From 5b95f6444f4e9dea77fcd034b05e92dc3ddd2fc2 Mon Sep 17 00:00:00 2001 From: Bernardo Magri Date: Mon, 20 Jul 2026 18:37:20 +0100 Subject: [PATCH] chore(ci): run the lock bump daily instead of weekly Move bump.yml's schedule from Mondays to every day (temporarily 17:39 UTC to trigger a run shortly). Sync the ROADMAP cadence note + shipped log to match. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/bump.yml | 9 +++++---- docs/ROADMAP.md | 10 ++++++---- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/bump.yml b/.gitea/workflows/bump.yml index 7927375..2e0eadf 100644 --- a/.gitea/workflows/bump.yml +++ b/.gitea/workflows/bump.yml @@ -1,11 +1,12 @@ # Nomarchy scheduled lock bump — the automated half of "rock-stable -# without rotting": once a week, update flake.lock (inputs track pinned +# without rotting": once a day, update flake.lock (inputs track pinned # release branches, so this never jumps a NixOS release — that's a # deliberate hand-edited v2, see agent/GOALS.md), gate it, and land it # on main only on green. `v1` promotion stays human, always. # # Fast lane: workflow_dispatch. For a security fix upstream, run this -# workflow manually from the Actions tab instead of waiting for Monday. +# workflow manually from the Actions tab instead of waiting for the +# next daily run. # # Gate scope: `nix flake check --no-build` (eval tier) followed by a V1 build # (home-manager activation package + nixos toplevel) to catch compilation errors. @@ -18,7 +19,7 @@ # # Failure mode: a red gate fails this run visibly and pushes nothing; # next schedule retries. A push race (someone landed on main mid-run) -# also just fails the final push — rerun or wait a week. +# also just fails the final push — rerun or wait a day. # # Container recipe (nixbld users, sandbox=false, pinned Nix, plain-shell # install) inherited from check.yml — the gotchas are documented there. @@ -27,7 +28,7 @@ name: Lock bump on: schedule: - - cron: '17 5 * * 1' # Mondays 05:17 UTC + - cron: '39 17 * * *' # daily 17:39 UTC workflow_dispatch: jobs: diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 94fafe7..5291fb7 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -1840,8 +1840,9 @@ Design/decision records and a running log of shipped work (items marked builds `system.build.toplevel`, and on green lands on `main` — which nobody tracks, so a bad bump costs a debug session, not a user outage; `v1` stays the manual on-hardware gate (it only ever fast-forwards, never force-pushed, - or a user's locked rev can vanish from history). **Cadence weekly** - (release-26.05 doesn't move fast; nightly is just churn), and `nix flake + or a user's locked rev can vanish from history). **Cadence daily** + (2026-07-20; was weekly — release-26.05 doesn't move fast, but daily + shrinks security-patch latency and a no-op bump is cheap), and `nix flake update` stays *within* the pinned release branches — no surprise major bump (a 26.11 jump is a deliberate `v2`, hand-edited in flake.nix). Side benefit: shrinks the security-patch latency the single-input model otherwise imposes @@ -1849,8 +1850,9 @@ Design/decision records and a running log of shipped work (items marked already eval/build/VM-tested and one hardware promotion away from `v1` — worth fast-laning lock-only/security bumps ahead of feature batches. **Shipped since:** `.gitea/workflows/check.yml` (eval tier on every main - push) and `bump.yml` (Monday 05:17 UTC scheduled lock bump, eval + V1 - build gate, auto-lands on green — first landing 8fded63, 2026-07-06). + push) and `bump.yml` (daily 17:39 UTC scheduled lock bump, eval + V1 + build gate, auto-lands on green — first landing 8fded63, 2026-07-06; + cadence weekly→daily 2026-07-20). 2026-07-12: both gates moved from one big `nix flake check --no-build` (~6.0 GB peak RSS — OOM'd the 4 GB VPS, then could never fit the runner's 2 GB container cap) to `tools/ci-eval.sh`, one output per nix