chore(nix): commit flake.lock and add a nix flake check CI job - #706
Open
forkwright wants to merge 4 commits into
Open
chore(nix): commit flake.lock and add a nix flake check CI job#706forkwright wants to merge 4 commits into
forkwright wants to merge 4 commits into
Conversation
added 2 commits
August 12, 2026 09:29
The action now requires FlakeHub authentication and fails closed without it; the repo carries no such credential. The job runs uncached until a cache account is a deliberate operator decision. Refs #610
The locked nixpkgs removed the pkgs.nixosTest alias; the module tests now use the current testers.nixosTest path. Caught by the first nix flake check run — the CI job proving itself on its first day. Refs #610
forkwright
added a commit
that referenced
this pull request
Aug 12, 2026
## Summary Drains the standing basanos violation baseline (12 → 1, and that one — `NIX/flake-lock-committed` — resolves when #706 merges, taking the workspace to zero). Per the operator's standing rule that the baseline and suppressions are in scope. **Real fixes:** - `paroche/routes/download.rs`: `ReleaseMetadata` gains a validating constructor — non-empty title/URL enforced once at the persistence boundary; both construction sites (HTTP route, MCP bridge) now go through it. `ReleasePersistError` is `#[non_exhaustive]` with a new `EmptyMetadata` variant and a forward-safe wildcard arm in the bridge's match. - `eksetasis/rate_limit.rs` + `komide/fetch.rs`: the two genuinely wall-clock tests rewritten — paused-clock + `tokio::time::timeout` as the bound. Same properties asserted (prompt cancel-unblock; client timeout beats a stalled server), no `Instant::now()` measurement. - `CONTRIBUTING.md` / `docs/integrations.md`: internal `.lan` FQDN literals replaced (placeholder for the forge host; reserved `example.com` domain for the KOReader examples). **Suppressions (each with a WHY):** - `search/tests.rs` wall-clock: the assertion measures `tokio::time::Instant` under an explicitly paused clock — virtual time, deterministic by construction; the rule's flake concern doesn't apply. - `gate-attestation.yml` unpinned-action: `forkwright/.github` is fleet-owned and `@main` is the deliberate single-update channel for the shared hybrid gate (9 of 10 fleet repos call it this way). **Cruft deleted:** four stale suppression entries that matched no files (an as-cast glob for a moved module, a checksum glob, a dep-count entry, and a per-crate ignore file whose suppressed field was removed in #575). ## Verification ```text cargo test -p eksetasis: 316 passed; 0 failed cargo test -p komide: 82 passed; 0 failed cargo test -p paroche download: 33 passed; 0 failed cargo test -p archon mcp_bridge: 28 passed; 0 failed cargo check -p paroche -p archon: clean cargo fmt --check: clean kanon lint: 2 remaining (flake.lock → #706; the two justified suppressions above) ``` Refs #705 (the full 159-entry suppression audit is its own campaign) Co-authored-by: forkwright <noreply@forkwright.dev>
The locked nixpkgs exposed three bit-rotted surfaces the never-locked flake had been hiding: - hardware.raspberry-pi."4" is gone: the DAC overlay moves to hardware.deviceTree.overlays (dtbo from the rpi kernel's dtbs), and onboard-audio-off becomes a snd_bcm2835 module blacklist. The iqaudio-dacpro auto-parameter is inexpressible via deviceTree overlays — driven by the base overlay now, detection to be verified on hardware. - xdg.desktopEntries is Home Manager, not NixOS: the launcher entry becomes a makeDesktopItem package in environment.systemPackages. - builtins.log never existed: the renderer volume option now takes levelDb directly instead of an uncomputable linear-to-dB conversion. - services.harmonia collides with upstream nixpkgs's unrelated binary-cache module: disabledModules pins ours as the one. All six flake checks now evaluate locally (drvPath for each). Refs #610
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes out #610's two remaining artifacts (operator-approved workflow change):
flake.lockcommitted — inputs pinned (nixpkgs 2026-08-10, rust-overlay 2026-08-12, crane, flake-utils, systems), so flake builds are reproducible. Generated on metis with Determinate Nix 3.21.8..github/workflows/nix.yml—nix flake checkon the DeterminateSystems installer + magic-nix-cache (both SHA-pinned per repo convention). This is the verification surface for the chore(docs,nix,horismos): delete fabricated-feature docs and repair the NixOS module #619 module boot fixes, which were unverifiable when written (no nix toolchain then).Scope discipline: PRs run the job only when the flake surface changes (
flake.nix,flake.lock,nix/**, the workflow itself) — the full check builds the workspace plus two NixOS VM module tests, too heavy for every PR. Main always runs it.Verification
nix flake lock: clean resolution, lock committed.nix eval .#checks.x86_64-linux: all six checks resolve —clippy,deny,fmt,tests,harmonia-basic,harmonia-render-module.nix flake checkbuild is CI's job (metis compile budget + KVM VM tests); this PR's own nix.yml run is the first execution — watch it here.Refs #610