From c31c69c568cada8824e7a04f85290ef959687dde Mon Sep 17 00:00:00 2001 From: mintaka Date: Fri, 21 Aug 2026 14:43:42 -0400 Subject: [PATCH 1/4] ci: add CI gate for branch protection (RIG-2213) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a `.github/workflows/rigel-ci.yml` whose job is named `CI` so the fork's `main` branch-protection ruleset can pin `["CI"]` as its required status check. The job runs `nix build .#devenv` — the same build command upstream's own `build.yml` runs — on a GitHub-hosted `ubuntu-latest` runner. It pulls the closure from the `devenv.cachix.org` substituter the flake already declares, so it is a real (non-vacuous) gate that can go green here. Why standalone rather than aggregating upstream's `pipeline`: upstream's per-system pipeline runs on `self-hosted` runners this fork does not have, so a `needs:`-aggregator over it would sit `queued` indefinitely and wedge the required-check pin. Co-authored-by: Matt Wilkinson --- .github/workflows/rigel-ci.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/rigel-ci.yml diff --git a/.github/workflows/rigel-ci.yml b/.github/workflows/rigel-ci.yml new file mode 100644 index 0000000000..890aa28f9f --- /dev/null +++ b/.github/workflows/rigel-ci.yml @@ -0,0 +1,26 @@ +name: CI + +# Branch-protection gate producing a check-run literally named `CI` for the +# fork's `main` ruleset to pin (RIG-2213). Upstream's own pipeline runs on +# self-hosted runners this fork does not have, so a `needs:`-aggregator over it +# would sit `queued` forever and wedge the pin. This standalone job runs the +# same build command upstream's build.yml runs (`nix build .#devenv`) on a +# GitHub-hosted runner, pulling the closure from the devenv cachix substituter +# the flake already declares, so it is a real gate that can go green here. + +on: + pull_request: + push: + branches: + - main + +permissions: + contents: read + +jobs: + CI: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 + - run: nix build -L --show-trace .#devenv From c6e634ca3631c0f2b9a46550adb11fac678a6e49 Mon Sep 17 00:00:00 2001 From: mintaka Date: Fri, 21 Aug 2026 21:31:51 -0400 Subject: [PATCH 2/4] ci: neutralize inherited fork-CI noise (generate + self-hosted PR gate) (RIG-2213) Two pre-existing upstream workflows light up red/hung once Actions is enabled on the RigelBuild fork; neither has a monorepo consumer and the fork's real build gate is the standalone rigel-ci.yml `CI` producer (`nix build .#devenv`, GitHub-hosted, the branch-protection pin target): - generate.yml -> .disabled: regenerates docs and auto-commits via EndBug/add-and-commit on push, which 403s (the bot cannot push to a protected fork main) and then reds every PR on the uncommitted-diff check. We consume devenv as a pinned nix flake input, not its generated docs. - pr-test.yml: its `pipeline` matrix runs on upstream Cachix's self-hosted runners (warm nix store + native Apple Silicon) that RigelBuild has no runners for, so every leg sits `queued` forever on the fork. Scope it to the upstream owner (`if: github.repository_owner == 'cachix'`) so it skips cleanly. The richer multi-arch build + cache-push PR gate is deliberately left to RIG-2449; the release path (release.yml / release-test.yml) is untouched for the same reason. Spec-impact: none --- .../workflows/{generate.yml => generate.yml.disabled} | 0 .github/workflows/pr-test.yml | 9 +++++++++ 2 files changed, 9 insertions(+) rename .github/workflows/{generate.yml => generate.yml.disabled} (100%) diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml.disabled similarity index 100% rename from .github/workflows/generate.yml rename to .github/workflows/generate.yml.disabled diff --git a/.github/workflows/pr-test.yml b/.github/workflows/pr-test.yml index 2de4ca8b12..aaaa245e35 100644 --- a/.github/workflows/pr-test.yml +++ b/.github/workflows/pr-test.yml @@ -27,6 +27,15 @@ concurrency: jobs: pipeline: name: pipeline (${{ matrix.system }}) + # RigelBuild fork: this matrix runs on upstream Cachix's self-hosted + # runners (warm nix store + native Apple Silicon), which RigelBuild has + # no runners registered for — so on the fork every leg sits `queued` + # forever. The fork's real PR build gate is the standalone rigel-ci.yml + # `CI` producer (`nix build .#devenv` on a GitHub-hosted runner), which is + # also the branch-protection pin target. Scope this inherited matrix to + # the upstream owner so it skips cleanly on the fork rather than hanging. + # (The richer multi-arch build + cache-push gate is RIG-2449.) (RIG-2213) + if: github.repository_owner == 'cachix' strategy: fail-fast: false From bb4e6be79d0f0f33ade3e58e6351e7b888c585d6 Mon Sep 17 00:00:00 2001 From: mintaka Date: Fri, 21 Aug 2026 22:22:32 -0400 Subject: [PATCH 3/4] ci: wire the devenv substituter into the CI producer (RIG-2213) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The producer ran `nix build .#devenv` with no binary cache: the flake declares devenv.cachix.org only in `nixConfig.extra-substituters`, which nix ignores non-interactively without `--accept-flake-config`. So on the fork the gate cold-compiled the custom Nix fork (`github:cachix/nix/devenv-2.35`) and nixd from source — a 24-minute build one heavier closure away from exhausting the hosted runner, on the very check `main` will pin. Add `cachix/cachix-action` (pull-only, name `devenv`, no authToken), matching upstream build.yml, so the closure is substituted rather than built. Add a `concurrency` group so superseded pushes cancel instead of running redundant full builds to completion. Spec-impact: none --- .github/workflows/rigel-ci.yml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/rigel-ci.yml b/.github/workflows/rigel-ci.yml index 890aa28f9f..2d42012048 100644 --- a/.github/workflows/rigel-ci.yml +++ b/.github/workflows/rigel-ci.yml @@ -5,8 +5,11 @@ name: CI # self-hosted runners this fork does not have, so a `needs:`-aggregator over it # would sit `queued` forever and wedge the pin. This standalone job runs the # same build command upstream's build.yml runs (`nix build .#devenv`) on a -# GitHub-hosted runner, pulling the closure from the devenv cachix substituter -# the flake already declares, so it is a real gate that can go green here. +# GitHub-hosted runner. The devenv substituter is wired explicitly via +# cachix-action (matching upstream build.yml) rather than the flake's +# `nixConfig.extra-substituters`, which nix ignores non-interactively without +# `--accept-flake-config`; without it the build would cold-compile the custom +# Nix fork + full closure from source and risk exhausting the hosted runner. on: pull_request: @@ -14,6 +17,10 @@ on: branches: - main +concurrency: + group: rigel-ci-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read @@ -23,4 +30,11 @@ jobs: steps: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 + # Pull-only: no authToken (we do not push to upstream's cache from the + # fork's PR gate). Names the devenv substituter so the closure — notably + # the custom Nix fork `github:cachix/nix/devenv-2.35` and nixd, which are + # not on cache.nixos.org — is fetched, not rebuilt. + - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 + with: + name: devenv - run: nix build -L --show-trace .#devenv From 24e632d7d9854064a717b95b98db2a28fbef299c Mon Sep 17 00:00:00 2001 From: mintaka Date: Fri, 21 Aug 2026 22:26:37 -0400 Subject: [PATCH 4/4] ci: fail fast on the devenv CI build with a 20m timeout (RIG-2213) With the substituter wired the build is fast, but a substituter regression would fall back to a cold rebuild and hang to GitHub's 6h job default on the check `main` pins. Add `timeout-minutes: 20` so a regression surfaces as a fast failure. Spec-impact: none --- .github/workflows/rigel-ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/rigel-ci.yml b/.github/workflows/rigel-ci.yml index 2d42012048..e320853aa3 100644 --- a/.github/workflows/rigel-ci.yml +++ b/.github/workflows/rigel-ci.yml @@ -27,6 +27,9 @@ permissions: jobs: CI: runs-on: ubuntu-latest + # Fail fast if a substituter regression forces a cold rebuild of the + # closure, rather than hanging to the 6h job default on the pinned check. + timeout-minutes: 20 steps: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31