Bernardo Magri
67400b07dc
Some checks failed
Check / eval (push) Failing after 7m59s
check.yml has been permanently red since the runner container was
capped at 2 GB (uncapped, it OOM'd the whole 4 GB VPS). Root cause,
measured with GNU time (eval-cache off): `nix flake check --no-build`
walks every output in ONE evaluator process and peaks at ~6.0 GB RSS
on this repo — the checks.* suite alone is ~15 runNixOSTests, each a
full NixOS eval, all accumulating in one heap.
New tools/ci-eval.sh: identical coverage (all checks.* drvPaths, both
nixosConfigurations toplevels, the HM activationPackage — enumerated
dynamically, no drift), one fresh nix process per output so the heap is
freed between outputs. Cold per-output peaks: worst check 0.99 GB
(hardware-toggles), nomarchy toplevel 0.78 GB, HM 0.60 GB; the one
outlier is nomarchy-live at 2.69 GB (live-ISO eval), which fits the
2 GB cap only via the container's swap allowance (docker's default
--memory-swap is 2x memory). check.yml and bump.yml both call the
script now; bump.yml also gains max-jobs=1/cores=2 (it had no limits,
so its V1 build gate could spawn parallel builders in the capped
container). ROADMAP's stale "no CI today" corrected: bump.yml landed
8fded63 on schedule 2026-07-06.
Verified: V1+ — ci-eval.sh green locally end-to-end (3m22s, tree peak
2.75 GB = nomarchy-live's process); per-output peaks measured
individually. The decisive proof is the next Actions run on the VPS
itself — watch the nomarchy-live step; if it OOMs there, the runner
needs swap allowed: --memory=2g --memory-swap=6g.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
103 lines
4.2 KiB
YAML
103 lines
4.2 KiB
YAML
# Nomarchy scheduled lock bump — the automated half of "rock-stable
|
|
# without rotting": once a week, update flake.lock (inputs track pinned
|
|
# release branches, so this never jumps a NixOS release — that's a
|
|
# deliberate hand-edited v2, see agent/GOALS.md), gate it, and land it
|
|
# on main only on green. `v1` promotion stays human, always.
|
|
#
|
|
# Fast lane: workflow_dispatch. For a security fix upstream, run this
|
|
# workflow manually from the Actions tab instead of waiting for Monday.
|
|
#
|
|
# Gate scope: `nix flake check --no-build` (eval tier) followed by a V1 build
|
|
# (home-manager activation package + nixos toplevel) to catch compilation errors.
|
|
# (this runner has no KVM; see item 20 for the VM-suite
|
|
# upgrade path). The py_compile/bash -n steps are skipped on purpose:
|
|
# they don't read flake.lock, so a lock bump cannot break them. The
|
|
# bump commit's own push then triggers check.yml as a second net.
|
|
# A green bump therefore guards evaluation and compilation, not VM behaviour —
|
|
# the checks.* suite still runs locally / at promotion time.
|
|
#
|
|
# Failure mode: a red gate fails this run visibly and pushes nothing;
|
|
# next schedule retries. A push race (someone landed on main mid-run)
|
|
# also just fails the final push — rerun or wait a week.
|
|
#
|
|
# Container recipe (nixbld users, sandbox=false, pinned Nix, plain-shell
|
|
# install) inherited from check.yml — the gotchas are documented there.
|
|
|
|
name: Lock bump
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '17 5 * * 1' # Mondays 05:17 UTC
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
bump:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
env:
|
|
NIX_CONFIG: |
|
|
max-jobs = 1
|
|
cores = 2
|
|
experimental-features = nix-command flakes
|
|
sandbox = false
|
|
NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install Nix
|
|
run: |
|
|
NIX_VERSION=2.31.5
|
|
groupadd -r nixbld 2>/dev/null || true
|
|
for i in $(seq 1 10); do
|
|
useradd -r -g nixbld -G nixbld -d /var/empty \
|
|
-s /usr/sbin/nologin -c "Nix build user $i" "nixbld$i" 2>/dev/null || true
|
|
done
|
|
curl -L "https://releases.nixos.org/nix/nix-${NIX_VERSION}/install" | sh -s -- --no-daemon
|
|
echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Update flake.lock
|
|
# Inputs track release branches (nixos-26.05, release-26.05), so
|
|
# the update stays within them by construction. The human-readable
|
|
# change list goes into the commit body below.
|
|
run: |
|
|
nix flake update 2>&1 | tee /tmp/bump-log
|
|
if git diff --quiet flake.lock; then
|
|
echo "Lock already up to date — nothing to do."
|
|
echo "changed=0" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "changed=1" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
id: update
|
|
|
|
- name: Gate — evaluate every output (eval tier, memory-bounded)
|
|
# Per-output processes, not one big `nix flake check --no-build`:
|
|
# the single-process walk peaks ~6 GB RSS and OOMs inside the
|
|
# runner's 2 GB container cap (details in tools/ci-eval.sh).
|
|
if: steps.update.outputs.changed == '1'
|
|
run: bash tools/ci-eval.sh
|
|
|
|
- name: Gate — V1 build (toplevel + home-manager)
|
|
if: steps.update.outputs.changed == '1'
|
|
run: |
|
|
nix build .#homeConfigurations.nomarchy.activationPackage --no-link
|
|
nix build .#nixosConfigurations.nomarchy.config.system.build.toplevel --no-link
|
|
|
|
- name: Commit + push on green
|
|
if: steps.update.outputs.changed == '1'
|
|
# The checkout step persists the Actions token, so this push
|
|
# authenticates as the workflow; its push triggers check.yml as
|
|
# the second net. Only flake.lock is committed — pathspec-limited,
|
|
# nothing else can ride along.
|
|
run: |
|
|
{
|
|
echo "chore(lock): scheduled upstream bump"
|
|
echo
|
|
grep -E '^(• | )' /tmp/bump-log || true
|
|
echo
|
|
echo "Gate: nix flake check --no-build (eval tier — see bump.yml header)."
|
|
} > /tmp/bump-msg
|
|
git -c user.name="nomarchy-bump" -c user.email="actions@git.bemagri.xyz" \
|
|
commit --only flake.lock -F /tmp/bump-msg
|
|
git push origin HEAD:main
|