Repository navigation
fix(nix): verify dependency hashes before releases - #59881
clementpoiret wants to merge 2 commits into
Conversation
github-actions
Bot
added
needs:compliance
|
Thanks for your contribution! This PR doesn't have a linked issue. All PRs must reference an existing issue. Please:
See CONTRIBUTING.md for details. |
![opencodejr[bot]](https://avatars.githubusercontent.com/in/5497873?s=60&v=4){kind=small}
There was a problem hiding this comment.
I couldn't run this: it only changes CI workflows, which need GitHub Actions and Nix. I reviewed it by reading the workflows and scripts against each other (release.yml, check-nix.yml, bot-nix-hashes.yml, publish.sh, tag-release.sh, nix/node_modules.nix).
Building node_modules per system is a good idea and would have caught the stale hashes in 2.2.0. As wired up, though, I think it would cause problems:
- Every dev and beta build is gated, not just stable releases.
release.ymlruns on every push todevandbeta, and the newnixjob has no condition.bot-nix-hashesonly computes new hashes after a dependency change lands ondev. So every commit that changesbun.lockwould fail its own dev/beta build until the bot's hash PR merges, and every build now waits on three Nix runners, including macOS. - The concurrency group collides when check-nix.yml is called from release.yml (inline).
- Requiring
nix-depsondev, as the description asks maintainers to do, would block every PR that changes dependencies. Those PRs can't pass the check, because their hashes are only produced after merge by the bot. A required check here would need to run only on the bot'sbot/nix-hashesPR, or the hash update would need to happen inside the PR.
Public API: unchanged (CI only).
github-actions
Bot
removed
needs:compliance
|
Thanks for updating your PR! It now meets our contributing guidelines. 👍 |
There was a problem hiding this comment.
All three earlier points are addressed: the release Nix gate now runs only for stable releases, and the downstream jobs keep running when it's skipped on dev/beta; the concurrency group is isolated per run; and nix-deps only runs for the bot's bot/nix-hashes branch or release, with nix-eval as the stable check. I couldn't run it (Actions + Nix aren't available here), so I checked it by reading the needs/if chain of every job in release.yml.
Public API: unchanged (CI only).
One leftover: the description still asks maintainers to make the nix-deps checks required on dev. On ordinary PRs that matrix is skipped, and its per-system checks never report, so requiring them would leave every PR waiting. nix-eval is the check to require; worth updating the description so it isn't set up the wrong way.
|
For context, il happens to nearly all releases, making opencode hard to install on NixOS using the flake. E.g., current v2.2.5 is also broken |
Issue for this PR
Closes #59882
Type of change
What does this PR do?
Nix evaluation misses stale node_modules hashes. Build dependencies natively on all three supported systems, dispatch Nix checks for hash-bot PRs, and gate releases on them.
nix-eval should be run and pass before merging
This problem actually occured with current v2.2.0 release: it can't be installed with the flake, because hashes were updated after the release.
How did you verify your code works?
Workflow linting, ShellCheck, and bot-script smoke tests passed. The Linux dependency build reproduced the existing hash mismatch; hashes remain unchanged.
Checklist
Added by the opencode bot (AI-generated).
Related: #52863, #59601