Improve pipelines

[blackheaven]

• Save latest hsec-tools as artifact
• Reuse artifact to check new advisories
  • Only run on new/changed advisories
• Don't rebuild hsec-tools on new advisories

For reference, I squeezed the docker image: https://gautier.difolco.dev/2023-07/nix-docker-optimization/

[blackheaven]

Eventually!

@frasertweedale can you have a look please?

[akacase]

@blackheaven -- This is great! I like the docker addition. Should we strive for parity by also adding a Dockerfile in the main repository to replicate (sort of) what we have in Nix?

[blackheaven]

It could be a good idea.

At some point, we also might publish GitHub packages too.

[frasertweedale]

@blackheaven I promise I haven't forgotten about this PR :) I shall re-review it this week.

[mihaimaruseac]

We need to resolve the nix conflict.

[blackheaven]

I'll handle it tomorrow morning

[blackheaven]

Ready :)

[frasertweedale]

haskell-ci regenerate fails because the patch does not apply. (I'm using haskell-ci v1.6.3). I'll look into it tomorrow, if I can find some time.

[frasertweedale]

I think the following haskell-ci.patch will achieve the desired result (that is, regenerates and cleanly applies the patch to haskell-ci.yml resulting unchanged file content).

diff --git a/.github/workflows/haskell-ci.yml b/.github/workflows/haskell-ci.yml
index 96282c2..e40c573 100644
--- a/.github/workflows/haskell-ci.yml
+++ b/.github/workflows/haskell-ci.yml
@@ -19,6 +19,21 @@
 jobs:
+  tools_changed:
+    continue-on-error: true
+    runs-on: ubuntu-20.04
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/[email protected]
+        with:
+          concurrent_skipping: "never"
+          skip_after_successful_duplicate: "true"
+          paths: '["code/**"]'
+          do_not_skip: '["push", "workflow_dispatch", "schedule"]'
   linux:
     name: Haskell-CI - Linux - ${{ matrix.compiler }}
+    needs: tools_changed
+    if: ${{ needs.tools_changed.outputs.should_skip != 'true' }}
     runs-on: ubuntu-20.04
     timeout-minutes:
       60

When the regenerate issue is resolved feel free to merge it. I am still not 100% convinced that everything will work as intended (same doubts as in previous comments). But it's hard to fit all the cases in my head, so I think it's best to merge and then we can observe the changes in action.

[blackheaven]

I'll handle main build failure