update

.github/workflows/vulnix.yml

@@ -25,7 +25,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           API: ${{ github.api_url }}
           REPO: ${{ github.repository }}
-        run: 'nix run -L .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"'
+        run: nix run -L .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"
 
       - name: close resolved issue
         if: steps.scan.outputs.count == '0'

ci.nix

@@ -1,17 +1,10 @@
 { lib, pkgs }:
-let
-  # vulnix's bundled nix-2.34 broke its own --experimental-features detection
-  nixConf = pkgs.writeText "ci-nix.conf" "experimental-features = nix-command flakes";
-in
 # tools must track ci.py's subprocess calls; nix stays ambient (uses the
 # runner's own nix, not a pinned one).
 pkgs.writers.writePython3Bin "ci" {
   flakeIgnore = [ "E501" ];
   libraries = [ pkgs.python3Packages.subprocess-tee ];
   makeWrapperArgs = [
-    "--set-default"
-    "NIX_USER_CONF_FILES"
-    (toString nixConf)
     "--prefix"
     "PATH"
     ":"

ci.py

@@ -18,8 +18,7 @@ def run(*args, **kw):
 
 
 def nix(*args):
-    # tee to stderr - stdout leaks into GITHUB_OUTPUT $() captures
+    return subprocess_tee.run(("nix", "--extra-experimental-features", "nix-command flakes", "-L", *args), check=True, text=True).stdout
-    return subprocess_tee.run(("nix", "--extra-experimental-features", "nix-command flakes", "-L", *args), check=True, text=True, stdout=sys.stderr).stdout
 
 
 def git(*args, check=True):

containers/server-n0/git.nix

@@ -163,9 +163,10 @@ in
             trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" ];
           };
 
-          nix.settings = {
+          nix.gc = {
-            min-free = 5 * 1024 * 1024 * 1024;
+            automatic = true;
-            max-free = 10 * 1024 * 1024 * 1024;
+            dates = "daily";
+            options = "--delete-older-than 14d";
           };
           # nix.optimise.automatic = true; - doesn't work with microvm.writableStoreOverlay