Continuous deployment

You can have NixCI automatically deploy your code after a suite succeeds.

To activate the continuous deployment mechanism, add a deploy section to your NixCI configuration.

For example, this example deployment configures the packages.x86_64-linux.deploy-to-prod package to be run as a deployment:

{
  deploy = {
    example = {
      package = "packages.x86_64-linux.deploy-to-prod";
    };
  };
}

In particular, NixCI will nix run packages.x86_64-linux.deploy-to-prod, which will execute the package's meta.mainProgram.

Deployments can access secrets and SSH keys as environment variables. See the Secrets & SSH Keys documentation for how to declare and use them.

NixCI also automatically provides git metadata as environment variables during deployments.

deploy: # optional
  # default: {}
  # Deploy Configurations
  <key>: 
    # DeployConfiguration
    enable: # optional
      # default: true
      # enable this deployment
      <boolean>
    package: # required
      # package of which the main program will be run
      <string>
    system: # optional
      # system on which the deployment will be run
      <string>
    branches: # optional
      # default: :default
      # branches from which may be deployed
      # any of
      [ # one of
        [ # the branches to run on, with nothing excluded
          # any of
          [ # every ref
            :any
          , # the repository's default branch
            :default
          , # a branch name, or a glob pattern: * matches within one segment, ** across them, ? a single character
            <string>
          , # every ref; deprecated, write :any instead
            any
          , # every ref; deprecated, write :any instead
            all
          , # the repository's default branch; deprecated, write :default instead
            default
          , - # any of
              [ # every ref
                :any
              , # the repository's default branch
                :default
              , # a branch name, or a glob pattern: * matches within one segment, ** across them, ? a single character
                <string>
              , # every ref; deprecated, write :any instead
                any
              , # every ref; deprecated, write :any instead
                all
              , # the repository's default branch; deprecated, write :default instead
                default
              ]
          ]
        , # BranchFilter
          run-on: # optional
            # default: :any
            # branches to run on
            # any of
            [ # every ref
              :any
            , # the repository's default branch
              :default
            , # a branch name, or a glob pattern: * matches within one segment, ** across them, ? a single character
              <string>
            , # every ref; deprecated, write :any instead
              any
            , # every ref; deprecated, write :any instead
              all
            , # the repository's default branch; deprecated, write :default instead
              default
            , - # any of
                [ # every ref
                  :any
                , # the repository's default branch
                  :default
                , # a branch name, or a glob pattern: * matches within one segment, ** across them, ? a single character
                  <string>
                , # every ref; deprecated, write :any instead
                  any
                , # every ref; deprecated, write :any instead
                  all
                , # the repository's default branch; deprecated, write :default instead
                  default
                ]
            ]
          do-not-run-on: # optional
            # default: []
            # branches not to run on, even when they are in "run-on"
            # any of
            [ # every ref
              :any
            , # the repository's default branch
              :default
            , # a branch name, or a glob pattern: * matches within one segment, ** across them, ? a single character
              <string>
            , # every ref; deprecated, write :any instead
              any
            , # every ref; deprecated, write :any instead
              all
            , # the repository's default branch; deprecated, write :default instead
              default
            , - # any of
                [ # every ref
                  :any
                , # the repository's default branch
                  :default
                , # a branch name, or a glob pattern: * matches within one segment, ** across them, ? a single character
                  <string>
                , # every ref; deprecated, write :any instead
                  any
                , # every ref; deprecated, write :any instead
                  all
                , # the repository's default branch; deprecated, write :default instead
                  default
                ]
            ]
        ]
      , # true means every ref, false means none
        <boolean>
      ]
    in-repo: # optional
      # Run the job in a checkout of the repository at the right revision
      # default: False
      # Setting this to false is more efficient if the job doesn't need to access to git history.
      # You can use ${self} to refer to the flake source if you need access to the repository contents at the current commit only.
      <boolean>
    secrets: # optional
      # default: []
      # secrets provided to the deployment
      - <string>
    ssh-keys: # optional
      # default: []
      # ssh keys provided to the deployment
      - # SshKeyConfiguration
        secret: # required
          # name of the secret on NixCI to use as the private key
          <string>
        public-key: # required
          # public key of the ssh key
          <string>