From f24d49be08177343f51d35d6770104ceec7aa473 Mon Sep 17 00:00:00 2001 From: Bernardo Magri Date: Fri, 29 May 2026 22:05:12 +0100 Subject: [PATCH] ci: disable Nix sandbox so Stylix IFD can realize sources MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit flake check evaluates the home-manager fontconfig text, which via Stylix/base16.nix does import-from-derivation — eval must realize fetched `-source` paths. The single-user Nix in the runner container can't set up the build sandbox (no user namespaces), so realization failed with "path '…-source' is not valid". Set sandbox = false for the runner (safe in a throwaway CI container). Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/check.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml index 83cc171..a8c19bb 100644 --- a/.gitea/workflows/check.yml +++ b/.gitea/workflows/check.yml @@ -28,10 +28,16 @@ jobs: runs-on: ubuntu-latest # Flakes for every `nix` invocation in the job (the bare `nix flake # check` below relies on this; the scripts pass the flag themselves). - # NIX_SSL_CERT_FILE because we add nix to PATH without sourcing the - # installer's profile (which is what normally exports it). + # sandbox=false because Stylix/base16.nix do import-from-derivation — + # eval realizes fetched `-source` paths mid-check, and the single-user + # Nix in this container can't set up the build sandbox (no user + # namespaces), which otherwise surfaces as "path '…-source' is not + # valid". NIX_SSL_CERT_FILE because we add nix to PATH without sourcing + # the installer's profile (which is what normally exports it). env: - NIX_CONFIG: "experimental-features = nix-command flakes" + NIX_CONFIG: | + experimental-features = nix-command flakes + sandbox = false NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt steps: - name: Checkout