harald/nixcfg
1
0
Fork 0
Code Issues Pull requests 5 Projects Releases Packages Wiki Activity Actions

fix(cache-warm): unblock the nightly lock refresh (gitlab API 403) and the x1 flatpak build #59

Closed
hermes wants to merge 1 commit from hermes/cache-warm-gitlab403-flatpak into main AGit
pull from: hermes/cache-warm-gitlab403-flatpak
merge into: harald:main
Conversation 0 Commits 1 Files changed 5 +40 -54
hermes commented 2026-10-11 18:47:52 +02:00
Contributor
Copy link

Two independent breaks made cache-warm fail every night since 2026-10-06/09
and froze the fleet's flake.lock at 603b74b (06.10):

  1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the
    anonymous /repository/commits API — the call nix uses to resolve a branch
    HEAD — with a Cloudflare challenge (403 for every project and every UA;
    verified 11.10 from hermes and reproduced with a single 'nix flake update'
    here). The weekly-update run died before any build, so no lock was pushed.
    The API archive endpoint still serves anonymously, so the input now follows
    the same nixos-26.05 HEAD as an API-archive tarball. The transitive
    'blobs' input is rev-pinned and resolves via that endpoint, unchanged.

  2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9;
    flatpak 1.18.4 (nixpkgs-unstable since 29.09) reworked that function, so
    'Hunk #1 FAILED' killed flatpak -> xdg-desktop-portal -> the whole
    nixos-system-x1 closure. Applied via postPatch sed anchored on the line
    itself instead (version-agnostic, guarded no-op if upstream ever unsets
    the variable); built flatpak 1.18.4 with the overlay after the change.

PR #36 (push-before-exit) stays closed: the gating is intended, Harald
decided 24.09 on the PR; this fixes the reasons the run fails, not the gate.

Two independent breaks made cache-warm fail every night since 2026-10-06/09 and froze the fleet's flake.lock at 603b74b (06.10): 1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the anonymous /repository/commits API — the call nix uses to resolve a branch HEAD — with a Cloudflare challenge (403 for every project and every UA; verified 11.10 from hermes and reproduced with a single 'nix flake update' here). The weekly-update run died before any build, so no lock was pushed. The API archive endpoint still serves anonymously, so the input now follows the same nixos-26.05 HEAD as an API-archive tarball. The transitive 'blobs' input is rev-pinned and resolves via that endpoint, unchanged. 2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9; flatpak 1.18.4 (nixpkgs-unstable since 29.09) reworked that function, so 'Hunk #1 FAILED' killed flatpak -> xdg-desktop-portal -> the whole nixos-system-x1 closure. Applied via postPatch sed anchored on the line itself instead (version-agnostic, guarded no-op if upstream ever unsets the variable); built flatpak 1.18.4 with the overlay after the change. PR #36 (push-before-exit) stays closed: the gating is intended, Harald decided 24.09 on the PR; this fixes the reasons the run fails, not the gate.
fix(cache-warm): unblock the nightly lock refresh (gitlab API 403) and the x1 flatpak build
Some checks failed
nix flake check / flake-check (pull_request) Failing after 3s
Details
9c441ef4af 
Two independent breaks made cache-warm fail every night since 2026-10-06/09
and froze the fleet's flake.lock at 603b74b (06.10):

1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the
   anonymous /repository/commits API — the call nix uses to resolve a branch
   HEAD — with a Cloudflare challenge (403 for every project and every UA;
   verified 11.10 from hermes and reproduced with a single 'nix flake update'
   here). The weekly-update run died before any build, so no lock was pushed.
   The API archive endpoint still serves anonymously, so the input now follows
   the same nixos-26.05 HEAD as an API-archive tarball. The transitive
   'blobs' input is rev-pinned and resolves via that endpoint, unchanged.

2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9;
   flatpak 1.18.4 (nixpkgs-unstable since 29.09) reworked that function, so
   'Hunk #1 FAILED' killed flatpak -> xdg-desktop-portal -> the whole
   nixos-system-x1 closure. Applied via postPatch sed anchored on the line
   itself instead (version-agnostic, guarded no-op if upstream ever unsets
   the variable); built flatpak 1.18.4 with the overlay after the change.

PR #36 (push-before-exit) stays closed: the gating is intended, Harald
decided 24.09 on the PR; this fixes the reasons the run fails, not the gate.
hermes closed this pull request 2026-10-11 18:51:49 +02:00
Some checks failed
nix flake check / flake-check (pull_request) Failing after 3s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
harald/nixcfg!59
No description provided.