From 95cd7d045718a3fae2e04e1fad37a37044ec39e5 Mon Sep 17 00:00:00 2001 From: flowey Date: Thu, 17 Sep 2026 05:20:21 +0000 Subject: [PATCH 1/5] ci: fix flake update (#8) Co-authored-by: Floweynt <50057682+Floweynt@users.noreply.github.com> Reviewed-on: https://git.floweytf.com/server/server-config/pulls/8 --- .github/workflows/diff-pr.yml | 10 ++++++++- .github/workflows/flake-update.yml | 8 +++----- ci.py | 33 ++++++++++++++++++++++-------- 3 files changed, 37 insertions(+), 14 deletions(-) diff --git a/.github/workflows/diff-pr.yml b/.github/workflows/diff-pr.yml index 17b0abf..d8fbabb 100644 --- a/.github/workflows/diff-pr.yml +++ b/.github/workflows/diff-pr.yml @@ -17,10 +17,18 @@ jobs: steps: - uses: actions/checkout@v4 with: + ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 + - name: merge base branch + run: | + git config user.email "ci@localhost" + git config user.name "CI" + git fetch origin ${{ github.event.pull_request.base.ref }} + git merge --no-edit origin/${{ github.event.pull_request.base.ref }} + - name: worktree base for diff - run: git worktree add "$RUNNER_TEMP/base" "${{ github.event.pull_request.base.sha }}" + run: git worktree add "$RUNNER_TEMP/base" "origin/${{ github.event.pull_request.base.ref }}" - name: build closures and render diff run: | diff --git a/.github/workflows/flake-update.yml b/.github/workflows/flake-update.yml index 27ec96d..2baadce 100644 --- a/.github/workflows/flake-update.yml +++ b/.github/workflows/flake-update.yml @@ -5,21 +5,19 @@ on: - cron: "17 4 * * *" workflow_dispatch: -permissions: - contents: write - pull-requests: write - jobs: update: runs-on: nix steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - run: nix flake update -L - name: open/update PR env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ secrets.BOT_TOKEN }} API: ${{ github.api_url }} REPO: ${{ github.repository }} run: | diff --git a/ci.py b/ci.py index 61076ea..a3d8db0 100644 --- a/ci.py +++ b/ci.py @@ -8,6 +8,7 @@ import re import subprocess import subprocess_tee import sys +import urllib.error import urllib.request from collections import Counter from pathlib import Path @@ -26,6 +27,10 @@ def git(*args, check=True): return run("git", *args, check=check, capture_output=True) +class GiteaError(Exception): + pass + + def gitea(method, path, body=None): url = f'{os.environ["API"]}/repos/{os.environ["REPO"]}{path}' data = json.dumps(body).encode() if body is not None else None @@ -37,7 +42,11 @@ def gitea(method, path, body=None): with urllib.request.urlopen(req) as resp: raw = resp.read() except urllib.error.HTTPError as e: - sys.exit(f"gitea {method} {path}: {e.code} {e.reason}\n{e.read().decode()}") + try: + detail = json.loads(e.read()).get("message", e.reason) + except (json.JSONDecodeError, UnicodeDecodeError): + detail = e.reason + raise GiteaError(f"{method} {path}: {e.code} {detail}") from None return json.loads(raw) if raw else None @@ -466,16 +475,24 @@ def open_pr(args): host = os.environ["API"].removesuffix("/api/v1") auth = base64.b64encode(f'token:{os.environ["GH_TOKEN"]}'.encode()).decode() - git("-c", f"http.extraHeader=Authorization: Basic {auth}", - "push", "-f", f'{host}/{os.environ["REPO"]}.git', f"HEAD:{args.branch}") + push = git("-c", f"http.extraHeader=Authorization: Basic {auth}", + "push", "-f", f'{host}/{os.environ["REPO"]}.git', f"HEAD:{args.branch}", + check=False) + if push.returncode != 0: + raise RuntimeError(f"git push failed:\n{push.stderr}") - owner = os.environ["REPO"].split("/")[0] - if gitea("GET", f"/pulls?state=open&head={owner}:{args.branch}"): + pulls = gitea("GET", f"/pulls?state=open&base_branch={args.base}") + existing = next((pr for pr in pulls if pr["head"]["ref"] == args.branch), None) + if existing: + print(f"PR #{existing['number']} already open, pushed update") return labels = [label_id(args.label)] if args.label else [] - gitea("POST", "/pulls", - {"title": args.title, "head": args.branch, "base": args.base, - "body": Path(args.body_file).read_text(), "labels": labels}) + pr = gitea("POST", "/pulls", + {"title": args.title, "head": args.branch, "base": args.base, + "body": Path(args.body_file).read_text(), "labels": labels}) + if not pr or "number" not in pr: + raise GiteaError(f"POST /pulls: unexpected response: {json.dumps(pr)}") + print(f"opened PR #{pr['number']}") def main(): From e5e4ac5e7fb6d7c12824657eca466fd9454d7840 Mon Sep 17 00:00:00 2001 From: flowey Date: Thu, 17 Sep 2026 00:28:52 -0500 Subject: [PATCH 2/5] misc: format --- modules/autodeploy.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/autodeploy.nix b/modules/autodeploy.nix index 2d8c7d3..f49c766 100644 --- a/modules/autodeploy.nix +++ b/modules/autodeploy.nix @@ -38,7 +38,7 @@ in type = lib.types.listOf lib.types.str; default = [ ]; }; - + repoOwner = lib.mkOption { type = lib.types.str; description = "User that owns the configuration checkout"; From c26a1fde3155320a0824e5730543c6478754c0eb Mon Sep 17 00:00:00 2001 From: flowey Date: Thu, 17 Sep 2026 06:32:05 +0000 Subject: [PATCH 3/5] bug: fix autodeploy generation naming (#12) Co-authored-by: Floweynt Reviewed-on: https://git.floweytf.com/server/server-config/pulls/12 --- scripts/server-autodeploy.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/server-autodeploy.sh b/scripts/server-autodeploy.sh index f2559f2..cfd7a76 100644 --- a/scripts/server-autodeploy.sh +++ b/scripts/server-autodeploy.sh @@ -48,9 +48,11 @@ runas git tag -v "$latest" || { sha=$(runas git rev-list -1 "$latest") report_status "pending" "deploying $latest" "$sha" -flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$HOSTNAME" +runas git checkout "$latest" +runas tee .nixos-label <<< "$latest" >/dev/null +runas git add .nixos-label -if nixos-rebuild switch --flake "$flake_url"; then +if nixos-rebuild switch --flake ".#$HOSTNAME"; then echo "$latest" > "$STATE_DIR/tag" report_status "success" "deployed $latest" "$sha" echo "deployed $latest" From 8551b8ad9065ecd5abd8878e7eb5459b7acd0bab Mon Sep 17 00:00:00 2001 From: flowey Date: Thu, 17 Sep 2026 10:35:22 -0500 Subject: [PATCH 4/5] try and fix deployment --- configuration.nix | 10 ++-------- flake.lock | 13 +++++++++++++ flake.nix | 11 ++++++++++- misc/deploy-label/label | 0 scripts/server-autodeploy.sh | 10 ++++++---- 5 files changed, 31 insertions(+), 13 deletions(-) create mode 100644 misc/deploy-label/label diff --git a/configuration.nix b/configuration.nix index 7461aba..da77608 100644 --- a/configuration.nix +++ b/configuration.nix @@ -5,6 +5,7 @@ hostInfo, customPkgs, flakeRev, + deployLabel, ... }: let @@ -62,14 +63,7 @@ in time.timeZone = "UTC"; system.stateVersion = "26.05"; - system.nixos.label = - let - labelFile = ./.nixos-label; - in - if builtins.pathExists labelFile then - lib.removeSuffix "\n" (builtins.readFile labelFile) - else - flakeRev; + system.nixos.label = if deployLabel != null then deployLabel else flakeRev; nix = { settings = { diff --git a/flake.lock b/flake.lock index 6e14954..98d5d3a 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,17 @@ { "nodes": { + "deploy-label": { + "flake": false, + "locked": { + "path": "./misc/deploy-label", + "type": "path" + }, + "original": { + "path": "./misc/deploy-label", + "type": "path" + }, + "parent": [] + }, "flake-utils": { "inputs": { "systems": "systems" @@ -79,6 +91,7 @@ }, "root": { "inputs": { + "deploy-label": "deploy-label", "microvm": "microvm", "mtce": "mtce", "nixpkgs": "nixpkgs" diff --git a/flake.nix b/flake.nix index 541b7fc..95b7e43 100644 --- a/flake.nix +++ b/flake.nix @@ -7,6 +7,8 @@ mtce.inputs.nixpkgs.follows = "nixpkgs"; microvm.url = "github:microvm-nix/microvm.nix"; microvm.inputs.nixpkgs.follows = "nixpkgs"; + deploy-label.url = "path:./misc/deploy-label"; + deploy-label.flake = false; }; outputs = @@ -15,6 +17,7 @@ nixpkgs, mtce, microvm, + deploy-label, ... }: let @@ -23,6 +26,12 @@ pkgs = import nixpkgs { inherit system; }; flakeRev = self.shortRev or self.dirtyShortRev or "unknown"; + deployLabel = + let + labelFile = "${deploy-label}/label"; + raw = lib.removeSuffix "\n" (builtins.readFile labelFile); + in + if raw != "" then raw else null; customPkgs = { hopper-rs = pkgs.callPackage ./packages/hopper-rs.nix { }; @@ -56,7 +65,7 @@ specialArgsFor = hostName: { hostInfo = hostInfoFor hostName; - inherit inputs customPkgs flakeRev; + inherit inputs customPkgs flakeRev deployLabel; }; hostDefFor = diff --git a/misc/deploy-label/label b/misc/deploy-label/label new file mode 100644 index 0000000..e69de29 diff --git a/scripts/server-autodeploy.sh b/scripts/server-autodeploy.sh index cfd7a76..54a236c 100644 --- a/scripts/server-autodeploy.sh +++ b/scripts/server-autodeploy.sh @@ -48,15 +48,17 @@ runas git tag -v "$latest" || { sha=$(runas git rev-list -1 "$latest") report_status "pending" "deploying $latest" "$sha" -runas git checkout "$latest" -runas tee .nixos-label <<< "$latest" >/dev/null -runas git add .nixos-label +label_dir=$(mktemp -d) +echo "$latest" > "$label_dir/label" +flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$HOSTNAME" -if nixos-rebuild switch --flake ".#$HOSTNAME"; then +if nixos-rebuild switch --flake "$flake_url" --override-input deploy-label "path:$label_dir"; then + rm -rf "$label_dir" echo "$latest" > "$STATE_DIR/tag" report_status "success" "deployed $latest" "$sha" echo "deployed $latest" else + rm -rf "$label_dir" report_status "failure" "nixos-rebuild failed" "$sha" exit 1 fi From 1b796ff9dd5ae01d0318591cad8b5b6750e00f56 Mon Sep 17 00:00:00 2001 From: "gitea-actions[bot]" Date: Tue, 22 Sep 2026 04:19:08 +0000 Subject: [PATCH 5/5] flake.lock: update inputs --- flake.lock | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/flake.lock b/flake.lock index 98d5d3a..9d2a79b 100644 --- a/flake.lock +++ b/flake.lock @@ -38,11 +38,11 @@ "spectrum": "spectrum" }, "locked": { - "lastModified": 1786300091, - "narHash": "sha256-4UFJOVGpaYtHW5yasSv80MaJxTBYdk2zyf3jhKtt0wA=", + "lastModified": 1789506833, + "narHash": "sha256-4L8SOCF84de1irB72Ka9VHcu9wrAJ9Amuey4lU9oh4Y=", "owner": "microvm-nix", "repo": "microvm.nix", - "rev": "71beea0076cd46dafcee97a5a2e7d00cbba5bd2f", + "rev": "187b0a390ee054028106a674e7b01b1cb940cbba", "type": "github" }, "original": { @@ -75,11 +75,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1786384358, - "narHash": "sha256-RzPPiWeUtuvymnpuEWsdtzli5w4kjZs49FqEs3/1u+I=", + "lastModified": 1789921291, + "narHash": "sha256-Ft/BRnIqw1MywFoXydKobjjWmDFgDdYtSpJliE8+yUw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "2fcb964de67fcf60b43471c55d5d99e61a9ccb5a", + "rev": "44a91898084f46797b5fac650c7e8c9ac38c43d4", "type": "github" }, "original": { @@ -100,11 +100,11 @@ "spectrum": { "flake": false, "locked": { - "lastModified": 1785761586, - "narHash": "sha256-MWOMVqJJERwjQGgRIv8d6rlEBqbLM3VZWxHkNKIIZNw=", + "lastModified": 1786032750, + "narHash": "sha256-+Ba/kIn5BjvV7PN8bWOo7RoqgTY/Yv2M7qeMf3wS2Ag=", "ref": "refs/heads/main", - "rev": "a7762d6f54b40560dd5255ce902e6e6a5d980fe9", - "revCount": 1416, + "rev": "77d2389874bb092b8dbf05ecc5b1030372e80e98", + "revCount": 1417, "type": "git", "url": "https://spectrum-os.org/git/spectrum" },