[Backport release-2.3] ci: fix Renovate's Nix updates and bump nixpkgs to nixos-26.05 - #266
Merged
Merged
Conversation
Renovate's post-upgrade tasks fail here, so nix run .#tidy and nix run .#generate never refresh gomod2nix.toml or our generated code. The docker/cli bump in crossplane#253 was opened with go.mod and go.sum alone for this reason. Nix builds without its sandbox in Renovate's container, where HOME is /homeless-shelter on the real filesystem. A build that writes there creates the directory, and Nix then refuses to start any later build. pkgs.gomod2nix is one of the builds that creates it, and it comes from a dependency rather than our own Nix code, so we have nowhere to set a writable HOME. The entrypoint now registers a post-build hook that removes the directory after each build, and sets max-jobs to 1 so no build starts before the cleanup runs. The nix manager is disabled by default, so flake.lock has never been updated here and everything it pins is frozen. This commit enables the manager along with lock file maintenance, on an empty schedule so a refresh can open during any run, and gives it a prPriority that sorts it behind security updates only. Release branches opt out of non-security updates, but they build with Nix too and pick up newer Go versions through the lock file, so a rule re-enables maintenance for them. Renovate installs its own Nix through containerbase whenever it updates flake.lock. That one goes earlier on PATH and ignores /etc/nix/nix.conf, so the entrypoint publishes a crossplane-nix launcher that pins both the binary and the config it reads, and the post-upgrade tasks call it. RENOVATE_ALLOWED_COMMANDS no longer permits a bare nix, so a command still spelled that way fails on the allowlist instead of running against the wrong Nix. RENOVATE_VERSION now pins the version the validator runs and the version the action runs, so the two cannot disagree, and a customManager keeps it current. prConcurrentLimit returns to Renovate's default of 10 and the hourly PR limit is disabled so a backlog drains faster, security fixes skip dependency dashboard approval, and the entrypoint no longer installs Earthly, which nothing in this repo builds with. Signed-off-by: Jared Watts <jbw976@gmail.com> (cherry picked from commit 98b9db9)
The nixos-25.11 branch stopped moving at the end of June 2026 when the channel reached end of life, so every tool we pin through it is frozen. This commit points the nixpkgs input at nixos-26.05 and refreshes both inputs in flake.lock, neither of which had moved since April. Moving the channel moves the toolchain, and that accounts for the rest of the diff. protoc-gen-go 1.36.10 to 1.36.11 regenerates the render protobuf output. golangci-lint 2.11.4 to 2.12.2, which arrives with the nixpkgs-unstable refresh, reports new goconst and modernize findings, each addressed in place. nixpkgs 26.05 makes nixfmt-rfc-style an alias of nixfmt and warns when it is used, so we call nixfmt directly. Signed-off-by: Jared Watts <jbw976@gmail.com> (cherry picked from commit 79e0ba3)
haarchri
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of your changes
This PR is a manual backport of #257 to
release-2.3:The renovate config isn't strictly necessary, since Renovate runs from main for all branches, but they come along with the cherry picks for completeness.
Any non applicable chunks, i.e.
go lintfixes frommainfor code that doesn't exist in the release branch have been dropped.I have:
./nix.sh flake checkto ensure this PR is ready for review.Linked a PR or a docs tracking issue to document this change.Addedbackport release-x.ylabels to auto-backport this PR.Need help with this checklist? See the cheat sheet.