enricobuehler
f8cde0adaf
THE CI GAP. `nix flake check` does not check `nixosModules`. It forces the value
and asserts it is a lambda taking an open attribute set — nothing more; nix's own
source carries `// FIXME: if we have a 'nixpkgs' input, use it to check the
module.` Measured: a flake whose module sets a nonexistent OPTION, references a
nonexistent `pkgs` attribute AND calls a nonexistent `lib` function passes clean,
printing `checking NixOS module 'nixosModules.default'... all checks passed!`.
nix.yml's header claimed that leg covered the module; it never did, for the
module's whole life — on a flake whose history is Nix regressions reaching main
invisibly.
Closed with `checks.<system>.nixos-module` (packaging/nix/module-check.nix): it
evaluates the module against real nixpkgs in four scenarios (desktop, appliance,
native-only, client-only) and asserts on the rendered systemd units. The
assertions are PURE NIX so instantiating the check runs them — which means the
eval-only `--no-build` leg CI already runs is sufficient, and no Rust is built.
Stub fake-derivation packages keep it independent of punktfunk-host/-client and
the from-source gamescope; crane and bun2nix are provably not needed (they are
`throw`s in the wiring test and it still instantiates).
17 checks, including regression guards for every divergence the sweep found and
for the KWin identification trap (host ExecStart must stay on the plain store
path, never a capability wrapper, while the encode worker points AT the wrapper).
Mutation-tested: 8 mutants, each re-introducing one real defect, all 8 rejected,
baseline green. The suite already earned it once — its first run failed a correct
module because systemd renders `After=` as one space-separated line, so those
assertions now read the evaluated lists instead of the text.
Also closed from the sweep:
* services.punktfunk.host.desktopSession (new, default false) — binds the host
to graphical-session.target, the declarative form of the
punktfunk-host-desktop-session.conf drop-in. Without it a Plasma/GNOME
restart leaves the host holding a Wayland socket and portal D-Bus connection
that died with the old compositor: it still listens, still answers, and every
session it then serves fails at capture. Off by default because an appliance
may never reach that target and would be left permanently stopped.
* scripting.autoStart now defaults ON, matching the deb postinst and RPM %post,
which both `systemctl --global enable` the runner. It was opt-in here on the
reasoning that the runner is inert until you add automation — which stopped
being true when the game-library scanners became plugins. A NixOS host came up
with an empty library and no obvious reason why. The module and README carried
the superseded rationale verbatim; both updated.
* A warning when the host is enabled and xdg.portal is not. A warning rather
than `xdg.portal.enable = mkDefault true`, because enabling the portal service
with no `extraPortals` backend is its own broken state and only the operator
knows which backend their compositor needs.
* punktfunk-gamescope gets a `build-gamescope` dispatch input. It is on the
critical path of every host build (`gamescopeHdr` defaults true) yet nothing
compiled it; it tracks nixpkgs' gamescope, so a flake.lock bump — not a change
of ours — is what breaks it, and the first to find out would be an operator
whose system rebuild fails.
All .nix files reformatted with the flake's own declared formatter
(nixfmt-rfc-style from the PINNED nixpkgs, not a channel's).
202 lines
11 KiB
YAML
202 lines
11 KiB
YAML
# Nix packaging gate. Until this existed, NOTHING in CI ever evaluated flake.nix: the word "nix"
|
|
# appeared in exactly one workflow file, and only in a comment about bun2nix breaking a Windows
|
|
# step. Every Nix regression therefore reached main invisibly and was found by hand on a Nix box —
|
|
# `nix build .#punktfunk-web` was broken for 553 commits before anyone noticed (see the bun-nix job
|
|
# in ci.yml for that story).
|
|
#
|
|
# Two tiers, because a full `nix flake check` builds the whole Rust workspace with crane and would
|
|
# run for an hour on every push:
|
|
#
|
|
# * eval — `nix flake check --no-build`: instantiates every package, app, check and devShell
|
|
# without building them. Catches the failures that actually happen to this flake — a
|
|
# renamed file, a callPackage argument that no longer exists, a syntax error, a package
|
|
# attribute dropped from packages.nix.
|
|
#
|
|
# ⚠ It does NOT, on its own, check the NixOS module. `nix flake check` handles
|
|
# `nixosModules` by forcing the value and asserting it is a lambda taking an open
|
|
# attribute set — nothing more (nix's own source: `// FIXME: if we have a 'nixpkgs'
|
|
# input, use it to check the module.`). MEASURED: a module setting a nonexistent
|
|
# OPTION, referencing a nonexistent `pkgs` attribute AND calling a nonexistent `lib`
|
|
# function passes clean, printing `checking NixOS module ... all checks passed!`. This
|
|
# header used to claim the module was covered here; it was not, for the module's whole
|
|
# life. It is covered NOW because `checks.<system>.nixos-module`
|
|
# (packaging/nix/module-check.nix) evaluates it against real nixpkgs and asserts on the
|
|
# rendered systemd units — and because those assertions are pure Nix, INSTANTIATING
|
|
# that check runs them, so `--no-build` is enough. Keep them pure: a shell script in
|
|
# the derivation body would only run under a full `nix flake check`, which builds the
|
|
# hour-long Rust packages.
|
|
# * bun — actually BUILDS punktfunk-web + punktfunk-scripting. These are the two derivations
|
|
# whose inputs churn constantly (every dependency bump moves a lockfile) and they cost
|
|
# minutes, not hours, because neither compiles Rust. This is the end-to-end proof that
|
|
# the generated bun.nix really does materialise a working node_modules offline — it
|
|
# covers what the ci.yml drift gate cannot, e.g. a tarball the registry no longer
|
|
# serves, or the codegen going quietly message-less (see packages.nix's inlang note).
|
|
#
|
|
# The Rust packages (punktfunk-host, punktfunk-client) and punktfunk-gamescope are NOT built here.
|
|
# They are the expensive ones and their inputs are already gated by the `rust` job in ci.yml; build
|
|
# them by hand on a Nix box, or with the `build-rust` dispatch input below.
|
|
#
|
|
# ⚠ punktfunk-gamescope deserves the dispatch run more than it looks: `host.gamescopeHdr` DEFAULTS
|
|
# TRUE, so it is on the critical path of every `services.punktfunk.host.enable = true` build, while
|
|
# being the one package nothing here compiles. It patches whatever gamescope the pinned nixpkgs
|
|
# carries, so a nixpkgs bump — not a change of ours — is what breaks it, and the first person to
|
|
# find out would be an operator whose system rebuild fails. Run the dispatch after a flake.lock bump.
|
|
#
|
|
# ⚠ pull_request is deliberately present. flatpak.yml shipped with push-only triggers and manifest
|
|
# breakage reached main invisibly for weeks — do not "simplify" this workflow by dropping it.
|
|
# ⚠ The two path lists are duplicated on purpose: a YAML anchor would be tidier, but Gitea's
|
|
# workflow parser is not a place to bet on anchor support. Keep them in step by hand.
|
|
name: nix
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "flake.nix"
|
|
- "flake.lock"
|
|
- "packaging/nix/**"
|
|
- "**/bun.lock"
|
|
- "**/bun.nix"
|
|
- "**/package.json"
|
|
- "Cargo.lock"
|
|
- "Cargo.toml"
|
|
- "rust-toolchain.toml"
|
|
- ".gitea/workflows/nix.yml"
|
|
- "scripts/ci/check-bun-nix.sh"
|
|
pull_request:
|
|
paths:
|
|
- "flake.nix"
|
|
- "flake.lock"
|
|
- "packaging/nix/**"
|
|
- "**/bun.lock"
|
|
- "**/bun.nix"
|
|
- "**/package.json"
|
|
- "Cargo.lock"
|
|
- "Cargo.toml"
|
|
- "rust-toolchain.toml"
|
|
- ".gitea/workflows/nix.yml"
|
|
- "scripts/ci/check-bun-nix.sh"
|
|
workflow_dispatch:
|
|
inputs:
|
|
build-rust:
|
|
description: "Also build punktfunk-host + punktfunk-client (slow: full Rust workspace)"
|
|
type: boolean
|
|
default: false
|
|
build-gamescope:
|
|
description: "Also build punktfunk-gamescope (patched gamescope from source; run after a flake.lock bump)"
|
|
type: boolean
|
|
default: false
|
|
|
|
jobs:
|
|
flake:
|
|
runs-on: ubuntu-24.04
|
|
container:
|
|
# NOT nixos/nix. That image contains nix and essentially nothing else — in particular no
|
|
# /bin/sleep, and Gitea's act_runner starts every job container with
|
|
# `entrypoint=["/bin/sleep","10800"]`. The container therefore never starts:
|
|
# failed to create shim task: OCI runtime create failed: unable to start container
|
|
# process: exec: "/bin/sleep": stat /bin/sleep: no such file or directory
|
|
# and — the part that makes this expensive to debug — every step is then reported as
|
|
# `cancelled` rather than failed, which reads exactly like a superseded run.
|
|
#
|
|
# node:22-bookworm instead: a full Debian with coreutils (so the entrypoint exists) and a
|
|
# real node (so actions/checkout works with no pre-checkout install dance), and audit.yml
|
|
# already pulls it on this fleet, so it is proven to resolve here. Nix is installed below.
|
|
image: node:22-bookworm
|
|
timeout-minutes: 90
|
|
env:
|
|
# The flake needs both experimental features. Also baked into the installer's --extra-conf
|
|
# below; this covers any step that shells out before that config is read.
|
|
NIX_CONFIG: "experimental-features = nix-command flakes"
|
|
# Absolute path rather than $GITHUB_PATH: one less runner behaviour to assume.
|
|
NIX: /nix/var/nix/profiles/default/bin/nix
|
|
# `--init none` installs Nix with NO daemon running, but the installer still writes a profile
|
|
# script that exports NIX_REMOTE=daemon. Anything that sources it (any `-l` login shell) then
|
|
# dies on `cannot connect to socket at '/nix/var/nix/daemon-socket/socket'` — which is exactly
|
|
# how the installer's own self-test fails during this step, harmlessly, and would be a
|
|
# confusing first thing to read in the log. The steps below never source that profile, but pin
|
|
# the empty value so a future step cannot reintroduce it. Empty = talk to the local store
|
|
# directly, which works because the job runs as root (MEASURED: "Store URL: local, Trusted: 1",
|
|
# and a real `nix build` of a trivial derivation succeeds).
|
|
NIX_REMOTE: ""
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# The Determinate installer needs curl + xz; git so nix can read the flake from the checkout.
|
|
# (node:22-bookworm is the full image and already has all three — this is belt-and-braces
|
|
# against a future slim-image swap, and costs one cached apt call.)
|
|
- name: Installer prerequisites
|
|
run: apt-get update && apt-get install -y --no-install-recommends ca-certificates curl xz-utils git
|
|
|
|
# `--init none` is the container mode: no systemd, no daemon. Running as root, nix then talks
|
|
# to the store directly. Determinate Nix is also what the Nix box (.21) runs, so CI and the
|
|
# hand-verification box stay on the same distribution.
|
|
- name: Install Nix
|
|
run: |
|
|
curl -fsSL https://install.determinate.systems/nix -o /tmp/nix-installer.sh
|
|
sh /tmp/nix-installer.sh install linux --init none --no-confirm \
|
|
--extra-conf "experimental-features = nix-command flakes"
|
|
"$NIX" --version
|
|
|
|
# Nix reads the flake through libgit2 and refuses a checkout owned by another uid
|
|
# ("detected dubious ownership"), which is the normal case for a container job.
|
|
- name: Trust the checkout
|
|
run: git config --global --add safe.directory "$PWD"
|
|
|
|
# Diagnostics. This fleet ran a runner out of disk on 2026-08-06 (the ci.yml `web` job died
|
|
# with "no space left on device" mid-`bun install`), and a Nix build is the heaviest thing
|
|
# here — so record the headroom, or a future failure is a guess.
|
|
- name: Environment
|
|
run: df -h / /nix /tmp || true
|
|
|
|
# Evaluates + instantiates every flake output without building any of it.
|
|
- name: nix flake check (eval only)
|
|
run: |
|
|
"$NIX" flake check --no-build --show-trace
|
|
|
|
# The bun packages, built for real. This is the leg that would have caught the stale
|
|
# web/bun.nix end to end: the derivation's offline `bun install` runs against a store cache
|
|
# built strictly from bun.nix, so a lockfile that cache does not cover fails here.
|
|
# Path-filtered, so it runs only when the packaging or a lockfile actually moves. If it ever
|
|
# starts going red on runner disk rather than on real defects, demote it to the dispatch
|
|
# opt-in below rather than leaving an infra-red gate on the board.
|
|
- name: Build the bun packages
|
|
run: |
|
|
"$NIX" build --print-build-logs .#punktfunk-web .#punktfunk-scripting
|
|
|
|
# Both launchers exec pkgs.bun from the store; confirm they were produced and are real entry
|
|
# points rather than dangling wrappers.
|
|
- name: Smoke the built launchers
|
|
run: |
|
|
set -eu
|
|
web=$("$NIX" path-info .#punktfunk-web)
|
|
scripting=$("$NIX" path-info .#punktfunk-scripting)
|
|
test -x "$web/bin/punktfunk-web-server" || { echo "no punktfunk-web-server in $web" >&2; exit 1; }
|
|
test -x "$scripting/bin/punktfunk-scripting" || { echo "no punktfunk-scripting in $scripting" >&2; exit 1; }
|
|
# The console must be the bun bundle, not a node one — the same assertion packages.nix
|
|
# makes at build time, re-checked on the installed output.
|
|
grep -q 'Bun\.serve' "$web/share/punktfunk-web/.output/server/index.mjs" \
|
|
|| { echo "installed console is not a bun bundle" >&2; exit 1; }
|
|
echo "bun packages OK: $web $scripting"
|
|
|
|
# Opt-in only: the full Rust workspace through crane, which is the hour-long leg.
|
|
# `github.event.inputs.*` (string) rather than `inputs.*` — the portable spelling.
|
|
- name: Build the Rust packages (dispatch opt-in)
|
|
if: ${{ github.event.inputs.build-rust == 'true' }}
|
|
run: |
|
|
"$NIX" build --print-build-logs .#punktfunk-host .#punktfunk-client
|
|
|
|
# The patched compositor. Separate from build-rust because its failure mode is different: it
|
|
# tracks nixpkgs' gamescope, not our Rust, so it wants a run after a flake.lock bump rather
|
|
# than after a code change. `gamescope.nix` fails loudly (an eval-time `throw` if nixpkgs no
|
|
# longer exposes a patchable derivation, a `+pfhdr` grep in installCheckPhase) — but only if
|
|
# something actually builds it.
|
|
- name: Build the patched gamescope (dispatch opt-in)
|
|
if: ${{ github.event.inputs.build-gamescope == 'true' }}
|
|
run: |
|
|
"$NIX" build --print-build-logs .#punktfunk-gamescope
|