harald/nixcfg
1
0
Fork 0
Code Issues Pull requests 5 Projects Releases Packages Wiki Activity Actions

fix(cache-warm): unblock the nightly lock refresh (gitlab API 403) and the x1 flatpak build #60

Closed
hermes wants to merge 1 commit from hermes/cache-warm-gitlab403-flatpak-v2 into main AGit
pull from: hermes/cache-warm-gitlab403-flatpak-v2
merge into: harald:main
Conversation 0 Commits 1 Files changed 5 +44 -54
hermes commented 2026-10-11 18:51:50 +02:00
Contributor
Copy link

Two independent breaks made cache-warm fail every night since 2026-10-06/09
and froze the fleet's flake.lock at 603b74b (06.10):

  1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the
    anonymous /repository/commits API - the call nix uses to resolve a branch
    HEAD - with a Cloudflare challenge (403 for every project and every UA;
    verified 11.10 from hermes and reproduced with a single 'nix flake update'
    here). The weekly-update run died before any build, so no lock was ever
    pushed. The archive endpoint still serves anonymously, so the input now
    follows the same nixos-26.05 HEAD as an API-archive tarball, by numeric
    project id: the %2F path form 404s wherever the URL is decoded before the
    fetch (CI runner mx, run 58), the id cannot be mangled. mx imports switch
    to .nixosModules.mailserver - upstream dropped the .nixosModule alias
    after the pinned rev; the new spelling resolves on old and new revs.

  2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9;
    flatpak 1.18.4 (nixpkgs-unstable since 29.09) reworked that function, so
    'Hunk #1 FAILED at 9' killed flatpak -> xdg-desktop-portal -> the whole
    nixos-system-x1 closure. Applied via postPatch sed anchored on the line
    itself instead (version-agnostic, guarded no-op if upstream ever unsets
    the variable); built flatpak 1.18.4 with the overlay after the change.

PR #36 (push-before-exit) stays closed on purpose: Harald decided on 24.09
that the run must fail when a target failed; this fixes why it fails, not
the gate.

Two independent breaks made cache-warm fail every night since 2026-10-06/09 and froze the fleet's flake.lock at 603b74b (06.10): 1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the anonymous /repository/commits API - the call nix uses to resolve a branch HEAD - with a Cloudflare challenge (403 for every project and every UA; verified 11.10 from hermes and reproduced with a single 'nix flake update' here). The weekly-update run died before any build, so no lock was ever pushed. The archive endpoint still serves anonymously, so the input now follows the same nixos-26.05 HEAD as an API-archive tarball, by numeric project id: the %2F path form 404s wherever the URL is decoded before the fetch (CI runner mx, run 58), the id cannot be mangled. mx imports switch to .nixosModules.mailserver - upstream dropped the .nixosModule alias after the pinned rev; the new spelling resolves on old and new revs. 2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9; flatpak 1.18.4 (nixpkgs-unstable since 29.09) reworked that function, so 'Hunk #1 FAILED at 9' killed flatpak -> xdg-desktop-portal -> the whole nixos-system-x1 closure. Applied via postPatch sed anchored on the line itself instead (version-agnostic, guarded no-op if upstream ever unsets the variable); built flatpak 1.18.4 with the overlay after the change. PR #36 (push-before-exit) stays closed on purpose: Harald decided on 24.09 that the run must fail when a target failed; this fixes why it fails, not the gate.
fix(cache-warm): unblock the nightly lock refresh (gitlab API 403) and the x1 flatpak build
All checks were successful
nix flake check / flake-check (pull_request) Successful in 4m20s
Details
462956ab22 
Two independent breaks made cache-warm fail every night since 2026-10-06/09
and froze the fleet's flake.lock at 603b74b (06.10):

1. simple-nixos-mailserver followed a gitlab: input. GitLab now answers the
   anonymous /repository/commits API - the call nix uses to resolve a branch
   HEAD - with a Cloudflare challenge (403 for every project and every UA;
   verified 11.10 from hermes and reproduced with a single 'nix flake update'
   here). The weekly-update run died before any build, so no lock was ever
   pushed. The archive endpoint still serves anonymously, so the input now
   follows the same nixos-26.05 HEAD as an API-archive tarball, by numeric
   project id: the %2F path form 404s wherever the URL is decoded before the
   fetch (CI runner mx, run 58), the id cannot be mangled. mx imports switch
   to .nixosModules.mailserver - upstream dropped the .nixosModule alias
   after the pinned rev; the new spelling resolves on old and new revs.

2. The flatpak overlay carried a diff anchored at profile/flatpak.fish:9;
   flatpak 1.18.4 (nixpkgs-unstable since 29.09) reworked that function, so
   'Hunk #1 FAILED at 9' killed flatpak -> xdg-desktop-portal -> the whole
   nixos-system-x1 closure. Applied via postPatch sed anchored on the line
   itself instead (version-agnostic, guarded no-op if upstream ever unsets
   the variable); built flatpak 1.18.4 with the overlay after the change.

PR #36 (push-before-exit) stays closed on purpose: Harald decided on 24.09
that the run must fail when a target failed; this fixes why it fails, not
the gate.
hermes closed this pull request 2026-10-11 18:53:26 +02:00
All checks were successful
nix flake check / flake-check (pull_request) Successful in 4m20s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
harald/nixcfg!60
No description provided.