_HOSTKEY }}
        HCLOUD_DEV_SSH_INITRD_KEY: ${{ secrets.HCLOUD_DEV_SSH_INITRD_KEY }}
        TF_VAR_server_type: cx22
        HOME: /root
      run: |
        id -u || echo unknown
        nix shell nixpkgs#jq nixpkgs#bashInteractive --command bash <<NIXSH
        TF_VAR_kexec_tarball="$(nix build .#kexec-installer-nixos-unstable-noninteractive --print-out-paths --no-link)/nixos-kexec-installer-noninteractive-x86_64-linux.tar.gz"
        export TF_VAR_kexec_tarball
        cd tofu/dev
        echo "------- RUN TOFU INIT -------"
        nix run .#tofuWithPlugins -- init
        echo "------- RUN TOFU APPLY -------"
        nix run .#tofuWithPlugins -- apply -auto-approve
        NIXSH
        echo "------- GET REMOTE IP -------"
        echo remote_ip="$(nix run .#tofuWithPlugins -- output -raw dev_ip)" >> "$GITHUB_OUTPUT"

    - name: Unlock
      env:
        SSH_KEY: ${{ secrets.GH_SSH_INITRD_AUTHKEY }}
        CLOUD_DISK_PASSWORD: ${{ secrets.CLOUD_DISK_PASSWORD }}
        REMOTE_IP: ${{ steps.tofu.outputs.remote_ip }}
      run: |
        nix run .#unlockremote

  remove-runner:
    name: Remove runner
    needs:
      - create-runner
      - start
    runs-on: ubuntu-latest
    if: ${{ always() }}
    steps:
    - name: Remove runner
      uses: Kwarf/hetzner-ephemeral-runner@v1
      with:
        action: remove
        github-token: ${{ secrets.GH_TOKEN_HETZNER_RUNNER }}
        hetzner-token: ${{ secrets.HCLOUD_TOKEN }}
        server-name: ${{ needs.create-runner.outputs.server-name }}