feat: build the container image with nix

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>

.github/workflows/container.yml

@@ -1,41 +0,0 @@
-name: Container
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-permissions:
-  packages: write
-  contents: read
-
-jobs:
-  push_to_registry:
-    name: Build and push containers image to GitHub Packages
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Set up env
-        run: echo "repository_owner=${GITHUB_REPOSITORY_OWNER,,}" >>${GITHUB_ENV}
-      - name: Build and Push Container
-        uses: docker/build-push-action@v5
-        with:
-          tags: |
-            ghcr.io/${{env.repository_owner}}/${{ github.event.repository.name }}:latest
-            matterlabsrobot/${{ github.event.repository.name }}:latest
-          push: ${{ github.event_name == 'push' ||  github.event_name == 'schedule' }}
-

.github/workflows/go.yml

@@ -1,40 +0,0 @@
-# This workflow will build a golang project
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
-
-name: Go
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-jobs:
-
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Prep
-        run: |
-          wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -
-          sudo bash -c 'echo "deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main" > /etc/apt/sources.list.d/intel-sgx.list'
-          sudo apt -o Acquire::Retries=3 update
-          sudo apt -o Acquire::Retries=3 install -y --no-install-recommends \
-            libsgx-headers \
-            libsgx-enclave-common \
-            libsgx-urts \
-            libsgx-dcap-quote-verify \
-            libsgx-dcap-quote-verify-dev
-
-      - uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.21.4
-
-      - name: Build
-        run: go build -v ./...
-
-      - name: Test
-        run: go test -v ./...

.github/workflows/nix.yml

@@ -0,0 +1,63 @@
+name: nix
+
+on:
+  pull_request:
+    branches: [ "main" ]
+  push:
+    branches: [ "main" ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ github.token }}
+      - run: nix flake check -L --show-trace --keep-going
+
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ github.token }}
+      - run: nix fmt
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ github.token }}
+      - uses: cachix/cachix-action@v14
+        continue-on-error: true
+        with:
+          name: vault-auth-tee
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          extraPullNames: nixsgx
+      - name: nix build
+        run: nix run nixpkgs#nixci
+      - name: nix docker image
+        run: |
+          nix build .#dockerImage
+          docker load -i result
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and Push Container
+        uses: docker/build-push-action@v5
+        with:
+          tags: matterlabsrobot/vault-auth-tee:latest
+          push: ${{ github.event_name == 'push' ||  github.event_name == 'schedule' }}