server/server-config
3
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Merge branch 'frcc-kvm' of https://git.floweytf.com/server/server-config into frcc-kvm

Browse Source
This commit is contained in:
Autumn Liu
2026-09-11 15:27:56 -05:00
parent 9721112d67 1bf51e9a9e
commit 6cda214d97
4 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/vulnix.yml
+1 -1
View File
@@ -25,7 +25,7 @@ jobs:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
API: ${{ github.api_url }} API: ${{ github.api_url }}
REPO: ${{ github.repository }} REPO: ${{ github.repository }}
run: nix run -L .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md" run: 'nix run -L .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"'
- name: close resolved issue - name: close resolved issue
if: steps.scan.outputs.count == '0' if: steps.scan.outputs.count == '0'
ci.nix
+7
View File
@@ -1,10 +1,17 @@
{ lib, pkgs }: { lib, pkgs }:
let
# vulnix's bundled nix-2.34 broke its own --experimental-features detection
nixConf = pkgs.writeText "ci-nix.conf" "experimental-features = nix-command flakes";
in
# tools must track ci.py's subprocess calls; nix stays ambient (uses the # tools must track ci.py's subprocess calls; nix stays ambient (uses the
# runner's own nix, not a pinned one). # runner's own nix, not a pinned one).
pkgs.writers.writePython3Bin "ci" { pkgs.writers.writePython3Bin "ci" {
flakeIgnore = [ "E501" ]; flakeIgnore = [ "E501" ];
libraries = [ pkgs.python3Packages.subprocess-tee ]; libraries = [ pkgs.python3Packages.subprocess-tee ];
makeWrapperArgs = [ makeWrapperArgs = [
"--set-default"
"NIX_USER_CONF_FILES"
(toString nixConf)
"--prefix" "--prefix"
"PATH" "PATH"
":" ":"
ci.py
+2 -1
View File
@@ -18,7 +18,8 @@ def run(*args, **kw):
def nix(*args): def nix(*args):
return subprocess_tee.run(("nix", "--extra-experimental-features", "nix-command flakes", "-L", *args), check=True, text=True).stdout # tee to stderr - stdout leaks into GITHUB_OUTPUT $() captures
return subprocess_tee.run(("nix", "--extra-experimental-features", "nix-command flakes", "-L", *args), check=True, text=True, stdout=sys.stderr).stdout
def git(*args, check=True): def git(*args, check=True):
containers/server-n0/git.nix
+3 -4
View File
@@ -163,10 +163,9 @@ in
trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" ]; trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" ];
}; };
nix.gc = { nix.settings = {
automatic = true; min-free = 5 * 1024 * 1024 * 1024;
dates = "daily"; max-free = 10 * 1024 * 1024 * 1024;
options = "--delete-older-than 14d";
}; };
# nix.optimise.automatic = true; - doesn't work with microvm.writableStoreOverlay # nix.optimise.automatic = true; - doesn't work with microvm.writableStoreOverlay