ci: add Copilot cloud agent setup workflow #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Copilot Setup Steps" | |
| # Prepares the agent's filesystem snapshot with: | |
| # - Nix + flakes enabled | |
| # - firefly-toolbox cachix substituter wired in /etc/nix/nix.conf | |
| # - The dev shell's full closure pre-fetched into /nix/store | |
| # - direnv loaded, so the turnkey enterShell hook has run (and therefore | |
| # .buckconfig is a live symlink, .turnkey/* cells are materialized, | |
| # and go-deps.toml / rust-deps.toml are in sync with go.mod / Cargo.lock) | |
| # | |
| # Job name must be "copilot-setup-steps" — Copilot won't pick it up otherwise. | |
| on: | |
| workflow_dispatch: | |
| push: | |
| paths: [.github/workflows/copilot-setup-steps.yml] | |
| pull_request: | |
| paths: [.github/workflows/copilot-setup-steps.yml] | |
| jobs: | |
| copilot-setup-steps: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Nix (with flakes) | |
| uses: DeterminateSystems/nix-installer-action@main | |
| with: | |
| extra-conf: | | |
| experimental-features = nix-command flakes | |
| accept-flake-config = true | |
| - name: Wire firefly-toolbox cachix substituter | |
| uses: cachix/cachix-action@v15 | |
| with: | |
| name: firefly-toolbox | |
| # No authToken: read-only pull from the public cache. | |
| # This writes the substituter + public key to /etc/nix/nix.conf | |
| # so every subsequent `nix develop` invocation uses it without | |
| # depending on the flake's nixConfig trust prompt. | |
| - name: Pre-fetch dev-shell closure | |
| run: nix develop --accept-flake-config --command true | |
| - name: Install direnv + nix-direnv | |
| run: | | |
| nix profile install --accept-flake-config \ | |
| nixpkgs#direnv nixpkgs#nix-direnv | |
| mkdir -p ~/.config/direnv | |
| echo "source $HOME/.nix-profile/share/nix-direnv/direnvrc" \ | |
| > ~/.config/direnv/direnvrc | |
| - name: Trigger turnkey enterShell hook | |
| # `direnv exec . true` loads .envrc (`use flake .`), which fires the | |
| # devenv shell activation including turnkey's enterShell hook. | |
| # That hook materializes .turnkey/* symlinks, links .buckconfig to | |
| # the Nix-generated config, and syncs go-deps.toml / rust-deps.toml. | |
| run: | | |
| direnv allow . | |
| direnv exec . true | |
| # Sanity check: the agent will find the tools turnkey provisions. | |
| direnv exec . bash -c 'command -v buck2 bw tk jj go cargo' | |
| - name: Expose dev-shell PATH + env to the agent | |
| # The agent inherits $GITHUB_ENV from the snapshot, so populating it | |
| # here lets the agent invoke tools directly without `direnv exec`. | |
| run: | | |
| direnv exec . env \ | |
| | grep -E '^(PATH|GOPATH|GOCACHE|CARGO_HOME|RUSTUP_HOME|DEVENV_|TURNKEY_)=' \ | |
| >> "$GITHUB_ENV" |