vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed

Browse source 
Job-level timeout-minutes is parsed but not enforced by this runner; only
the runner's jobTimeout bounds a job. Also fixes the devshell coverage
comment, the shellcheck job comment, an option description citing a script
that is not in the repo, and comment file pointers that resolve to nothing.
This commit is contained in:
atlas 2026-10-15 03:36:34 +02:00 • committed by mara
commit 2644c0d5f9
7 changed files with 20 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

19
.forgejo/workflows/ci.yml
View file

@ -7,14 +7,14 @@ on:
# Lets `hive-forge ci-rerun` re-trigger CI via workflow-dispatch API
workflow_dispatch:
# No job sets `timeout-minutes`: this runner parses a job-level key but does not
# enforce it. The runner's `services.hyperhive.deploy.ci-runner.jobTimeout`
# (default 1h) is the only bound on how long a job runs.
jobs:
check:
name: nix flake check
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
# 30 min is well above a cold-cache rebuild (~15 min observed) and well
# under the runner's 3h cap
timeout-minutes: 30
steps:
- uses: actions/checkout@v3
- name: check
@ -24,7 +24,6 @@ jobs:
name: tracker-tag lint
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v3
- name: lint
@ -34,7 +33,6 @@ jobs:
name: comment-block lint
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v3
- name: lint
@ -44,7 +42,6 @@ jobs:
name: doc-pointer lint
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v3
- name: lint
@ -54,7 +51,6 @@ jobs:
name: attribution-trailer lint
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v3
with:
@ -66,22 +62,23 @@ jobs:
name: dashboard-description lint
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v3
- name: lint
# jq isn't a project dependency elsewhere in this repo — same
# nix-shell-for-one-tool shape the vale/shellcheck jobs above use.
# nix-shell-for-one-tool shape the vale jobs below use.
run: nix shell nixpkgs#jq --command sh scripts/check-dashboard-descriptions.sh
shellcheck:
name: shellcheck
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 10
steps:
- uses: actions/checkout@v3
- name: lint
# `nix develop` enters the whole devshell for this one tool, which pins
# shellcheck to flake.lock; the vale and jq jobs take theirs from the registry.
#
# By shebang, not a `*.sh` glob — scripts/pre-push has no suffix.
run: |
files=$(grep -lE '^#!.*/(env[[:space:]]+)?(ba)?sh([[:space:]]|$)' scripts/* 2>/dev/null)
@ -95,7 +92,6 @@ jobs:
name: prose lint (vale)
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v3
- name: lint
@ -108,7 +104,6 @@ jobs:
name: prose lint (vale, errors)
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v3
- name: lint

9
.forgejo/workflows/coverage.yml
View file

@ -5,7 +5,7 @@ name: coverage
#
# ⚠️ The hour is deliberate: at the default job capacity of 1
# (`services.hyperhive.deploy.ci-runner.concurrency`) this job holds the
# runner for its whole timeout and everything else queues behind it.
# runner for its whole run and everything else queues behind it.
#
# Separate from ci.yml because a `workflow_dispatch` trigger there fires every
# job in that file, and this must not run per pull request.
@ -19,10 +19,9 @@ jobs:
name: cargo llvm-cov
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
# Above the 30 min `nix flake check` allows, because instrumented
# builds are slower than the ordinary ones and this starts from a
# cache that the normal jobs never populate.
timeout-minutes: 60
# Instrumented builds are slower than the ordinary ones and this starts
# from a cache that the normal jobs never populate. The runner's
# `jobTimeout` (default 1h) is the only bound; a longer run is killed.
steps:
- uses: actions/checkout@v3
- name: coverage

1
.forgejo/workflows/flake-update.yml
View file

@ -24,7 +24,6 @@ jobs:
name: nix flake update
if: vars.PUBLIC_FORGE != 'true'
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
timeout-minutes: 30
steps:
- uses: actions/checkout@v3
- name: update and open a PR if the lock changed

6
nix/devshell.nix
View file

@ -1,6 +1,6 @@
# Dev shell: the rust toolchain plus the exact native build inputs
# the crane derivations use (git, sqlite, pkg-config, cmake — see
# ../rust.nix), so a plain `cargo build` / `cargo test` in the shell
# ./rust.nix), so a plain `cargo build` / `cargo test` in the shell
# sees the same toolchain shape as CI.
{ pkgs, rust }:
{
@ -46,8 +46,8 @@
#
# Coverage is deliberately NOT part of `nix flake check`: an
# instrumented build cannot reuse the normal test artifacts, so it
# roughly doubles a test job. It runs on manual dispatch — see
# .forgejo/workflows/coverage.yml for why that rather than nightly.
# roughly doubles a test job. It runs nightly and on manual dispatch — see
# .forgejo/workflows/coverage.yml.
LLVM_PROFDATA = "${pkgs.llvmPackages.llvm}/bin/llvm-profdata";
LLVM_COV = "${pkgs.llvmPackages.llvm}/bin/llvm-cov";
};

4
nix/host-modules/hive-forge/default.nix
View file

@ -143,8 +143,8 @@ in
# view: the names and ports it answers on, the URLs it advertises, and the
# client id it is registered under. What lives here is what the host running
# it decides — which build it runs, how it is served, what it mirrors, and
# where its host-local secrets sit. Same rule as ./swarm-victorialogs.nix,
# and the renames are in ./deploy.nix with the rest.
# where its host-local secrets sit. Same rule as ../swarm-victorialogs.nix,
# and the renames are in ../deploy.nix with the rest.
options.services.hyperhive.deploy.forgejo = {
package = lib.mkOption {
type = lib.types.package;

4
nix/host-modules/hive-tls.nix
View file

@ -40,7 +40,7 @@ let
# reach the store, and waiting on a login to that store would take that
# path down whenever it is sealed. There the gateway starts on the hive
# leaf, or on a host without a hive on a throwaway self-signed pair
# (../hive-gateway/default.nix), and the issuing script re-imports the
# (./hive-gateway/default.nix), and the issuing script re-imports the
# services leaf into the running nginx once it lands.
#
# Nor on a host fronting no swarm name: it asks the store for the root
@ -51,7 +51,7 @@ let
# The hive leaf, `hive-tls-resign` and the hive identity it needs exist only
# where a hive runs. A gateway host without one serves the swarm-services
# leaf in their place (../hive-gateway/default.nix).
# leaf in their place (./hive-gateway/default.nix).
runsHive = hyperhiveCfg.deploy.hive-controller.enable;
# The gateway's own leaf is only issued when the gateway actually serves a

4
nix/host-modules/swarm-victorialogs-service.nix
View file

@ -57,8 +57,8 @@ in
⚠️ Every swarm container shares the host's network namespace, so
this is a swarm-wide claim rather than a per-container one — two
modules picking the same number collide at runtime with no bind
error and nothing in any log. `state/eval-port-collisions.sh`
checks the class.
error and nothing in any log. No repo-wide
check catches it.
'';
};