From 84347f122cc6322bb71ac16f6dd4f187f37ac9d5 Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 5 Oct 2026 12:54:03 +0200 Subject: [PATCH] forgejo: actionsFromSelf defaults to whether this host runs the swarm-controller The controller seeds the actions/checkout mirror from its own host's mirror list, so a forge host without it got DEFAULT_ACTIONS_URL = self and no mirror. The default now follows deploy.swarm-controller.enable; the module-eval check pins forge-only (false, no warning) and forge+controller (true, mirror seeded). --- docs/scheduler/ci.md | 12 +++++++++--- nix/host-modules/deploy.nix | 5 +++-- nix/host-modules/hive-forge/default.nix | 13 ++++++++++--- nix/module-eval/swarm-services-switch.nix | 23 +++++++++++++++++++++++ 4 files changed, 45 insertions(+), 8 deletions(-) diff --git a/docs/scheduler/ci.md b/docs/scheduler/ci.md index ce2261a1..2c58dcb6 100644 --- a/docs/scheduler/ci.md +++ b/docs/scheduler/ci.md @@ -169,12 +169,18 @@ the forge admin panel as offline until an admin deletes it. -With `services.hyperhive.deploy.forgejo.actionsFromSelf` enabled (the default) -on the forge's host, the swarm controller seeds an `actions/checkout` pull-mirror on the forge -and Forgejo's `DEFAULT_ACTIONS_URL` points at the forge itself. CI +With `services.hyperhive.deploy.forgejo.actionsFromSelf` enabled, the swarm +controller seeds an `actions/checkout` pull-mirror on the forge and Forgejo's +`DEFAULT_ACTIONS_URL` points at the forge itself. CI `uses: actions/checkout@vN` steps then resolve on the forge, with no external DNS on the CI critical path. +The option defaults to whether the forge's host also runs the swarm controller +(`services.hyperhive.deploy.swarm-controller.enable`): on when it does, off +otherwise. Setting it `true` on a forge host without the controller leaves +`actions/checkout` unresolved, because nothing seeds the mirror; evaluation +warns about it. + The **swarm controller** seeds the mirror in its swarm-wide forge-objects diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix index 40e280b0..70eaad2e 100644 --- a/nix/host-modules/deploy.nix +++ b/nix/host-modules/deploy.nix @@ -53,8 +53,9 @@ let The runner registers as a new runner on the forge, so delete the old one in the forge's admin panel (Site administration, Actions, Runners). - The forge keeps resolving `uses: actions/checkout` from itself unless - services.hyperhive.deploy.forgejo.actionsFromSelf is false on its host. + A forge host that runs the swarm-controller keeps resolving + `uses: actions/checkout` from itself unless + services.hyperhive.deploy.forgejo.actionsFromSelf is false there. See docs/scheduler/ci.md. ''; in diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index 92dd0699..968b8af8 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -175,14 +175,15 @@ in failure on whatever reads it. With {option}`services.hyperhive.deploy.forgejo.actionsFromSelf` - enabled (the default), an `actions/checkout` mirror is appended to - this list. + enabled (the default on a host that runs the swarm-controller), an + `actions/checkout` mirror is appended to this list. ''; }; actionsFromSelf = lib.mkOption { type = lib.types.bool; - default = true; + default = deployCfg.swarm-controller.enable; + defaultText = lib.literalExpression "config.services.hyperhive.deploy.swarm-controller.enable"; example = false; description = '' Resolve a workflow's `uses: /@vN` against this forge @@ -192,6 +193,12 @@ in checkout then needs no external DNS; only the mirror's re-sync does. + Defaults to on when this host runs the swarm-controller, which seeds + the `actions/checkout` mirror, and off otherwise. Setting it `true` on + a host without the controller leaves `actions/checkout` unresolved: + nothing seeds the mirror, and the warning about unseeded mirrors + fires. + Any other action a workflow names has to be mirrored here too. Set to `false` to resolve actions from `data.forgejo.org` and seed no mirror. ''; diff --git a/nix/module-eval/swarm-services-switch.nix b/nix/module-eval/swarm-services-switch.nix index aeeb5723..f46d1cd8 100644 --- a/nix/module-eval/swarm-services-switch.nix +++ b/nix/module-eval/swarm-services-switch.nix @@ -117,6 +117,11 @@ let deploy.forgejo.enable = true; deploy.forgejo.mirrors = [ aMirror ]; }; + forgeOnly = hive { deploy.forgejo.enable = true; }; + forgeWithController = hive { + deploy.swarm-controller.enable = true; + deploy.forgejo.enable = true; + }; controllerWithSelfActions = hive { deploy.swarm-controller.enable = true; deploy.forgejo.enable = true; @@ -469,6 +474,24 @@ let && mirrorsOf controllerWithMirrors == [ aMirror ] && actionsUrlOf controllerWithMirrors == null; } + { + # The default follows the controller, the only thing that seeds the + # checkout mirror: a forge alone must not resolve actions from itself. + name = "actionsFromSelf defaults to whether this host runs the swarm-controller"; + ok = + let + actionsUrlOf = + m: m.containers.hive-forge.config.services.forgejo.settings.actions.DEFAULT_ACTIONS_URL or null; + mirrorsOf = + m: builtins.fromJSON m.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_FORGE_MIRRORS; + in + !forgeOnly.services.hyperhive.deploy.forgejo.actionsFromSelf + && actionsUrlOf forgeOnly == null + && forgeOnly.warnings == [ ] + && forgeWithController.services.hyperhive.deploy.forgejo.actionsFromSelf + && actionsUrlOf forgeWithController == "self" + && lib.elem "actions/checkout" (map (m: m.dest) (mirrorsOf forgeWithController)); + } { name = "the old c0re org-avatar option lands on the controller's unit"; ok =