From aa7ebbcd3b0a1fa9538c79bec310e915a27842c0 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 31 May 2026 23:24:16 +0200 Subject: [PATCH 1/6] =?UTF-8?q?feat:=20add=20hive-ci=20module=20=E2=80=94?= =?UTF-8?q?=20Forgejo=20Actions=20runner=20for=20CI?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds `services.hyperhive.ci` NixOS module that spins up a `hive-ci` nixos-container running `gitea-actions-runner` against the hive-forge Forgejo instance. Off by default; opt in with `ci.enable = true` after generating a runner registration token in Forgejo. Also adds `.forgejo/workflows/ci.yml` with four jobs: nix flake check, formatting (nix fmt + cargo fmt), cargo test, and cargo clippy. Jobs target the `hive-ci` runner label. Container design mirrors hive-forge (shared host netns, non-ephemeral state, loopback reach to forge). sandbox-fallback = true since nspawn containers can't create user-namespaces for nix sandbox. Closes #175. Co-Authored-By: Claude Sonnet 4.6 --- .forgejo/workflows/ci.yml | 42 +++++++++ flake.nix | 1 + nix/modules/hive-c0re.nix | 86 +++++++++-------- nix/modules/hive-ci.nix | 191 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 283 insertions(+), 37 deletions(-) create mode 100644 .forgejo/workflows/ci.yml create mode 100644 nix/modules/hive-ci.nix diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml new file mode 100644 index 00000000..a6fb111a --- /dev/null +++ b/.forgejo/workflows/ci.yml @@ -0,0 +1,42 @@ +name: CI + +on: + push: + branches: ["**"] + pull_request: + branches: ["**"] + +jobs: + check: + name: nix flake check + runs-on: [hive-ci] + steps: + - uses: actions/checkout@v3 + - name: check + run: nix flake check --no-build + + fmt: + name: formatting + runs-on: [hive-ci] + steps: + - uses: actions/checkout@v3 + - name: nix fmt + run: nix fmt -- --check . + - name: cargo fmt + run: cargo fmt --all -- --check + + test: + name: cargo test + runs-on: [hive-ci] + steps: + - uses: actions/checkout@v3 + - name: test + run: cargo test --workspace + + clippy: + name: cargo clippy + runs-on: [hive-ci] + steps: + - uses: actions/checkout@v3 + - name: clippy + run: cargo clippy --workspace -- -D warnings diff --git a/flake.nix b/flake.nix index 840653fd..0169702c 100644 --- a/flake.nix +++ b/flake.nix @@ -246,6 +246,7 @@ agentBaseToplevel = self.packages.x86_64-linux.agent-base-toplevel; managerToplevel = self.packages.x86_64-linux.manager-toplevel; }; + hive-ci = ./nix/modules/hive-ci.nix; hive-forge = ./nix/modules/hive-forge.nix; # Convenience alias: one import covers the full hyperhive host # stack (hive-c0re + hive-forge, since hive-c0re already pulls diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index 8de18a11..2565e27e 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -22,6 +22,7 @@ in # opt-in (off by default) and asserts that `services.hyperhive.domain` # is set before it can be enabled. imports = [ + ./hive-ci.nix ./hive-forge.nix ./hive-gateway.nix ./hive-matrix.nix @@ -99,34 +100,40 @@ in # `identity.rs::peers()` + the dashboard's `peer_hives` state field # (feeds the P33RS dashboard tab). options.services.hyperhive.peers = lib.mkOption { - type = lib.types.attrsOf (lib.types.submodule { - options = { - domain = lib.mkOption { - type = lib.types.str; - example = "lab.example.com"; - description = '' - DNS domain of the peer hive. Used to construct the peer's - dashboard URL (`http://''${domain}/`) and for Matrix - federation auto-discovery (`matrix.''${domain}`). - Must be reachable from this host. - ''; + type = lib.types.attrsOf ( + lib.types.submodule { + options = { + domain = lib.mkOption { + type = lib.types.str; + example = "lab.example.com"; + description = '' + DNS domain of the peer hive. Used to construct the peer's + dashboard URL (`http://''${domain}/`) and for Matrix + federation auto-discovery (`matrix.''${domain}`). + Must be reachable from this host. + ''; + }; + tlsCertFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + description = '' + Optional path to a PEM cert/bundle to trust for this peer's + TLS. Null = system CA bundle (for Let's Encrypt peers). Set + to the peer's self-signed cert for `selfSignedTls = true` + peers. Forward-compat slot; not yet used in v0. + ''; + }; }; - tlsCertFile = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - description = '' - Optional path to a PEM cert/bundle to trust for this peer's - TLS. Null = system CA bundle (for Let's Encrypt peers). Set - to the peer's self-signed cert for `selfSignedTls = true` - peers. Forward-compat slot; not yet used in v0. - ''; - }; - }; - }); + } + ); default = { }; example = { - lab = { domain = "lab.example.com"; }; - edge = { domain = "edge.corp"; }; + lab = { + domain = "lab.example.com"; + }; + edge = { + domain = "edge.corp"; + }; }; description = '' Peer hives in the same swarm. The attrset key is a short label @@ -345,24 +352,29 @@ in # links; when false it falls back to direct `:` TCP. HIVE_GATEWAY_ENABLED = "1"; } - // lib.optionalAttrs (config.services.hyperhive.forge.enable && config.services.hyperhive.forge.behindGateway) { - # Public URL of the forge vhost served by hive-gateway. The - # dashboard uses this to build browser-facing forge links - # instead of hardcoding `:3000`, which breaks when - # the operator accesses the dashboard through the gateway - # (forge sub-domain has no port; direct port URL would be - # wrong). Absent when `behindGateway = false` — dashboard - # falls back to `:3000`. - HIVE_FORGE_PUBLIC_URL = "https://${config.services.hyperhive.forge.domain}"; - } + // + lib.optionalAttrs + (config.services.hyperhive.forge.enable && config.services.hyperhive.forge.behindGateway) + { + # Public URL of the forge vhost served by hive-gateway. The + # dashboard uses this to build browser-facing forge links + # instead of hardcoding `:3000`, which breaks when + # the operator accesses the dashboard through the gateway + # (forge sub-domain has no port; direct port URL would be + # wrong). Absent when `behindGateway = false` — dashboard + # falls back to `:3000`. + HIVE_FORGE_PUBLIC_URL = "https://${config.services.hyperhive.forge.domain}"; + } // lib.optionalAttrs (config.services.hyperhive.peers != { }) { # Peer hives serialised as a JSON array of {label, domain} objects. # Consumed by hive-ag3nt::identity::peers() + the dashboard's # peer_hives StateSnapshot field (P33RS tab). tlsCertFile is # nix-side-only (host nginx/trust config); rust never needs the path. HYPERHIVE_PEERS = builtins.toJSON ( - lib.mapAttrsToList (label: p: { inherit label; inherit (p) domain; }) - config.services.hyperhive.peers + lib.mapAttrsToList (label: p: { + inherit label; + inherit (p) domain; + }) config.services.hyperhive.peers ); }; serviceConfig = { diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix new file mode 100644 index 00000000..04925031 --- /dev/null +++ b/nix/modules/hive-ci.nix @@ -0,0 +1,191 @@ +{ + pkgs, + lib, + config, + ... +}: +let + cfg = config.services.hyperhive.ci; + forgeCfg = config.services.hyperhive.forge; +in +{ + # Forgejo Actions runner in a `hive-ci` nixos-container. + # Shares host netns (same as hive-forge), so the runner reaches + # the forge at `http://127.0.0.1:` without extra plumbing. + # Container is non-ephemeral: the runner's registered credentials + # survive restarts (gitea-actions-runner writes them to its stateDir + # on first registration and reuses them on every subsequent start). + # + # Nix builds inside the container use the shared /nix/store (standard + # nixos-container behaviour) with sandbox-fallback = true, because + # nspawn containers can't create the user-namespaces that nix sandboxing + # requires. See docs/gotchas.md. + # + # Operator bootstrap: generate a runner registration token in Forgejo + # (Site Administration → Runners → Registration Token), store it in + # a secrets file on the host, and point `runnerTokenFile` at it. + # The token is consumed on first start; the runner's persistent + # credentials live in the container state dir afterwards. + + options.services.hyperhive.ci = { + enable = lib.mkOption { + type = lib.types.bool; + default = false; + example = true; + description = '' + Run a Forgejo Actions runner in a `hive-ci` nixos-container. + Disabled by default; requires `services.hyperhive.forge.enable = true` + (the runner registers against the hive-forge instance) and a + registration token at `runnerTokenFile`. + ''; + }; + + runnerTokenFile = lib.mkOption { + type = lib.types.path; + example = "/run/secrets/ci-runner-token"; + description = '' + Host path to a file containing the Forgejo runner registration + token (one token per line, no trailing whitespace). Obtain it + from Forgejo: Site Administration → Runners → Registration Token. + + The file is bind-mounted read-only into the container and consumed + on first start. After registration the runner's actual credentials + are persisted in the container's state dir; the token file can be + deleted or revoked from Forgejo without affecting the running + runner. + ''; + }; + + name = lib.mkOption { + type = lib.types.str; + default = "hive-ci"; + example = "my-hive"; + description = '' + Runner name as shown in the Forgejo admin panel. + Defaults to "hive-ci"; override when multiple hives share a + Forgejo instance to keep them distinct. + ''; + }; + + concurrency = lib.mkOption { + type = lib.types.ints.positive; + default = 1; + example = 4; + description = '' + Maximum number of workflow jobs the runner executes in parallel. + Each job gets its own temporary working directory; multiple parallel + jobs share the container's nix store and cargo registry cache. + Higher values trade memory + CPU headroom for throughput. + ''; + }; + + labels = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ + "hive-ci:host" + "ubuntu-latest:host" + "ubuntu-22.04:host" + ]; + example = [ + "hive-ci:host" + "nix:host" + ]; + description = '' + Runner labels. Each entry has the shape `:`. The + `host` scheme means the runner executes commands directly on the + container (no docker/podman). Workflow files target this runner + with `runs-on: [hive-ci]` (or whichever label the operator picks). + + The `ubuntu-latest` and `ubuntu-22.04` aliases let upstream + workflow files that hardcode GitHub-style runner names work + unchanged — the host runner is a reasonable substitute for + CI steps that only need git + nix + cargo and don't depend on + Ubuntu-specific APT packages. + ''; + }; + + package = lib.mkOption { + type = lib.types.package; + default = pkgs.gitea-actions-runner; + defaultText = lib.literalExpression "pkgs.gitea-actions-runner"; + description = '' + gitea-actions-runner package. Defaults to `pkgs.gitea-actions-runner` + (the nixpkgs release tracking Forgejo's runner releases). + ''; + }; + }; + + config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = forgeCfg.enable; + message = '' + services.hyperhive.ci.enable = true requires + services.hyperhive.forge.enable = true — the runner registers + against the hive-forge Forgejo instance. Either enable the forge + or leave ci.enable at its default of false. + ''; + } + ]; + + containers.hive-ci = { + autoStart = true; + ephemeral = false; + # Shared host netns: runner reaches hive-forge at localhost without + # any port-forwarding dance. Same pattern as hive-forge itself. + privateNetwork = false; + + # Bind the token file read-only into the container at a stable + # internal path the NixOS module option below references. + bindMounts."/run/hive-ci/runner-token" = { + hostPath = toString cfg.runnerTokenFile; + isReadOnly = true; + }; + + config = + { pkgs, lib, ... }: + { + system.stateVersion = "25.11"; + + # nspawn containers can't create user-namespaces, so nix + # sandboxing always fails. Fall back to unsandboxed builds + # rather than erroring out. See docs/gotchas.md. + nix.settings.sandbox-fallback = lib.mkForce true; + + # Flakes + nix-command needed by workflow steps. + nix.settings.experimental-features = [ + "nix-command" + "flakes" + ]; + + services.gitea-actions-runner.instances.hive = { + enable = true; + name = cfg.name; + # Reach hive-forge on loopback — shared netns means this + # is always reachable regardless of firewall / DNS config. + url = "http://127.0.0.1:${toString forgeCfg.httpPort}"; + tokenFile = "/run/hive-ci/runner-token"; + labels = cfg.labels; + settings = { + runner.capacity = cfg.concurrency; + # Generous timeout for nix builds that may be cold-cache. + runner.timeout = "3h"; + }; + package = cfg.package; + }; + + # Tools available to workflow steps. Rust toolchain covers + # cargo test + cargo clippy. nix covers flake check + fmt. + # git is required by the runner and actions/checkout. + environment.systemPackages = [ + pkgs.git + pkgs.nix + pkgs.cargo + pkgs.rustc + pkgs.rustfmt + pkgs.clippy + ]; + }; + }; + }; +} From bf350df4421da33c0d373e598a7f31f9d7032af1 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 31 May 2026 23:29:19 +0200 Subject: [PATCH 2/6] fixup: hive-ci auto-registers runner via forge admin API Removes the manual runnerTokenFile operator step. On first boot the container fetches a runner registration token from Forgejo's admin API using hive-c0re's existing admin token (/var/lib/hyperhive/forge-core-token). A preStart script writes the token to /run/hive-ci/runner-token; on subsequent boots it writes a dummy (registered .runner creds take precedence anyway). Operator bootstrap is now just `services.hyperhive.ci.enable = true`. Co-Authored-By: Claude Sonnet 4.6 --- nix/modules/hive-ci.nix | 154 ++++++++++++++++++++++++---------------- 1 file changed, 94 insertions(+), 60 deletions(-) diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix index 04925031..d62cef83 100644 --- a/nix/modules/hive-ci.nix +++ b/nix/modules/hive-ci.nix @@ -7,6 +7,54 @@ let cfg = config.services.hyperhive.ci; forgeCfg = config.services.hyperhive.forge; + + # hive-c0re writes its own admin token here on first forge startup. + # The token has read:admin + write:admin scopes — sufficient to call + # the runner registration-token API endpoint. + coreTokenPath = "/var/lib/hyperhive/forge-core-token"; + + # Script run before the gitea-runner-hive service starts. + # On first boot (no .runner credentials yet) it fetches a fresh + # runner registration token from the forge admin API and writes it to + # /run/hive-ci/runner-token so gitea-actions-runner can register. + # On subsequent boots the .runner credentials file already exists and + # the runner ignores the token file entirely, so we write a dummy to + # satisfy the file-existence check in the NixOS module. + autoRegisterScript = pkgs.writeShellScript "hive-ci-autoregister" '' + set -euo pipefail + TOKEN_FILE=/run/hive-ci/runner-token + STATE_FILE=/var/lib/gitea-runner/hive/.runner + + mkdir -p /run/hive-ci + chmod 700 /run/hive-ci + + if [ -f "$STATE_FILE" ]; then + # Already registered — dummy token satisfies the module's path check. + echo "already-registered" > "$TOKEN_FILE" + chmod 600 "$TOKEN_FILE" + exit 0 + fi + + CORE_TOKEN=$(cat /run/hive-ci/core-token) + FORGE_URL="http://127.0.0.1:${toString forgeCfg.httpPort}" + + # Retry up to 30s for forge to come up (containers autoStart in parallel). + for i in $(seq 1 30); do + REG_TOKEN=$(${pkgs.curl}/bin/curl -sf \ + "$FORGE_URL/api/v1/admin/runners/registration-token" \ + -H "Authorization: token $CORE_TOKEN" \ + | ${pkgs.jq}/bin/jq -r .token) && break + sleep 1 + done + + if [ -z "''${REG_TOKEN:-}" ] || [ "$REG_TOKEN" = "null" ]; then + echo "hive-ci: failed to fetch runner registration token from forge" >&2 + exit 1 + fi + + echo "$REG_TOKEN" > "$TOKEN_FILE" + chmod 600 "$TOKEN_FILE" + ''; in { # Forgejo Actions runner in a `hive-ci` nixos-container. @@ -16,16 +64,16 @@ in # survive restarts (gitea-actions-runner writes them to its stateDir # on first registration and reuses them on every subsequent start). # + # Auto-registration: on first boot the container fetches a runner + # registration token from the forge's admin API using the core token + # hive-c0re writes to /var/lib/hyperhive/forge-core-token. No manual + # token handling needed — `ci.enable = true` is the full operator + # bootstrap. See docs/ci.md for the registration flow. + # # Nix builds inside the container use the shared /nix/store (standard # nixos-container behaviour) with sandbox-fallback = true, because # nspawn containers can't create the user-namespaces that nix sandboxing # requires. See docs/gotchas.md. - # - # Operator bootstrap: generate a runner registration token in Forgejo - # (Site Administration → Runners → Registration Token), store it in - # a secrets file on the host, and point `runnerTokenFile` at it. - # The token is consumed on first start; the runner's persistent - # credentials live in the container state dir afterwards. options.services.hyperhive.ci = { enable = lib.mkOption { @@ -34,36 +82,22 @@ in example = true; description = '' Run a Forgejo Actions runner in a `hive-ci` nixos-container. - Disabled by default; requires `services.hyperhive.forge.enable = true` - (the runner registers against the hive-forge instance) and a - registration token at `runnerTokenFile`. - ''; - }; + Disabled by default; requires `services.hyperhive.forge.enable = true`. - runnerTokenFile = lib.mkOption { - type = lib.types.path; - example = "/run/secrets/ci-runner-token"; - description = '' - Host path to a file containing the Forgejo runner registration - token (one token per line, no trailing whitespace). Obtain it - from Forgejo: Site Administration → Runners → Registration Token. - - The file is bind-mounted read-only into the container and consumed - on first start. After registration the runner's actual credentials - are persisted in the container's state dir; the token file can be - deleted or revoked from Forgejo without affecting the running - runner. + On first start the container auto-registers against hive-forge using + hive-c0re's admin token — no manual token provisioning needed. + Runner credentials are persisted in the container's state dir and + reused on every subsequent boot. ''; }; name = lib.mkOption { type = lib.types.str; default = "hive-ci"; - example = "my-hive"; + example = "prod-hive"; description = '' - Runner name as shown in the Forgejo admin panel. - Defaults to "hive-ci"; override when multiple hives share a - Forgejo instance to keep them distinct. + Runner name as shown in the Forgejo admin panel. Defaults to + "hive-ci"; override when multiple hives share a Forgejo instance. ''; }; @@ -91,16 +125,13 @@ in "nix:host" ]; description = '' - Runner labels. Each entry has the shape `:`. The - `host` scheme means the runner executes commands directly on the - container (no docker/podman). Workflow files target this runner - with `runs-on: [hive-ci]` (or whichever label the operator picks). + Runner labels in `:` format. The `host` scheme runs + commands directly in the container (no docker/podman). Workflow + files target this runner with `runs-on: [hive-ci]`. - The `ubuntu-latest` and `ubuntu-22.04` aliases let upstream - workflow files that hardcode GitHub-style runner names work - unchanged — the host runner is a reasonable substitute for - CI steps that only need git + nix + cargo and don't depend on - Ubuntu-specific APT packages. + The `ubuntu-latest` and `ubuntu-22.04` aliases let workflow files + that hardcode GitHub-style runner names work unchanged, as long as + those jobs only need git + nix + cargo and not Ubuntu APT packages. ''; }; @@ -108,10 +139,7 @@ in type = lib.types.package; default = pkgs.gitea-actions-runner; defaultText = lib.literalExpression "pkgs.gitea-actions-runner"; - description = '' - gitea-actions-runner package. Defaults to `pkgs.gitea-actions-runner` - (the nixpkgs release tracking Forgejo's runner releases). - ''; + description = "gitea-actions-runner package."; }; }; @@ -122,8 +150,7 @@ in message = '' services.hyperhive.ci.enable = true requires services.hyperhive.forge.enable = true — the runner registers - against the hive-forge Forgejo instance. Either enable the forge - or leave ci.enable at its default of false. + against the hive-forge Forgejo instance. ''; } ]; @@ -131,15 +158,16 @@ in containers.hive-ci = { autoStart = true; ephemeral = false; - # Shared host netns: runner reaches hive-forge at localhost without - # any port-forwarding dance. Same pattern as hive-forge itself. + # Shared host netns: runner reaches hive-forge at localhost. privateNetwork = false; - # Bind the token file read-only into the container at a stable - # internal path the NixOS module option below references. - bindMounts."/run/hive-ci/runner-token" = { - hostPath = toString cfg.runnerTokenFile; - isReadOnly = true; + bindMounts = { + # Core token — used by the auto-register script on first boot. + # Read-only: the container only reads it, never modifies it. + "/run/hive-ci/core-token" = { + hostPath = coreTokenPath; + isReadOnly = true; + }; }; config = @@ -148,11 +176,9 @@ in system.stateVersion = "25.11"; # nspawn containers can't create user-namespaces, so nix - # sandboxing always fails. Fall back to unsandboxed builds - # rather than erroring out. See docs/gotchas.md. + # sandboxing always fails. Fall back to unsandboxed builds. + # See docs/gotchas.md. nix.settings.sandbox-fallback = lib.mkForce true; - - # Flakes + nix-command needed by workflow steps. nix.settings.experimental-features = [ "nix-command" "flakes" @@ -161,22 +187,28 @@ in services.gitea-actions-runner.instances.hive = { enable = true; name = cfg.name; - # Reach hive-forge on loopback — shared netns means this - # is always reachable regardless of firewall / DNS config. url = "http://127.0.0.1:${toString forgeCfg.httpPort}"; + # Token file is written by the ExecStartPre script below. + # On first boot: real registration token fetched from forge API. + # On subsequent boots: dummy value (runner uses .runner creds). tokenFile = "/run/hive-ci/runner-token"; labels = cfg.labels; settings = { runner.capacity = cfg.concurrency; - # Generous timeout for nix builds that may be cold-cache. + # Generous timeout for cold-cache nix builds. runner.timeout = "3h"; }; package = cfg.package; }; - # Tools available to workflow steps. Rust toolchain covers - # cargo test + cargo clippy. nix covers flake check + fmt. - # git is required by the runner and actions/checkout. + # Prepend auto-register script before the runner service starts. + # `+` prefix runs with elevated privileges so it can read the + # bind-mounted core-token (owned by root on the host). + systemd.services."gitea-runner-hive".serviceConfig.ExecStartPre = lib.mkBefore [ + "+${autoRegisterScript}" + ]; + + # Tools available to workflow steps. environment.systemPackages = [ pkgs.git pkgs.nix @@ -184,6 +216,8 @@ in pkgs.rustc pkgs.rustfmt pkgs.clippy + pkgs.curl + pkgs.jq ]; }; }; From 0fa0e821d998419881031a7c955f14ce90416907 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 31 May 2026 23:31:38 +0200 Subject: [PATCH 3/6] fixup: stateVersion 26.05, drop ubuntu labels, simplify CI workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - stateVersion: 25.11 → 26.05 (match hive-gateway + hive-matrix) - default labels: drop ubuntu-latest/ubuntu-22.04 aliases — misleading since this isn't Ubuntu; hive-ci:host is the correct label - ci.yml: collapse to single `nix flake check` job — flake checks.* already covers formatting (treefmt+rustfmt), cargo test, and clippy Co-Authored-By: Claude Sonnet 4.6 --- .forgejo/workflows/ci.yml | 31 ++++--------------------------- nix/modules/hive-ci.nix | 12 ++---------- 2 files changed, 6 insertions(+), 37 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index a6fb111a..b80ab2a0 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -13,30 +13,7 @@ jobs: steps: - uses: actions/checkout@v3 - name: check - run: nix flake check --no-build - - fmt: - name: formatting - runs-on: [hive-ci] - steps: - - uses: actions/checkout@v3 - - name: nix fmt - run: nix fmt -- --check . - - name: cargo fmt - run: cargo fmt --all -- --check - - test: - name: cargo test - runs-on: [hive-ci] - steps: - - uses: actions/checkout@v3 - - name: test - run: cargo test --workspace - - clippy: - name: cargo clippy - runs-on: [hive-ci] - steps: - - uses: actions/checkout@v3 - - name: clippy - run: cargo clippy --workspace -- -D warnings + # Runs all flake checks: formatting (treefmt+rustfmt), cargo test, + # cargo clippy, and module evaluation. No --no-build: the checks + # derivations are the canonical source of truth. + run: nix flake check diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix index d62cef83..e1d788f0 100644 --- a/nix/modules/hive-ci.nix +++ b/nix/modules/hive-ci.nix @@ -115,11 +115,7 @@ in labels = lib.mkOption { type = lib.types.listOf lib.types.str; - default = [ - "hive-ci:host" - "ubuntu-latest:host" - "ubuntu-22.04:host" - ]; + default = [ "hive-ci:host" ]; example = [ "hive-ci:host" "nix:host" @@ -128,10 +124,6 @@ in Runner labels in `:` format. The `host` scheme runs commands directly in the container (no docker/podman). Workflow files target this runner with `runs-on: [hive-ci]`. - - The `ubuntu-latest` and `ubuntu-22.04` aliases let workflow files - that hardcode GitHub-style runner names work unchanged, as long as - those jobs only need git + nix + cargo and not Ubuntu APT packages. ''; }; @@ -173,7 +165,7 @@ in config = { pkgs, lib, ... }: { - system.stateVersion = "25.11"; + system.stateVersion = "26.05"; # nspawn containers can't create user-namespaces, so nix # sandboxing always fails. Fall back to unsandboxed builds. From 61565e3c3a9742fa7889edf2a0d48db8f8af7815 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 31 May 2026 23:33:04 +0200 Subject: [PATCH 4/6] fixup: drop stale docs/ci.md forward-ref in module comment Co-Authored-By: Claude Sonnet 4.6 --- nix/modules/hive-ci.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix index e1d788f0..6dc02848 100644 --- a/nix/modules/hive-ci.nix +++ b/nix/modules/hive-ci.nix @@ -68,7 +68,9 @@ in # registration token from the forge's admin API using the core token # hive-c0re writes to /var/lib/hyperhive/forge-core-token. No manual # token handling needed — `ci.enable = true` is the full operator - # bootstrap. See docs/ci.md for the registration flow. + # bootstrap. Registration flow: preStart calls the Forgejo admin API, + # writes the token to /run/hive-ci/runner-token, runner registers and + # persists credentials to stateDir — token file ignored on next boot. # # Nix builds inside the container use the shared /nix/store (standard # nixos-container behaviour) with sandbox-fallback = true, because From 5f79ff68f0d0bbaccd18c1454f5c5b0f1bc834cd Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 31 May 2026 23:33:38 +0200 Subject: [PATCH 5/6] =?UTF-8?q?fixup:=20ci.yml=20=E2=80=94=20run=20on=20PR?= =?UTF-8?q?=20only,=20not=20every=20branch=20push?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Sonnet 4.6 --- .forgejo/workflows/ci.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index b80ab2a0..9ea39dec 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -1,8 +1,6 @@ name: CI on: - push: - branches: ["**"] pull_request: branches: ["**"] From 45cbf2eded8c7d1e9e6a268b83ca932d9a83860e Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 31 May 2026 23:37:31 +0200 Subject: [PATCH 6/6] fixup: trim systemPackages to git only nix flake check pulls rust tools hermetically. curl/jq in preStart use absolute store paths. nix is part of any NixOS system by default. git is the only package genuinely needed at runtime. Co-Authored-By: Claude Sonnet 4.6 --- nix/modules/hive-ci.nix | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix index 6dc02848..4eeabf04 100644 --- a/nix/modules/hive-ci.nix +++ b/nix/modules/hive-ci.nix @@ -202,17 +202,11 @@ in "+${autoRegisterScript}" ]; - # Tools available to workflow steps. - environment.systemPackages = [ - pkgs.git - pkgs.nix - pkgs.cargo - pkgs.rustc - pkgs.rustfmt - pkgs.clippy - pkgs.curl - pkgs.jq - ]; + # git is required by the runner's checkout step. + # Everything else (nix, rust tools) is either part of NixOS + # by default or pulled in hermetically by nix flake check. + # curl/jq in the autoregister preStart use absolute store paths. + environment.systemPackages = [ pkgs.git ]; }; }; };