Fail if the build happens locally

[trustix-integration-tests] / checks / one-publisher.nix

diff --git a/checks/one-publisher.nix b/checks/one-publisher.nix
index 7ecec8fb125135fd7e512bd6b82202f15460bf3a..b661624c0f476e184bd43f8b30c5d9e6d3ccf67a 100644 (file)
--- a/checks/one-publisher.nix
+++ b/checks/one-publisher.nix
@@ -51,6 +51,10 @@ let
     }
   '';
 
+  log-local-builds = writeShellScript "log-local-builds" ''
+    echo "$OUT_PATHS" >> /var/log/local-builds
+  '';
+
   clientConfig = writeText "clientConfig" ''
     { lib, ... }: {
       services.trustix-nix-cache = {
@@ -76,7 +80,9 @@ let
           percentage.minimum = 66;
         };
       };
-
+      nix.extraOptions = '''
+        post-build-hook = ${log-local-builds}
+      ''';
     }
   '';
 
@@ -176,5 +182,6 @@ in nixosTest {
         "nixos-rebuild switch --show-trace",
     )
     clint.succeed("nix-build '<nixpkgs>' -A hello")
+    clint.fail("grep hello /var/log/local-builds")
   '';
 }