From 2644c0d5f9bbb8d1bb884752fddc144d17678a79 Mon Sep 17 00:00:00 2001 From: atlas Date: Thu, 15 Oct 2026 03:36:34 +0200 Subject: [PATCH] CI and devshell comments say what the config does: jobTimeout bounds jobs, coverage runs nightly, dead timeout keys removed Job-level timeout-minutes is parsed but not enforced by this runner; only the runner's jobTimeout bounds a job. Also fixes the devshell coverage comment, the shellcheck job comment, an option description citing a script that is not in the repo, and comment file pointers that resolve to nothing. --- .forgejo/workflows/ci.yml | 19 +++++++------------ .forgejo/workflows/coverage.yml | 9 ++++----- .forgejo/workflows/flake-update.yml | 1 - nix/devshell.nix | 6 +++--- nix/host-modules/hive-forge/default.nix | 4 ++-- nix/host-modules/hive-tls.nix | 4 ++-- .../swarm-victorialogs-service.nix | 4 ++-- 7 files changed, 20 insertions(+), 27 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 84c01cd7..b7cbe931 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -7,14 +7,14 @@ on: # Lets `hive-forge ci-rerun` re-trigger CI via workflow-dispatch API workflow_dispatch: +# No job sets `timeout-minutes`: this runner parses a job-level key but does not +# enforce it. The runner's `services.hyperhive.deploy.ci-runner.jobTimeout` +# (default 1h) is the only bound on how long a job runs. jobs: check: name: nix flake check if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - # 30 min is well above a cold-cache rebuild (~15 min observed) and well - # under the runner's 3h cap - timeout-minutes: 30 steps: - uses: actions/checkout@v3 - name: check @@ -24,7 +24,6 @@ jobs: name: tracker-tag lint if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: lint @@ -34,7 +33,6 @@ jobs: name: comment-block lint if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: lint @@ -44,7 +42,6 @@ jobs: name: doc-pointer lint if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: lint @@ -54,7 +51,6 @@ jobs: name: attribution-trailer lint if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 5 steps: - uses: actions/checkout@v3 with: @@ -66,22 +62,23 @@ jobs: name: dashboard-description lint if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: lint # jq isn't a project dependency elsewhere in this repo — same - # nix-shell-for-one-tool shape the vale/shellcheck jobs above use. + # nix-shell-for-one-tool shape the vale jobs below use. run: nix shell nixpkgs#jq --command sh scripts/check-dashboard-descriptions.sh shellcheck: name: shellcheck if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 10 steps: - uses: actions/checkout@v3 - name: lint + # `nix develop` enters the whole devshell for this one tool, which pins + # shellcheck to flake.lock; the vale and jq jobs take theirs from the registry. + # # By shebang, not a `*.sh` glob — scripts/pre-push has no suffix. run: | files=$(grep -lE '^#!.*/(env[[:space:]]+)?(ba)?sh([[:space:]]|$)' scripts/* 2>/dev/null) @@ -95,7 +92,6 @@ jobs: name: prose lint (vale) if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: lint @@ -108,7 +104,6 @@ jobs: name: prose lint (vale, errors) if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: lint diff --git a/.forgejo/workflows/coverage.yml b/.forgejo/workflows/coverage.yml index 2b61ecd0..62ba9dbc 100644 --- a/.forgejo/workflows/coverage.yml +++ b/.forgejo/workflows/coverage.yml @@ -5,7 +5,7 @@ name: coverage # # ⚠️ The hour is deliberate: at the default job capacity of 1 # (`services.hyperhive.deploy.ci-runner.concurrency`) this job holds the -# runner for its whole timeout and everything else queues behind it. +# runner for its whole run and everything else queues behind it. # # Separate from ci.yml because a `workflow_dispatch` trigger there fires every # job in that file, and this must not run per pull request. @@ -19,10 +19,9 @@ jobs: name: cargo llvm-cov if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - # Above the 30 min `nix flake check` allows, because instrumented - # builds are slower than the ordinary ones and this starts from a - # cache that the normal jobs never populate. - timeout-minutes: 60 + # Instrumented builds are slower than the ordinary ones and this starts + # from a cache that the normal jobs never populate. The runner's + # `jobTimeout` (default 1h) is the only bound; a longer run is killed. steps: - uses: actions/checkout@v3 - name: coverage diff --git a/.forgejo/workflows/flake-update.yml b/.forgejo/workflows/flake-update.yml index 3ca76557..f3b053d8 100644 --- a/.forgejo/workflows/flake-update.yml +++ b/.forgejo/workflows/flake-update.yml @@ -24,7 +24,6 @@ jobs: name: nix flake update if: vars.PUBLIC_FORGE != 'true' runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }} - timeout-minutes: 30 steps: - uses: actions/checkout@v3 - name: update and open a PR if the lock changed diff --git a/nix/devshell.nix b/nix/devshell.nix index 5c971abf..f48fd752 100644 --- a/nix/devshell.nix +++ b/nix/devshell.nix @@ -1,6 +1,6 @@ # Dev shell: the rust toolchain plus the exact native build inputs # the crane derivations use (git, sqlite, pkg-config, cmake — see -# ../rust.nix), so a plain `cargo build` / `cargo test` in the shell +# ./rust.nix), so a plain `cargo build` / `cargo test` in the shell # sees the same toolchain shape as CI. { pkgs, rust }: { @@ -46,8 +46,8 @@ # # Coverage is deliberately NOT part of `nix flake check`: an # instrumented build cannot reuse the normal test artifacts, so it - # roughly doubles a test job. It runs on manual dispatch — see - # .forgejo/workflows/coverage.yml for why that rather than nightly. + # roughly doubles a test job. It runs nightly and on manual dispatch — see + # .forgejo/workflows/coverage.yml. LLVM_PROFDATA = "${pkgs.llvmPackages.llvm}/bin/llvm-profdata"; LLVM_COV = "${pkgs.llvmPackages.llvm}/bin/llvm-cov"; }; diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index abe84206..68eece45 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -143,8 +143,8 @@ in # view: the names and ports it answers on, the URLs it advertises, and the # client id it is registered under. What lives here is what the host running # it decides — which build it runs, how it is served, what it mirrors, and - # where its host-local secrets sit. Same rule as ./swarm-victorialogs.nix, - # and the renames are in ./deploy.nix with the rest. + # where its host-local secrets sit. Same rule as ../swarm-victorialogs.nix, + # and the renames are in ../deploy.nix with the rest. options.services.hyperhive.deploy.forgejo = { package = lib.mkOption { type = lib.types.package; diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix index 1f27697e..b3a62ce1 100644 --- a/nix/host-modules/hive-tls.nix +++ b/nix/host-modules/hive-tls.nix @@ -40,7 +40,7 @@ let # reach the store, and waiting on a login to that store would take that # path down whenever it is sealed. There the gateway starts on the hive # leaf, or on a host without a hive on a throwaway self-signed pair - # (../hive-gateway/default.nix), and the issuing script re-imports the + # (./hive-gateway/default.nix), and the issuing script re-imports the # services leaf into the running nginx once it lands. # # Nor on a host fronting no swarm name: it asks the store for the root @@ -51,7 +51,7 @@ let # The hive leaf, `hive-tls-resign` and the hive identity it needs exist only # where a hive runs. A gateway host without one serves the swarm-services - # leaf in their place (../hive-gateway/default.nix). + # leaf in their place (./hive-gateway/default.nix). runsHive = hyperhiveCfg.deploy.hive-controller.enable; # The gateway's own leaf is only issued when the gateway actually serves a diff --git a/nix/host-modules/swarm-victorialogs-service.nix b/nix/host-modules/swarm-victorialogs-service.nix index f59936f4..efb753e3 100644 --- a/nix/host-modules/swarm-victorialogs-service.nix +++ b/nix/host-modules/swarm-victorialogs-service.nix @@ -57,8 +57,8 @@ in ⚠️ Every swarm container shares the host's network namespace, so this is a swarm-wide claim rather than a per-container one — two modules picking the same number collide at runtime with no bind - error and nothing in any log. `state/eval-port-collisions.sh` - checks the class. + error and nothing in any log. No repo-wide + check catches it. ''; };