vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

push green meta builds to the attic cache and record cached

Browse source
This commit is contained in:
atlas 2026-10-27 10:12:35 +01:00
commit 0849afec80
1 changed files with 779 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nix/module-eval/builder.nix
View file

@ -29,6 +29,8 @@ let
withBuilder = hive {
deploy.bao.enable = true;
deploy.builder.enable = true;
swarm.attic.domain = "cache.example.org";
swarm.attic.cache = "grid";
};
servicesHere = shared.swarmServicesWithController;
@ -48,6 +50,8 @@ let
inner = container.config;
svc = inner.systemd.services.swarm-builder;
env = svc.environment;
hasOnPath = name: s: lib.any (p: lib.getName p == name) s.path;
withoutCache = servicesHere.containers.swarm-builder.config.systemd.services.swarm-builder;
# The check flake on the inputs the builder's unit names, called as
# `nix build` calls it. `hyperhive` is entered through the filtered source's
@ -116,6 +120,25 @@ let
&& svc.serviceConfig.DynamicUser
&& !(lib.any (lib.hasSuffix "TOKEN") (lib.attrNames env));
}
{
# The closure is pushed with `attic` from the unit, whose config file holds
# the push token: it goes in a runtime directory only the dynamic user can
# enter, and the token is in no variable. The host without a cache is the
# control: same unit, none of it, with `git` still on the path to show
# the lookup finds what is there.
name = "the builder pushes to the configured cache with attic from a private runtime directory, and pushes nowhere without one";
ok =
env.SWARM_BUILDER_ATTIC_DOMAIN == "cache.example.org"
&& env.SWARM_BUILDER_ATTIC_CACHE == "grid"
&& hasOnPath "attic-client" svc
&& svc.serviceConfig.RuntimeDirectory == "swarm-builder"
&& svc.serviceConfig.RuntimeDirectoryMode == "0700"
&& !(lib.any (lib.hasInfix "TOKEN") (lib.attrNames env))
&& hasOnPath "git" withoutCache
&& !(hasOnPath "attic-client" withoutCache)
&& !(withoutCache.environment ? SWARM_BUILDER_ATTIC_DOMAIN)
&& !(withoutCache.environment ? SWARM_BUILDER_ATTIC_CACHE);
}
{
# The minting unit goes inactive after each run, so a start that pulls it
# runs it again and mints a leaf that is missing; an active