harald/nixcfg
1
0
Fork 0
Code Issues Pull requests 5 Projects Releases Packages Wiki Activity Actions

fix(cache-warm): unblock the nightly lock refresh (gitlab API 403) and the x1 flatpak build #61

Open
hermes wants to merge 1 commit from hermes/cache-warm-gitlab403-flatpak-v3 into main AGit
pull from: hermes/cache-warm-gitlab403-flatpak-v3
merge into: harald:main
Conversation 0 Commits 1 Files changed 5 +44 -54
hermes commented 2026-10-11 18:53:27 +02:00
Contributor
Copy link

Two independent breaks made cache-warm fail every night since 2026-10-07
and froze the fleet's flake.lock at 603b74b (pushed 06.10):

  1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the
    anonymous /repository/commits API - the call nix uses to resolve a branch
    HEAD - with a Cloudflare challenge (403 for every project and every UA;
    verified 11.10 from hermes, reproduced with a single 'nix flake update'
    here). The weekly-input run died before any build, so that night pushed
    no lock. The archive endpoint still serves anonymously, so the input now
    follows the same nixos-26.05 HEAD as an API-archive tarball, by numeric
    project id: the %2F path form 404s wherever the URL is decoded before the
    fetch (CI runner mx, run 58), the id cannot be mangled. mx imports switch
    to .nixosModules.mailserver - upstream dropped the .nixosModule alias
    after the pinned rev d357b9f0; the new spelling resolves on old and new
    revs alike.

  2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9;
    flatpak 1.18.4 (nixos-26.05 since 29.09, entered our lock via the 05.10
    bump) reworked that function, so 'Hunk #1 FAILED at 9' killed flatpak ->
    xdg-desktop-portal -> the whole nixos-system-x1 closure every morning.
    Applied via postPatch sed anchored on the line itself instead (version-
    agnostic, guarded no-op if upstream ever unsets the variable); built
    flatpak 1.18.4 with the overlay after the change.

PR #36 (push-before-exit) stays closed on purpose: Harald decided on 14.09
in its thread that the run must fail when a target failed; this fixes why
it fails, not the gate.

Two independent breaks made cache-warm fail every night since 2026-10-07 and froze the fleet's flake.lock at 603b74b (pushed 06.10): 1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the anonymous /repository/commits API - the call nix uses to resolve a branch HEAD - with a Cloudflare challenge (403 for every project and every UA; verified 11.10 from hermes, reproduced with a single 'nix flake update' here). The weekly-input run died before any build, so that night pushed no lock. The archive endpoint still serves anonymously, so the input now follows the same nixos-26.05 HEAD as an API-archive tarball, by numeric project id: the %2F path form 404s wherever the URL is decoded before the fetch (CI runner mx, run 58), the id cannot be mangled. mx imports switch to .nixosModules.mailserver - upstream dropped the .nixosModule alias after the pinned rev d357b9f0; the new spelling resolves on old and new revs alike. 2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9; flatpak 1.18.4 (nixos-26.05 since 29.09, entered our lock via the 05.10 bump) reworked that function, so 'Hunk #1 FAILED at 9' killed flatpak -> xdg-desktop-portal -> the whole nixos-system-x1 closure every morning. Applied via postPatch sed anchored on the line itself instead (version- agnostic, guarded no-op if upstream ever unsets the variable); built flatpak 1.18.4 with the overlay after the change. PR #36 (push-before-exit) stays closed on purpose: Harald decided on 14.09 in its thread that the run must fail when a target failed; this fixes why it fails, not the gate.
fix(cache-warm): unblock the nightly lock refresh (gitlab API 403) and the x1 flatpak build
All checks were successful
nix flake check / flake-check (pull_request) Successful in 4m17s
Details
ea959e098a 
Two independent breaks made cache-warm fail every night since 2026-10-07
and froze the fleet's flake.lock at 603b74b (pushed 06.10):

1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the
   anonymous /repository/commits API - the call nix uses to resolve a branch
   HEAD - with a Cloudflare challenge (403 for every project and every UA;
   verified 11.10 from hermes, reproduced with a single 'nix flake update'
   here). The weekly-input run died before any build, so that night pushed
   no lock. The archive endpoint still serves anonymously, so the input now
   follows the same nixos-26.05 HEAD as an API-archive tarball, by numeric
   project id: the %2F path form 404s wherever the URL is decoded before the
   fetch (CI runner mx, run 58), the id cannot be mangled. mx imports switch
   to .nixosModules.mailserver - upstream dropped the .nixosModule alias
   after the pinned rev d357b9f0; the new spelling resolves on old and new
   revs alike.

2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9;
   flatpak 1.18.4 (nixos-26.05 since 29.09, entered our lock via the 05.10
   bump) reworked that function, so 'Hunk #1 FAILED at 9' killed flatpak ->
   xdg-desktop-portal -> the whole nixos-system-x1 closure every morning.
   Applied via postPatch sed anchored on the line itself instead (version-
   agnostic, guarded no-op if upstream ever unsets the variable); built
   flatpak 1.18.4 with the overlay after the change.

PR #36 (push-before-exit) stays closed on purpose: Harald decided on 14.09
in its thread that the run must fail when a target failed; this fixes why
it fails, not the gate.
All checks were successful
nix flake check / flake-check (pull_request) Successful in 4m17s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin +refs/pull/61/head:hermes/cache-warm-gitlab403-flatpak-v3
git switch hermes/cache-warm-gitlab403-flatpak-v3
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
harald/nixcfg!61
No description provided.