Scope CI checks to changed files; add --full-check for the old full sweep #22

2026-07-20T17:31:14Z

beatzaplenty commented

2026-07-20 17:31:14 +00:00

Summary

CI was running a full eval of every host + package on every push/PR, which was slow enough to routinely time out the Gitea runner.
scripts/codex-maintenance.sh default mode now diffs against a base ref (MAINT_BASE_SHA, else the PR base SHA, else HEAD^) and scopes nixpkgs-fmt --check/statix check/eval to the files that changed and the hosts/packages they can affect. A change to flake.nix/flake.lock/variables.nix/modules/common/* (or any other modules/*.nix outside platforms//build-types/, whose blast radius is not safely inferable from the path) falls back to evaluating everything, same as before.
The old full sweep moves behind --full-check (never run by CI); --dry-run adds build-planning for whatever scope is active.
scripts/codex-setup.sh no longer duplicates a full per-host eval loop -- that is what codex-maintenance.sh is for.
Both CI workflows (.github/.gitea) now fetch full history and pass a base SHA so the diff has something to compare against.
Docs (README.md, AGENTS.md, CLAUDE.md, docs/flake-lock-automation.md, scripts/bump-nixpkgs-release.sh) updated to match the new --full-check/--dry-run interface.

Test plan

Syntax-checked the rewritten script (bash -n).
Verified the hosts/<dir> -> target mapping regex against every hosts/* directory in flake.nix.
Ran with no changed .nix files -- correctly skipped fmt/statix/eval.
Ran against a real diff that touched variables.nix -- correctly fell back to evaluating every host and both packages end to end, no errors.
Ran against a single hosts/tor-relay/host.nix edit -- correctly scoped to only lxc-tor-relay, skipped packages, completed in seconds.
Same single-host edit with --dry-run -- correctly built only the affected scope.
Isolated logic tests for modules/platforms/*, modules/build-types/*, modules/installer/* (also affects the installer nixosConfigurations target, not just packages), and modules/pxe-boot/* (affects the pxe-boot build-type hosts, not packages) -- all scoped correctly.

## Summary - CI was running a full eval of every host + package on every push/PR, which was slow enough to routinely time out the Gitea runner. - `scripts/codex-maintenance.sh` default mode now diffs against a base ref (`MAINT_BASE_SHA`, else the PR base SHA, else `HEAD^`) and scopes `nixpkgs-fmt --check`/`statix check`/eval to the files that changed and the hosts/packages they can affect. A change to `flake.nix`/`flake.lock`/`variables.nix`/`modules/common/*` (or any other `modules/*.nix` outside `platforms/`/`build-types/`, whose blast radius is not safely inferable from the path) falls back to evaluating everything, same as before. - The old full sweep moves behind `--full-check` (never run by CI); `--dry-run` adds build-planning for whatever scope is active. - `scripts/codex-setup.sh` no longer duplicates a full per-host eval loop -- that is what `codex-maintenance.sh` is for. - Both CI workflows (`.github`/`.gitea`) now fetch full history and pass a base SHA so the diff has something to compare against. - Docs (`README.md`, `AGENTS.md`, `CLAUDE.md`, `docs/flake-lock-automation.md`, `scripts/bump-nixpkgs-release.sh`) updated to match the new `--full-check`/`--dry-run` interface. ## Test plan - [x] Syntax-checked the rewritten script (`bash -n`). - [x] Verified the `hosts/<dir>` -> target mapping regex against every `hosts/*` directory in `flake.nix`. - [x] Ran with no changed `.nix` files -- correctly skipped fmt/statix/eval. - [x] Ran against a real diff that touched `variables.nix` -- correctly fell back to evaluating every host and both packages end to end, no errors. - [x] Ran against a single `hosts/tor-relay/host.nix` edit -- correctly scoped to only `lxc-tor-relay`, skipped packages, completed in seconds. - [x] Same single-host edit with `--dry-run` -- correctly built only the affected scope. - [x] Isolated logic tests for `modules/platforms/*`, `modules/build-types/*`, `modules/installer/*` (also affects the `installer` nixosConfigurations target, not just packages), and `modules/pxe-boot/*` (affects the `pxe-boot` build-type hosts, not packages) -- all scoped correctly.

beatzaplenty added 1 commit 2026-07-20 17:31:48 +00:00

Rewrite codex-maintenance.sh to scope CI checks to changed files

Check NixOS configurations / eval-hosts (pull_request) Canceled after 0s

Details

7e9c0c2a6f

CI was running a full eval of every host + package on every push/PR,
which was slow enough to routinely time out the Gitea runner. Default
mode now diffs against a base ref and scopes nixpkgs-fmt/statix/eval to
the files that changed and the hosts/packages they can affect; a change
to flake.nix/flake.lock/variables.nix/modules/common/* (or any other
modules/*.nix outside platforms//build-types, whose blast radius isn't
inferable from the path) falls back to evaluating everything. The old
full sweep moves behind --full-check, which CI never passes; --dry-run
adds build-planning on top of whichever scope is active.

Also trims codex-setup.sh's redundant full host eval loop -- that's
what codex-maintenance.sh is for; setup should just install tooling.

beatzaplenty marked the pull request as work in progress 2026-07-20 17:32:42 +00:00

beatzaplenty marked the pull request as ready for review 2026-07-20 17:39:02 +00:00

beatzaplenty closed this pull request

2026-07-20 17:50:17 +00:00

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#22