nix-forge CI v2.8.0

Nix Forge CI v2.8.0

Changelog

• Publish each release's Sigstore bundle as a portable .intoto.jsonl asset beside the archive, checksum, and manifest.
• Verify release subjects against that exact bundle before publication and require the portable provenance in the shared release contract.

This compatible v2 release adds no pull request or merge queue jobs. Provenance export runs only for tagged releases and uses the bundle already produced by actions/attest, so it does not add a second attestation or network lookup. Existing callers need no migration until they choose to adopt this release.

The reviewed implementation is commit 2705c51e254ef3f43e90da1ab8fc717a54991487 (PR #46). The nix-forge/ci/.github/workflows/release.yml workflow builds, attests, verifies, and publishes the tagged source archive and portable provenance.

Validation: nix develop --command bash scripts/check.sh, nix flake check on x86_64 Linux, and a Codex Security diff scan passed with no reportable findings. PR and merge-group CI, CodeQL, and DCO must pass before tagging.

The v2.7.0 pin remains usable for rollback. No support end date is scheduled for v2.7.x; a later major contract change will define its end-of-life window.

nix-forge CI v2.7.0

Nix Forge CI v2.7.0

Changelog

• Bound each historical flake-check derivation evaluation to 60 seconds by default. A timeout builds the current check, so a slow base revision cannot delay the partition indefinitely or suppress validation.
• Add the optional base-eval-timeout input to actions/flake-checks. Callers can select a different positive limit or use zero for unlimited comparison. Existing callers need no migration.

This compatible v2 release changes no permissions, secret access, or privileged queue behavior. The reviewed implementation is commit 1cc86ef5aa21bc27df920239b8fe85496a93545e (PR #44). The nix-forge/ci/.github/workflows/release.yml workflow builds, attests, verifies, and publishes the tagged source archive.

Validation: nix develop --command bash scripts/check.sh, nix flake check on x86_64 Linux, and the shared workflow validator against the nix-conf caller passed locally. PR and merge-group CI, CodeQL, and DCO must pass before tagging. The nix-conf caller will update its immutable pin in a separate PR revision.

The v2.6.0 pin remains usable for rollback. No support end date is scheduled for v2.6.x; a later major contract change will define its end-of-life window.

nix-forge CI v2.6.0

Nix Forge CI v2.6.0

Changelog

• Add an optional weights-file input to actions/flake-checks. Callers can keep estimated check costs in their own repository and balance native check partitions without copying the shared runner.
• Preserve round-robin partitioning for callers that omit weights-file. No existing caller needs to change.

This release adds no permissions, secret access, or privileged queue behavior. The reviewed implementation is commit 4f1c8652ea3ca9cdde0b0982b06ad52875a92e55 (PR #41). The nix-forge/ci/.github/workflows/release.yml workflow will build, attest, and publish the tagged source archive.

Validation: nix flake check --print-build-logs passed on x86_64 Linux, including 82 Python tests and workflow validation. The PR and merge-group CI, CodeQL, and DCO checks passed. The nix-conf consumer will pin this release in a separate PR and retain its repository-specific runner matrix and weights.

This is a compatible v2 update. The v2.5.4 pin remains usable for rollback. No support end date is scheduled for v2.5.x; the next v2 release will supersede this version for new updates.

v2.5.4

Native check partitioning

• Add deterministic partition-count and partition-index inputs to actions/flake-checks.
• Preserve the existing single-job behavior by default.
• Reject invalid and empty partitions so parallel jobs cannot silently omit checks.

v2.5.3

Fixed

• Scope historical secret scanning to the checked-out commit's complete ancestry, preventing unrelated fetched branches from contaminating a repository check.
• Preserve the independent committed-tree scan and historical baseline behavior.

v2.5.2

Native flake checks now declare commit-fetched consumer repositories as shallow when evaluating the pull-request or merge-group base. This fixes the v2.5.1 behavior where Nix rejected the base URL and conservatively rebuilt every check.

The URL remains pinned to a validated full commit ID and retains submodule evaluation. Exact derivation-path equality remains the only skip condition; unavailable history and failed base evaluation still rebuild current checks.

Validation passed locally and in pull-request and merge-group CI: 74 regression tests, a real shallow-repository Nix comparison covering equal and changed derivations, workflow lint and security checks, and CodeQL.

v2.5.1

Native flake checks now compare each current derivation with the pull-request or merge-group base and skip only exact derivation matches. New, changed, unavailable, or unevaluable base checks continue to build.

Shallow checkouts fetch the requested base commit once. The action accepts only full hexadecimal commit IDs and preserves submodule-aware local flake evaluation. Existing workflow jobs and required status names are unchanged.

Validation passed locally and in both pull-request and merge-group CI: 74 regression tests, real Nix equal/changed derivation comparison, actionlint, Zizmor, Yamllint, ShellCheck, Ruff, formatting, and CodeQL.

v2.5.0

Queue actions now use the repository's default branch and accept explicit consumer inputs for package updater admission and comparison-base dispatch. Configure automation-branch for a same-repository github-actions bot updater and base-sha-workflows for workflows declaring base_sha.

The library's queue reconciler now uses hourly recovery and skips completion events from unrelated scans. PR and merge-group validation retain event-driven reconciliation, and dispatched queue runs retain completion callbacks. Consumer wrappers must adopt these trigger changes separately.

The new scripts/sync-release.py command checks or updates every shared CI reference across local workflows, composite actions and onboarding templates. It resolves published stable releases to immutable SHAs and supports read-only drift checks.

Validation passed on Linux locally and in both PR and merge-group CI, including 68 regression tests, real Nix attribute selection, workflow lint and security checks. Existing required statuses and bot admission restrictions remain enforced. Hourly recovery can delay progress after a missed callback.

v2.4.0

Workflow validation is now a packaged Nix app with declared tools, policy and Python inventory modules. The composite action uses that package. The library CI suite runs as a sandboxed flake check.

Validation includes 60 regression tests, packaged-validator checks and successful protected PR and native merge-group workflows. Consumer action interfaces and required check names are unchanged.

v2.3.0

Add optional checks-output selection for repositories with host-only deployment checks. The default remains checks. Reject malformed output identifiers before running Nix. Tested with 58 regression tests and real Nix attribute selection.