Publish build artifacts on s3 #529

	name: 'Partner Chains Smart Contracts CI'
	on:
	pull_request:
	push:
	branches:
	- master
	- develop
	workflow_dispatch:

	env:
	AWS_DEFAULT_REGION: eu-central-1

	jobs:
	build-x64-linux:
	permissions:
	id-token: write
	contents: read
	runs-on: [ self-hosted, Linux ]
	env:
	# Modify this value to "invalidate" the cabal cache.
	CABAL_CACHE_VERSION: "2024-11-14"
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	token: ${{ github.token }}

	- name: Add signing key for nix
	run: echo "${{ secrets.NIX_SIGNING_KEY }}" > "${{ runner.temp }}/nix-key"

	- name: Lint sources
	run: \|
	nix flake check

	- name: Build onchain
	run: \|
	cd onchain
	nix develop --command "make"

	- name: Build offchain
	run: \|
	cd offchain
	nix develop --command "make"

	- name: Build raw scripts crate
	run: \|
	cd raw-scripts
	nix develop --command "make"

	- name: Acquire AWS credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
	aws-region: ${{ env.AWS_DEFAULT_REGION }}

	- name: Upload zip to S3
	run: \|
	nix-shell --run "aws s3 cp offchain/build/release.zip s3://pcsc-bucket/${GITHUB_SHA}.zip --region $AWS_DEFAULT_REGION"

	- name: Copy nix scopes to nix cache
	run: \|
	nix build .#devShells.x86_64-linux.default --dry-run --json \| jq -r '.[] \| .drvPath + "^*"' \
	\| nix copy --stdin --to "s3://cache.sc.iog.io?secret-key=${{ runner.temp }}/nix-key&region=$AWS_DEFAULT_REGION"

Provide feedback