Archived
rootandClaude Sonnet 5
7e51168d1b
Check NixOS configurations / eval-hosts (pull_request) Failing after 11m29s
Three chunks of copy-pasted logic were drifting across scripts/*.sh: - codex-setup.sh and codex-maintenance.sh each carried an identical NIX_CONFIG bootstrap + ensure_nix_profile() -> scripts/lib/nix-bootstrap.sh - sync-host-keys.sh and prepare-host-key.sh each ran the same ssh-keygen/ssh-to-age nix-shell invocations -> scripts/lib/ssh-host-keys.sh (prepare-host-key.sh now also calls env.sh's nix_extra_opts before using them, closing a gap where it alone skipped the nix-cache reachability check env.sh exists for) - the "list nixosConfigurations attrNames" / "get one target's hostName" nix eval pattern was repeated across codex-setup.sh, codex-maintenance.sh, sync-host-keys.sh and create-proxmox-resource.sh (the latter twice, in its own --list and --host lookup) -> scripts/lib/nix-eval.sh, which also centralizes the --no-use-registries --no-accept-flake-config flag pair used on every such call Verified against the real flake/node config (nix is available here): create-proxmox-resource.sh --list for both --type lxc/vm, a full --dry-run create, and prepare-host-key.sh generating and cleaning up a real key/age-pubkey pair. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
104 lines
3.3 KiB
Bash
Executable File
104 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/nix-bootstrap.sh
|
|
source "${script_dir}/lib/nix-bootstrap.sh"
|
|
# shellcheck source=lib/nix-eval.sh
|
|
source "${script_dir}/lib/nix-eval.sh"
|
|
|
|
MODE="${1:-validate}"
|
|
|
|
ensure_nix_profile
|
|
|
|
if ! command -v nix >/dev/null 2>&1; then
|
|
echo "ERROR: nix is not available in PATH. Run bash scripts/codex-setup.sh first." >&2
|
|
exit 127
|
|
fi
|
|
|
|
hosts="$(list_flake_targets .)"
|
|
|
|
echo "Hosts:"
|
|
echo "$hosts"
|
|
|
|
echo
|
|
echo "Checking for obvious committed secrets..."
|
|
if grep -RInE 'github_pat_|ghp_|access-tokens|hashedPassword[[:space:]]*=' \
|
|
--exclude-dir=.git \
|
|
--exclude=flake.lock \
|
|
.; then
|
|
echo
|
|
echo "WARNING: Potential secrets or password hashes found. Review before committing."
|
|
else
|
|
echo "No obvious token patterns found."
|
|
fi
|
|
|
|
echo
|
|
echo "Checking Nix formatting with nixpkgs-fmt..."
|
|
nix run "${NIX_EVAL_FLAGS[@]}" github:NixOS/nixpkgs/nixos-25.11#nixpkgs-fmt -- --check .
|
|
|
|
echo
|
|
echo "Running statix lint..."
|
|
nix run "${NIX_EVAL_FLAGS[@]}" github:NixOS/nixpkgs/nixos-25.11#statix -- check .
|
|
|
|
echo
|
|
echo "Evaluating host toplevel derivations..."
|
|
for host in $hosts; do
|
|
echo "==> $host"
|
|
nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
|
|
|
|
# lxc-* hosts deploy via a directly pct-restore-able tarball instead of
|
|
# nixos-install (see docs/auto-installer.md); proxmox-* hosts can
|
|
# alternatively be built as a standalone disk image (see
|
|
# docs/proxmox-images.md). Both are otherwise-unvalidated buildable
|
|
# surface, easy to silently break without this.
|
|
case "$host" in
|
|
lxc-*)
|
|
echo "==> $host (tarball)"
|
|
nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.tarball.drvPath"
|
|
;;
|
|
proxmox-*)
|
|
echo "==> $host (diskoImagesScript)"
|
|
nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.diskoImagesScript.drvPath"
|
|
;;
|
|
esac
|
|
done
|
|
|
|
echo
|
|
echo "Evaluating buildable packages..."
|
|
packages="$(nix eval --json "${NIX_EVAL_FLAGS[@]}" .#packages.x86_64-linux --apply builtins.attrNames | jq -r '.[]')"
|
|
for pkg in $packages; do
|
|
echo "==> packages.x86_64-linux.${pkg}"
|
|
nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#packages.x86_64-linux.${pkg}"
|
|
done
|
|
|
|
if [[ "$MODE" == "dry-run" ]]; then
|
|
echo
|
|
echo "Running dry-run builds for all hosts. This will not create result symlinks."
|
|
for host in $hosts; do
|
|
echo "==> Dry-run build: $host"
|
|
nix build --dry-run --no-link "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.toplevel"
|
|
|
|
case "$host" in
|
|
lxc-*)
|
|
echo "==> Dry-run build: $host (tarball)"
|
|
nix build --dry-run --no-link "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.tarball"
|
|
;;
|
|
proxmox-*)
|
|
echo "==> Dry-run build: $host (diskoImagesScript)"
|
|
nix build --dry-run --no-link "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.diskoImagesScript"
|
|
;;
|
|
esac
|
|
done
|
|
|
|
echo
|
|
echo "Running dry-run builds for all packages."
|
|
for pkg in $packages; do
|
|
echo "==> Dry-run build: packages.x86_64-linux.${pkg}"
|
|
nix build --dry-run --no-link "${NIX_EVAL_FLAGS[@]}" ".#packages.x86_64-linux.${pkg}"
|
|
done
|
|
fi
|
|
|
|
echo
|
|
echo "Maintenance checks complete."
|