Archived
beatzaplenty
7e9c0c2a6f
Check NixOS configurations / eval-hosts (pull_request) Canceled after 0s
CI was running a full eval of every host + package on every push/PR, which was slow enough to routinely time out the Gitea runner. Default mode now diffs against a base ref and scopes nixpkgs-fmt/statix/eval to the files that changed and the hosts/packages they can affect; a change to flake.nix/flake.lock/variables.nix/modules/common/* (or any other modules/*.nix outside platforms//build-types, whose blast radius isn't inferable from the path) falls back to evaluating everything. The old full sweep moves behind --full-check, which CI never passes; --dry-run adds build-planning on top of whichever scope is active. Also trims codex-setup.sh's redundant full host eval loop -- that's what codex-maintenance.sh is for; setup should just install tooling.
88 lines
2.2 KiB
Bash
Executable File
88 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/nix-bootstrap.sh
|
|
source "${script_dir}/lib/nix-bootstrap.sh"
|
|
# shellcheck source=lib/nix-eval.sh
|
|
source "${script_dir}/lib/nix-eval.sh"
|
|
|
|
install_nix_if_missing() {
|
|
if command -v nix >/dev/null 2>&1; then
|
|
return
|
|
fi
|
|
|
|
echo "Nix not found. Installing Nix..."
|
|
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
echo "Running as root; preparing nixbld users for container/Codex environment..."
|
|
|
|
if ! getent group nixbld >/dev/null; then
|
|
groupadd -r nixbld
|
|
fi
|
|
|
|
for i in $(seq 1 10); do
|
|
if ! id "nixbld$i" >/dev/null 2>&1; then
|
|
useradd \
|
|
-r \
|
|
-g nixbld \
|
|
-G nixbld \
|
|
-d /var/empty \
|
|
-s /usr/sbin/nologin \
|
|
"nixbld$i" || true
|
|
fi
|
|
done
|
|
|
|
mkdir -p /etc/nix
|
|
cat > /etc/nix/nix.conf <<'EOF'
|
|
experimental-features = nix-command flakes
|
|
accept-flake-config = false
|
|
warn-dirty = false
|
|
build-users-group = nixbld
|
|
EOF
|
|
|
|
# The official installer's single-user root path still shells out to
|
|
# `sudo` to create /nix even though it already knows it's running as
|
|
# root -- confirmed live against a sudo-less minimal Debian/Proxmox
|
|
# node, where it fails with "sudo: not found" and prints this exact
|
|
# mkdir/chown as the manual fix. Pre-create it so that branch of the
|
|
# installer is skipped entirely.
|
|
if [ ! -d /nix ]; then
|
|
mkdir -m 0755 /nix
|
|
chown root /nix
|
|
fi
|
|
|
|
sh <(curl -L https://nixos.org/nix/install) --no-daemon
|
|
else
|
|
sh <(curl -L https://nixos.org/nix/install) --no-daemon
|
|
fi
|
|
|
|
ensure_nix_profile
|
|
}
|
|
|
|
install_nix_if_missing
|
|
ensure_nix_profile
|
|
|
|
mkdir -p "$HOME/.config/nix"
|
|
cat > "$HOME/.config/nix/nix.conf" <<'EOF'
|
|
experimental-features = nix-command flakes
|
|
accept-flake-config = false
|
|
warn-dirty = false
|
|
EOF
|
|
|
|
echo "Nix version:"
|
|
nix --version
|
|
|
|
echo "Enabling tracked git hooks (pre-commit secret scan)..."
|
|
git config core.hooksPath .githooks
|
|
|
|
echo "Installing jq if unavailable..."
|
|
if ! command -v jq >/dev/null 2>&1; then
|
|
nix profile install nixpkgs#jq
|
|
fi
|
|
|
|
echo "Available NixOS hosts:"
|
|
list_flake_targets .
|
|
|
|
echo "Codex setup complete. Run bash scripts/codex-maintenance.sh to validate changes."
|