[buoh/ci] ci: Add Nix based build test

[Jan Tojnar <jtojnar src gnome org>]

commit 2322da1e071074a07e384844c274665931eaa1eb
Author: Jan Tojnar <jtojnar gmail com>
Date:   Thu Aug 30 12:59:12 2018 +0200

    ci: Add Nix based build test
    
    This will try to build Docker image based on nixos/nix [1] containing
    all the build dependencies, then the upload the built image to container
    registry [2]. Finally the image will be used to build the package using
    Nix.
    
    [1]: https://hub.docker.com/r/nixos/nix/
    [2]: https://gitlab.com/help/user/project/container_registry

 ci/Dockerfile     |  5 +++++
 ci/build-image.sh | 21 +++++++++++++++++++++
 ci/gitlab-ci.yaml | 22 ++++++++++++++++++++++
 3 files changed, 48 insertions(+)
---
diff --git a/ci/Dockerfile b/ci/Dockerfile
new file mode 100644
index 0000000..b9ab6a4
--- /dev/null
+++ b/ci/Dockerfile
@@ -0,0 +1,5 @@
+FROM nixos/nix
+ARG EXPRESSION_HASH=unknown
+LABEL ExpressionHash=$EXPRESSION_HASH
+COPY default.nix /project/
+RUN cd /project && nix-shell --run ':'
diff --git a/ci/build-image.sh b/ci/build-image.sh
new file mode 100755
index 0000000..4c957be
--- /dev/null
+++ b/ci/build-image.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# usage: build-image.sh <job-token> <image-tag>
+
+alias jq="docker run -i stedolan/jq"
+alias skopeo="docker run -i alexeiled/skopeo skopeo"
+
+CI_JOB_TOKEN=$1
+IMAGE_TAG=$2
+
+NIX_EXPRESSION_HASH=$(sha256sum default.nix | cut -f 1 -d ' ')
+IMAGE_EXPRESSION_HASH=$(skopeo inspect "docker://$IMAGE_TAG" | jq '.Labels.ExpressionHash')
+
+if test "$NIX_EXPRESSION_HASH" = "$IMAGE_EXPRESSION_HASH"; then
+  echo 'Image already up to date, skipping build…'
+else
+  echo 'Building Docker image…'
+  docker login -u gitlab-ci-token -p "$CI_JOB_TOKEN" "$CI_REGISTRY"
+  docker build -t "$IMAGE_TAG" . -f ci/Dockerfile --build-arg "EXPRESSION_HASH=$NIX_EXPRESSION_HASH"
+  docker push "$IMAGE_TAG"
+fi
diff --git a/ci/gitlab-ci.yaml b/ci/gitlab-ci.yaml
new file mode 100644
index 0000000..4399e9e
--- /dev/null
+++ b/ci/gitlab-ci.yaml
@@ -0,0 +1,22 @@
+image: docker:stable
+
+services:
+  - docker:dind
+
+variables:
+  DOCKER_HOST: tcp://docker:2375
+  DOCKER_DRIVER: overlay2
+
+# Ideally, we would generate a new image whenever the derivation for
+# default.nix changes, but we would not be able to pass the tag name
+# to the “build” job. For now, we just remove the image from
+# the registry manually when rebuild is needed.
+
+build_image:
+  stage: build
+  script: ci/build-image.sh "$CI_JOB_TOKEN" "$CI_REGISTRY_IMAGE:latest"
+
+build:
+  stage: test
+  image: $CI_REGISTRY_IMAGE:latest
+  script: nix-build