From 12f39e1967a03075009b0e02b08c9964cb6f9eb3 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Sat, 8 Aug 2026 17:15:49 +0200 Subject: [PATCH] fix(steamdeck): the updater stops dirtying the checkout it just pulled into MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `update.sh --pull` could abort with "Your local changes to the following files would be overwritten by merge: web/bun.nix" — before a single service was restarted — and the only way past it was to delete the file by hand. The updater did it to itself. web/bun.nix is generated (bun2nix, a pure function of web/bun.lock) but committed, because the Nix build fetches node_modules only from it. The web step ran `bun install --frozen-lockfile` without --ignore-scripts, so web's `postinstall` (`bun2nix -o bun.nix`) rewrote that tracked file on every update. Harmless while the committed file is in sync — but main carried a stale web/bun.nix from 1db8f763 to b79d90b4, so any Deck updated in that window had it rewritten to the *correct* content and has been sitting dirty ever since. The SDK step has always passed --ignore-scripts, which is why only web/bun.nix ever went dirty. Two changes, both in install.sh and update.sh: * the web install now passes --ignore-scripts and runs `bun run codegen` explicitly. web has two install lifecycle scripts and we want exactly one: `prepare` IS `bun run codegen` (orval + paraglide + the i18n check) and is required, since src/api/gen, src/paraglide and src/routeTree.gen.ts are gitignored and `prebuild` only re-runs orval; `postinstall` is the one that writes a committed file. Equivalent to the old behaviour minus bun2nix. * --pull restores web/bun.nix and sdk/bun.nix before pulling, which unsticks the installs already broken out there. Deliberately NOT `git reset --hard`: $SRC is the operator's own checkout and may carry real local work, so a still-dirty tree now fails with a message that names the files and the way out instead of git's raw abort. Discarding these two is provably lossless — regenerating them from the lockfiles is exactly what bun2nix does. CI already gates the drift that made this visible (scripts/ci/check-bun-nix.sh, ci.yml), so main cannot ship a stale bun.nix again. --- scripts/steamdeck/install.sh | 5 ++++- scripts/steamdeck/update.sh | 32 ++++++++++++++++++++++++++++++-- 2 files changed, 34 insertions(+), 3 deletions(-) diff --git a/scripts/steamdeck/install.sh b/scripts/steamdeck/install.sh index 622d972c..5e6ecf81 100755 --- a/scripts/steamdeck/install.sh +++ b/scripts/steamdeck/install.sh @@ -147,7 +147,10 @@ if [ "$WITH_WEB" = 1 ]; then distrobox enter "$BOX" -- bash -lc " set -e export PATH=\$HOME/.bun/bin:\$PATH -cd '$SRC/web' && bun install --frozen-lockfile && bun run build +# --ignore-scripts + explicit codegen: keep in step with scripts/steamdeck/update.sh, which +# explains why (web's `postinstall` writes the COMMITTED web/bun.nix; its `prepare`/codegen is +# required because src/api/gen, src/paraglide and src/routeTree.gen.ts are gitignored). +cd '$SRC/web' && bun install --frozen-lockfile --ignore-scripts && bun run codegen && bun run build " [ -f "$SRC/web/.output/server/index.mjs" ] || die "web build did not produce web/.output/server/index.mjs" ok "web console built" diff --git a/scripts/steamdeck/update.sh b/scripts/steamdeck/update.sh index ac163598..65243ded 100755 --- a/scripts/steamdeck/update.sh +++ b/scripts/steamdeck/update.sh @@ -20,7 +20,28 @@ TARGET_DIR="$SRC/target-steamos" WEB=0; [ -f "$HOME/.config/systemd/user/punktfunk-web.service" ] && WEB=1 if [ "${1:-}" = "--pull" ]; then - if [ -d "$SRC/.git" ]; then log "git pull"; git -C "$SRC" pull --ff-only; ok "pulled"; else die "$SRC is not a git checkout — rsync new source then run without --pull"; fi + [ -d "$SRC/.git" ] || die "$SRC is not a git checkout — rsync new source then run without --pull" + # web/bun.nix and sdk/bun.nix are GENERATED (bun2nix, a pure function of the matching bun.lock — + # packaging/nix/README.md) yet COMMITTED, because the Nix build fetches node_modules only from + # them. Until the --ignore-scripts fix below, web's `bun install` here ran its `postinstall` + # (`bun2nix -o bun.nix`) and rewrote that tracked file on every single update. That is invisible + # while the committed file is in sync — but main carried a STALE web/bun.nix from 1db8f763 to + # b79d90b4, so any Deck updated in that window had the file rewritten to the *correct* content + # and has been sitting dirty ever since. The next `git pull --ff-only` that touches it then dies + # with "Your local changes to the following files would be overwritten by merge", and the update + # stops before a single service is restarted. + # + # Restore ONLY these two derived paths. Not a blanket `git reset --hard`: $SRC is the operator's + # own checkout (they may have patched a source file, or be carrying a cherry-pick), and silently + # deleting that to save an update is a far worse trade than one legible error. Discarding these + # two is provably lossless — regenerating them from the lockfiles is exactly what bun2nix does. + git -C "$SRC" checkout -- web/bun.nix sdk/bun.nix 2>/dev/null || true + log "git pull" + git -C "$SRC" pull --ff-only \ + || die "git pull --ff-only failed in $SRC. If it named locally-modified files, this checkout + has local changes: review them with 'git -C $SRC status', then commit or stash them (or discard + one with 'git -C $SRC checkout -- ') and re-run. Nothing was rebuilt or restarted." + ok "pulled" fi log "Rebuilding host (release)" @@ -29,7 +50,14 @@ distrobox enter "$BOX" -- bash -lc "set -e; export PATH=\$HOME/.cargo/bin:\$PATH ok "host rebuilt" if [ "$WEB" = 1 ]; then log "Rebuilding web console" - distrobox enter "$BOX" -- bash -lc "set -e; export PATH=\$HOME/.bun/bin:\$PATH; cd '$SRC/web' && bun install --frozen-lockfile && bun run build" + # --ignore-scripts, then `bun run codegen` explicitly: web has TWO install lifecycle scripts and + # we want exactly one of them. `prepare` (= codegen: orval + paraglide + the i18n check) is + # REQUIRED — src/api/gen, src/paraglide and src/routeTree.gen.ts are gitignored, and `prebuild` + # only re-runs orval, so dropping codegen leaves the build without its i18n messages. But + # `postinstall` (`bun2nix -o bun.nix`) writes a COMMITTED file, and an updater must never dirty + # the tree it just pulled into — that is what broke `--pull` above. The SDK install below has + # always passed --ignore-scripts, which is why only web/bun.nix ever went dirty. + distrobox enter "$BOX" -- bash -lc "set -e; export PATH=\$HOME/.bun/bin:\$PATH; cd '$SRC/web' && bun install --frozen-lockfile --ignore-scripts && bun run codegen && bun run build" ok "web rebuilt" fi