Bernardo Magri
67400b07dc
Some checks failed
Check / eval (push) Failing after 7m59s
check.yml has been permanently red since the runner container was
capped at 2 GB (uncapped, it OOM'd the whole 4 GB VPS). Root cause,
measured with GNU time (eval-cache off): `nix flake check --no-build`
walks every output in ONE evaluator process and peaks at ~6.0 GB RSS
on this repo — the checks.* suite alone is ~15 runNixOSTests, each a
full NixOS eval, all accumulating in one heap.
New tools/ci-eval.sh: identical coverage (all checks.* drvPaths, both
nixosConfigurations toplevels, the HM activationPackage — enumerated
dynamically, no drift), one fresh nix process per output so the heap is
freed between outputs. Cold per-output peaks: worst check 0.99 GB
(hardware-toggles), nomarchy toplevel 0.78 GB, HM 0.60 GB; the one
outlier is nomarchy-live at 2.69 GB (live-ISO eval), which fits the
2 GB cap only via the container's swap allowance (docker's default
--memory-swap is 2x memory). check.yml and bump.yml both call the
script now; bump.yml also gains max-jobs=1/cores=2 (it had no limits,
so its V1 build gate could spawn parallel builders in the capped
container). ROADMAP's stale "no CI today" corrected: bump.yml landed
8fded63 on schedule 2026-07-06.
Verified: V1+ — ci-eval.sh green locally end-to-end (3m22s, tree peak
2.75 GB = nomarchy-live's process); per-output peaks measured
individually. The decisive proof is the next Actions run on the VPS
itself — watch the nomarchy-live step; if it OOMs there, the runner
needs swap allowed: --memory=2g --memory-swap=6g.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
109 lines
4.8 KiB
YAML
109 lines
4.8 KiB
YAML
# Nomarchy CI — the always-on net under direct-to-main pushes.
|
|
#
|
|
# Scope (deliberate): the EVAL tier only. The runner behind this Gitea
|
|
# instance is act_runner + docker containers (the legacy repo's check.yml
|
|
# ran 57 times on it) — no systemd, no /dev/kvm — so the checks.* VM
|
|
# tests and full toplevel builds can't run here. `nix flake check
|
|
# --no-build` still catches most breakage (type errors, missing options,
|
|
# bad merges, template/mkFlake drift — see docs/TESTING.md §1); the VM
|
|
# suite stays a local/promotion gate until a KVM-capable NixOS runner
|
|
# exists (see the commented vm-checks job at the bottom).
|
|
#
|
|
# Inherited-from-legacy gotchas (learned over 57 runs, kept verbatim):
|
|
# - Single-user Nix (--no-daemon): no systemd in the container. The
|
|
# installer runs as root and honours build-users-group=nixbld from
|
|
# its bundled nix.conf, aborting unless the group exists AND has
|
|
# members — create nixbld + users first.
|
|
# - sandbox=false: Stylix/base16.nix do import-from-derivation; the
|
|
# single-user Nix in this container can't set up the build sandbox
|
|
# (no user namespaces), which otherwise surfaces as
|
|
# "path '…-source' is not valid".
|
|
# - Pin the Nix version: 2.34's lazy-trees git cache doesn't
|
|
# materialise flake-input `-source` paths into the store, breaking
|
|
# the same IFD reads. 2.31.5 matches what wrote flake.lock.
|
|
# - Plain-shell Nix install, not a JS action: act_runner's bundled act
|
|
# tops out at node20; a `run:` step has no node-runtime coupling.
|
|
|
|
name: Check
|
|
|
|
on:
|
|
push:
|
|
branches: [main, v1]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
eval:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
env:
|
|
NIX_CONFIG: |
|
|
max-jobs = 1
|
|
cores = 1
|
|
experimental-features = nix-command flakes
|
|
sandbox = false
|
|
NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install Nix
|
|
run: |
|
|
NIX_VERSION=2.31.5
|
|
groupadd -r nixbld 2>/dev/null || true
|
|
for i in $(seq 1 10); do
|
|
useradd -r -g nixbld -G nixbld -d /var/empty \
|
|
-s /usr/sbin/nologin -c "Nix build user $i" "nixbld$i" 2>/dev/null || true
|
|
done
|
|
curl -L "https://releases.nixos.org/nix/nix-${NIX_VERSION}/install" | sh -s -- --no-daemon
|
|
echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Evaluate every output (eval tier, memory-bounded)
|
|
# Same coverage as `nix flake check --no-build` — both nixos
|
|
# configs, the home config, the checks.* derivations (instantiated,
|
|
# not run) and the downstream template through lib.mkFlake — but
|
|
# ONE output per nix process. A single process walking everything
|
|
# peaks at ~6.0 GB RSS (measured 2026-07-12): it OOM'd the 4 GB
|
|
# VPS itself, and can never fit this runner's 2 GB container cap.
|
|
# Per-output processes cap at the largest single output (~1 GB).
|
|
run: bash tools/ci-eval.sh
|
|
|
|
- name: Python syntax (all tracked scripts)
|
|
# Every tracked *.py — theme-sync, the installer composers
|
|
# (compose-lock, patch-template) and the maintainer tools
|
|
# (tools/, tools/vm/). Via nix shell so the step doesn't depend on
|
|
# the runner image preinstalling python3.
|
|
run: |
|
|
nix shell nixpkgs#python3 --command \
|
|
bash -c 'git ls-files "*.py" | xargs -r python3 -m py_compile'
|
|
|
|
- name: Shell syntax (tracked scripts)
|
|
# The distro's user-facing scripts are generated by Nix (their
|
|
# syntax is exercised by the eval + local builds); this covers the
|
|
# hand-written .sh files: installer helpers and maintainer tools.
|
|
run: |
|
|
set -e
|
|
fail=0
|
|
while IFS= read -r script; do
|
|
head -1 "$script" | grep -qE '^#!.*\b(bash|sh)\b' || continue
|
|
if ! bash -n "$script"; then
|
|
echo "::error file=$script::bash syntax error"
|
|
fail=1
|
|
fi
|
|
done < <(git ls-files '*.sh')
|
|
exit "$fail"
|
|
|
|
# ── vm-checks (DISABLED — FUTURE #20, not NEXT) ─────────────────────
|
|
# Eval-only CI is the standing decision: Gitea act_runner stays docker
|
|
# compose (no /dev/kvm). Full checks.* VMs need a *separate* host with
|
|
# nix + KVM (label nix-kvm); see agent/BACKLOG.md FUTURE #20. Do NOT
|
|
# uncomment until that label is online — Gitea queues forever otherwise.
|
|
#
|
|
# vm-checks:
|
|
# runs-on: nix-kvm
|
|
# timeout-minutes: 120
|
|
# steps:
|
|
# - uses: actions/checkout@v4
|
|
# - run: nix flake check # builds + runs the VM tests
|
|
# - run: nix build .#nixosConfigurations.nomarchy.config.system.build.toplevel --no-link
|
|
# - run: nix build .#homeConfigurations.nomarchy.activationPackage --no-link
|