ci: add nix flake check and build job - #405
Merged
Merged
Conversation
Guards two failure modes the Rust matrix cannot see. Flake outputs declared under the wrong attribute path evaluate fine but are invisible to Nix, which is how devShells and apps stayed nested inside packages since v0.37.0. And the librespot outputHashes in flake.nix pin the content of the spotatui-librespot checkout while the rev they match lives in Cargo.toml's [patch] block, so a fork bump without a regenerated hash breaks nix build with a hash mismatch that never names the rev. Path filtered to flake.nix, flake.lock, Cargo.toml and Cargo.lock, since the build step compiles the full default feature set.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a path-filtered GitHub Actions workflow that installs Nix, evaluates flake outputs, verifies the Rust development shell, and builds the default flake output. ChangesNix CI validation
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/nix.yml:
- Around line 36-37: Update the workflow steps for actions/checkout and
cachix/install-nix-action to reference immutable full commit SHAs instead of
master or a version tag, and add persist-credentials: false to the checkout
configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: d02f11c0-849a-4b54-8619-f7c5caeb0192
📒 Files selected for processing (1)
.github/workflows/nix.yml
Tags and branches are mutable, and this job runs nix build, so a retargeted action would execute arbitrary code against the build. Dependabot already covers the github-actions ecosystem and reads the trailing version comment, so these still get update PRs. Also drops the persisted GITHUB_TOKEN from the local git config, since the job only reads the repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Nix leg that the Rust matrix cannot cover. Three steps, cheapest first:
nix flake check --all-systems --no-buildcatches outputs declared under the wrong attribute path. This is the fix: nix develop flake output #401 class of bug:devShellsandappsnested insidepackagesevaluated fine but were invisible to Nix, sonix runhad no target andnix developsilently fell back to the package derivation. That had been the case since v0.37.0.nix develop --command cargo --versionguards the dev shell directly: reachable, and actually carrying the toolchain.nix build --no-link .#defaultcatches drift between thelibrespot-*entries incargoLock.outputHashesand the fork rev inCargo.toml's[patch]block. Nothing links the two, so bumping the fork without regenerating the hash breaksnix buildfor every Nix user, with a fixed-output hash mismatch that never names the rev. Only an actual build realizes the vendor derivation, so only a build catches it.Separate workflow rather than a job in
ci.ymlbecause GitHub filterspaths:at the workflow level only, and the build step compiles the full default feature set.Testing
Nix is not installed on my machine, so none of the three steps ran locally. The workflow triggers on changes to itself, so this PR's own run is the real verification.
python3 -c "import yaml; yaml.safe_load(open('.github/workflows/nix.yml'))"parses cleangit ls-files flake.lockconfirms the lock is tracked, so the job will not go red merely becausenixos-unstablemovedgh api repos/cachix/install-nix-action/tagsto pinv31.11.0; that repo publishes no moving major tagAdditional notes
paths:filters it does not run on most PRs, and a required check that never runs leaves them blocked pending forever.nix buildgets no benefit from the existingSwatinem/rust-cache. That is inherent to catching hash drift by building; the path filter is the mitigation.--all-systems. It cross-evaluates the darwin outputs (includingpkgs.apple-sdk) from a Linux runner, and the layout bug it guards reproduces on the Linux system alone.Summary by CodeRabbit
[skip ci].