ci: add aarch64-linux support for checks, builds, and releases

- Update run_checks.yml to run flake checks on both x86_64-linux and aarch64-linux using matrix strategy
- Update run_build.yml to build tarballs for both architectures using matrix strategy
- Update run_validate.yml to validate both tarballs
- Update run_tests.yml to use the x86_64 tarball artifact
- Update on_release.yml to upload both nixos.wsl and nixos.aarch64.wsl with checksums
- Add aarch64 nixosConfiguration to flake.nix
- Use ubuntu-24.04 for x86 runners and ubuntu-24.04-arm for arm64 runners

.github/workflows/on_release.yml

@@ -14,16 +14,22 @@ jobs:
     needs:
       - build
     name: Create Release 📢
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - name: Download Tarball 📥
+      - name: Download x86_64 Tarball 📥
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
-          name: tarball
+          name: tarball-x86_64
+
+      - name: Download aarch64 Tarball 📥
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          name: tarball-aarch64
 
       - name: Generate Checksums 🔑
         run: |
           sha256sum nixos.wsl > nixos.wsl.sha256
+          sha256sum nixos.aarch64.wsl > nixos.aarch64.wsl.sha256
 
       - name: Attach to Release 📎
         uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
@@ -31,5 +37,7 @@ jobs:
           files: |
             nixos.wsl
             nixos.wsl.sha256
+            nixos.aarch64.wsl
+            nixos.aarch64.wsl.sha256
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/run_build.yml

@@ -5,8 +5,19 @@ on:
 
 jobs:
   tar:
-    name: Tarball 🛠️
-    runs-on: ubuntu-latest
+    name: Tarball (${{ matrix.system }}) 🛠️
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            system: x86_64
+            config: default
+            filename: nixos.wsl
+          - runner: ubuntu-24.04-arm
+            system: aarch64
+            config: aarch64
+            filename: nixos.aarch64.wsl
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -26,11 +37,11 @@ jobs:
       - name: Build Tarball 🛠️
         uses: ./.github/actions/build-wsl-tarball
         with:
-          config: default
-          filename: nixos.wsl
+          config: ${{ matrix.config }}
+          filename: ${{ matrix.filename }}
 
       - name: Upload Tarball 📤
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
-          name: tarball
-          path: nixos.wsl
+          name: tarball-${{ matrix.system }}
+          path: ${{ matrix.filename }}

.github/workflows/run_checks.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   prepare:
     name: Find Checks 🔍
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       checks: ${{ steps.checks.outputs.checks }}
     steps:
@@ -24,14 +24,22 @@ jobs:
           nix-instantiate --json --eval --strict -E 'with builtins; attrNames (getFlake (toString ./.)).checks.${currentSystem}' | perl -pe 's|(.*)|checks=\1|' >>$GITHUB_OUTPUT
 
   checks:
-    name: Flake Check ❄️
+    name: Flake Check (${{ matrix.system }}) ❄️
     needs:
       - prepare
     strategy:
       fail-fast: false
       matrix:
         check: ${{ fromJSON(needs.prepare.outputs.checks) }}
-    runs-on: ubuntu-latest
+        system:
+          - x86_64-linux
+          - aarch64-linux
+        include:
+          - system: x86_64-linux
+            runner: ubuntu-24.04
+          - system: aarch64-linux
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -43,4 +51,4 @@ jobs:
 
       - name: Run Check 📋
         run: |
-          nix build -L --impure --expr "with builtins; (getFlake (toString ./.)).checks.\${currentSystem}.${{ matrix.check }}"
+          nix build -L --impure --expr "with builtins; (getFlake (toString ./.)).checks.${{ matrix.system }}.${{ matrix.check }}"

.github/workflows/run_tests.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   prepare:
     name: Find Tests 🔍
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       tests: ${{ steps.tests.outputs.tests }}
     steps:
@@ -23,6 +23,7 @@ jobs:
         run: |
           find tests -name '*.Tests.ps1' -print0 | perl -pe 's|(.*?)\x0|"\1",|g;s|,$||;s|(.*)|tests=[\1]|' >> $GITHUB_OUTPUT
 
+  # Note: Tests only run on x86_64. The windows-11-arm runner does not support nested virtualization.
   tests:
     name: Test 🧪
     needs:
@@ -41,7 +42,7 @@ jobs:
       - name: Download Tarball 📥
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
-          name: tarball
+          name: tarball-x86_64
 
       - name: Setup WSL 🐧
         run: |

.github/workflows/run_validate.yml

@@ -5,8 +5,17 @@ on:
 
 jobs:
   validate:
-    name: Validate Tarball 🩺
-    runs-on: ubuntu-latest
+    name: Validate Tarball (${{ matrix.system }}) 🩺
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        include:
+          - system: x86_64
+            artifact: tarball-x86_64
+            filename: nixos.wsl
+          - system: aarch64
+            artifact: tarball-aarch64
+            filename: nixos.aarch64.wsl
     steps:
       - name: Checkout WSL Repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -22,9 +31,9 @@ jobs:
       - name: Download Tarball 📥
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
-          name: tarball
+          name: ${{ matrix.artifact }}
 
       - name: Validate Tarball 🩺
         shell: bash
         run: |
-          python3 distributions/validate-modern.py --tar nixos.wsl
+          python3 distributions/validate-modern.py --tar ${{ matrix.filename }}

flake.nix

@@ -34,40 +34,45 @@
       };
       nixosModules.default = self.nixosModules.wsl;
 
-      nixosConfigurations = {
-        default = lib.nixosSystem {
-          system = "x86_64-linux";
-          modules = [
-            self.nixosModules.default
-            ({ config, lib, pkgs, ... }: {
-              # This config is only used until the first nixos-rebuild. For the config installed to /etc/nixos/configuration.nix, see modules/build-tarball.nix
+      nixosConfigurations =
+        let
+          mkSystem = system: lib.nixosSystem {
+            inherit system;
+            modules = [
+              self.nixosModules.default
+              ({ config, lib, pkgs, ... }: {
+                # This config is only used until the first nixos-rebuild. For the config installed to /etc/nixos/configuration.nix, see modules/build-tarball.nix
 
-              wsl.enable = true;
+                wsl.enable = true;
 
-              programs.bash.loginShellInit = "nixos-wsl-welcome";
+                programs.bash.loginShellInit = "nixos-wsl-welcome";
 
-              # When the config is built from a flake, the NIX_PATH entry of nixpkgs is set to its flake version.
-              # Per default the resulting systems aren't flake-enabled, so rebuilds would fail.
-              # Note: This does not affect the module being imported into your own flake.
-              nixpkgs.flake.source = lib.mkForce null;
+                # When the config is built from a flake, the NIX_PATH entry of nixpkgs is set to its flake version.
+                # Per default the resulting systems aren't flake-enabled, so rebuilds would fail.
+                # Note: This does not affect the module being imported into your own flake.
+                nixpkgs.flake.source = lib.mkForce null;
 
-              systemd.tmpfiles.rules =
-                let
-                  channels = pkgs.runCommand "default-channels" { } ''
-                    mkdir -p $out
-                    ln -s ${pkgs.path} $out/nixos
-                    ln -s ${./.} $out/nixos-wsl
-                  '';
-                in
-                [
-                  "L /nix/var/nix/profiles/per-user/root/channels-1-link - - - - ${channels}"
-                  "L /nix/var/nix/profiles/per-user/root/channels - - - - channels-1-link"
-                ];
-              system.stateVersion = config.system.nixos.release;
-            })
-          ];
+                systemd.tmpfiles.rules =
+                  let
+                    channels = pkgs.runCommand "default-channels" { } ''
+                      mkdir -p $out
+                      ln -s ${pkgs.path} $out/nixos
+                      ln -s ${./.} $out/nixos-wsl
+                    '';
+                  in
+                  [
+                    "L /nix/var/nix/profiles/per-user/root/channels-1-link - - - - ${channels}"
+                    "L /nix/var/nix/profiles/per-user/root/channels - - - - channels-1-link"
+                  ];
+                system.stateVersion = config.system.nixos.release;
+              })
+            ];
+          };
+        in
+        {
+          default = mkSystem "x86_64-linux";
+          aarch64 = mkSystem "aarch64-linux";
         };
-      };
 
       checks = forAllSystems (
         pkgs: