style(glazewm): inner_gap = 0 / title bar 非表示 / borders を Rose Pine 化 #136
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nix flake check | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'nix/**' | |
| - 'configs/**' | |
| - 'secrets/**' | |
| - 'scripts/**' | |
| - 'windows/**' | |
| - 'Justfile' | |
| - '.statix.toml' | |
| - '.github/workflows/check.yml' | |
| pull_request: | |
| paths: | |
| - 'nix/**' | |
| - 'configs/**' | |
| - 'secrets/**' | |
| - 'scripts/**' | |
| - 'windows/**' | |
| - 'Justfile' | |
| - '.statix.toml' | |
| schedule: | |
| # 月曜 09:00 JST = 00:00 UTC — flake.lock が古くなってないか確認 | |
| - cron: '0 0 * * 1' | |
| workflow_dispatch: # 手動 trigger 用 | |
| # 同じ branch の連続 push で前の run を cancel | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| flake-check: | |
| name: nix flake check | |
| runs-on: macos-14 # Apple Silicon | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@v22 | |
| # nix store cache: 同じ flake.lock の間は再 download 不要 | |
| - name: Cache nix store | |
| uses: nix-community/cache-nix-action@v6 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('nix/flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-macos: 5G | |
| purge: true | |
| purge-prefixes: nix-${{ runner.os }}- | |
| purge-created: 0 | |
| purge-last-accessed: 0 | |
| purge-primary-key: never | |
| - name: nix flake check (syntax/eval) | |
| run: nix flake check ./nix --no-build --show-trace | |
| build-darwin: | |
| name: build darwinConfigurations (dry) | |
| runs-on: macos-14 | |
| timeout-minutes: 30 | |
| needs: flake-check | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: DeterminateSystems/nix-installer-action@v22 | |
| - uses: nix-community/cache-nix-action@v6 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('nix/flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| - name: Build darwinConfigurations.<user> (no activation) | |
| run: | | |
| USER_NAME=$(nix eval --raw -f ./nix/user.nix username) | |
| echo "Building for username: $USER_NAME" | |
| nix build "./nix#darwinConfigurations.$USER_NAME.system" --dry-run --show-trace | |
| build-home: | |
| name: build homeConfigurations (dry) | |
| runs-on: macos-14 | |
| timeout-minutes: 30 | |
| needs: flake-check | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: DeterminateSystems/nix-installer-action@v22 | |
| - uses: nix-community/cache-nix-action@v6 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('nix/flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| - name: Build homeConfigurations.<user> (no activation) | |
| run: | | |
| USER_NAME=$(nix eval --raw -f ./nix/user.nix username) | |
| echo "Building for username: $USER_NAME" | |
| nix build "./nix#homeConfigurations.$USER_NAME.activationPackage" --dry-run --show-trace | |
| # pre-commit (gitleaks protect --staged) は --no-verify で飛ばせるため、 | |
| # CI 側で全履歴を gitleaks detect して二重化する。 | |
| gitleaks: | |
| name: gitleaks (full history scan) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # 全コミット履歴を取得 (detect は履歴を走査するため必須) | |
| - name: gitleaks detect | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITLEAKS_CONFIG: ${{ github.workspace }}/.gitleaks.toml | |
| # pre-commit フック (git-hooks.nix 宣言) をリポ全体に実行。 | |
| # nixfmt-rfc-style / deadnix / gitleaks を nix/ + templates 含め検査。 | |
| pre-commit: | |
| name: pre-commit (nixfmt / deadnix) | |
| runs-on: macos-14 | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: DeterminateSystems/nix-installer-action@v22 | |
| - uses: nix-community/cache-nix-action@v6 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('nix/flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| - name: pre-commit run --all-files | |
| run: nix develop ./nix --command pre-commit run --all-files --show-diff-on-failure | |
| # pre-commit に含めない enforced 外リンタを CI で gate する。 | |
| # 全ツールを devShell 経由 (nix develop) で実行し flake.lock の nixpkgs にバージョン固定 | |
| # → ローカルと CI のバージョン差を防ぐ (just --fmt の {{x}} vs {{ x }} 問題の根本対策)。 | |
| # - just --summary: Justfile パース検証 (整形は just のバージョン依存のため gate にしない) | |
| # - statix: Nix アンチパターン (repeated_keys は誤検出のため .statix.toml で除外) | |
| # - shellcheck: 全 .sh を error 重大度で gate (warning/info は既存資産が多いため除外) | |
| # - stylua: nvim 配下の lua 整形 (uosc/yazi 等の vendored は対象外) | |
| # - taplo/jq/yq: toml/json/yaml の構文検証 (設定破損の即検知) | |
| lint: | |
| name: lint (just / statix / shellcheck / stylua / 構文) | |
| runs-on: macos-14 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: DeterminateSystems/nix-installer-action@v22 | |
| - uses: nix-community/cache-nix-action@v6 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('nix/flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| - name: just --summary (Justfile パース検証) | |
| run: nix develop ./nix --command just --summary | |
| - name: statix check (Nix アンチパターン) | |
| run: nix develop ./nix --command statix check -c .statix.toml nix | |
| - name: shellcheck (全 .sh の error gate) | |
| run: nix develop ./nix --command shellcheck -S error $(git ls-files '*.sh') | |
| - name: stylua --check (nvim lua 整形) | |
| run: nix develop ./nix --command stylua --check configs/editors/nvim/ | |
| - name: TOML 構文 (taplo) | |
| run: nix develop ./nix --command taplo check $(git ls-files '*.toml') | |
| - name: JSON 構文 (jq) | |
| run: nix develop ./nix --command bash -c 'for f; do jq empty "$f"; done' _ $(git ls-files '*.json') | |
| - name: YAML 構文 (yq) | |
| run: nix develop ./nix --command bash -c 'for f; do yq -e "." "$f" >/dev/null; done' _ $(git ls-files '*.yml' '*.yaml') | |
| # Windows native (PowerShell 7) — bootstrap の DryRun セルフテスト + 静的解析。 | |
| # 実 install を走らせず、構文 / 解析 / 計画ログだけで Windows side の壊れを検知する。 | |
| windows-check: | |
| name: windows (parse / bootstrap -DryRun / PSScriptAnalyzer) | |
| runs-on: windows-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: PowerShell parse (全 .ps1) | |
| shell: pwsh | |
| run: | | |
| $fail = $false | |
| Get-ChildItem windows -Recurse -Filter '*.ps1' | ForEach-Object { | |
| $e = $null | |
| $null = [System.Management.Automation.Language.Parser]::ParseFile($_.FullName, [ref]$null, [ref]$e) | |
| if ($e) { | |
| Write-Host "::error file=$($_.FullName)::parse failed" | |
| $e | Format-List | Out-String | Write-Host | |
| $fail = $true | |
| } else { | |
| Write-Host "OK $($_.FullName)" | |
| } | |
| } | |
| if ($fail) { exit 1 } | |
| - name: bootstrap.ps1 -DryRun (副作用なし全 step 確認) | |
| shell: pwsh | |
| run: ./windows/bootstrap.ps1 -DryRun | |
| - name: PSScriptAnalyzer (Severity Warning 以上で fail) | |
| shell: pwsh | |
| run: | | |
| Install-Module PSScriptAnalyzer -Force -Scope CurrentUser -SkipPublisherCheck | |
| Invoke-ScriptAnalyzer -Path windows -Recurse -Severity Warning -EnableExit -Settings windows/PSScriptAnalyzerSettings.psd1 |