b68b74d687
A new `swarm-builder` service, in its own container on the host that sets
`deploy.builder.enable` (defaulted on by `allSwarmServices` where the host
has the builder's store leaf, like the review classifier).
When an `agent-configs/<agent>` PR is opened, reopened or synchronized,
swarm-controller queues a `build_agent` jobq node. The node sets a
`swarm-builder` commit status to pending on the PR head, sends
`{agent, rev, pr}` to the builder over NATS request-reply
(`$SWARM.builder.build`), and writes success (store path), failure (last
line nix printed) or error (no builder / no reply) on the head. The node
fails when the build does, so the Jobs page matches the PR.
The builder builds nix/builder/check-flake's `check` with every input
overridden: hyperhive and nixpkgs to the host's own
`c0re.hyperhiveFlake`/`c0re.nixpkgsFlake` (what a hive there renders into
its meta flake), and the agent to the PR head on the forge. Evaluation is
pure and runs in the container; builds go to the host nix daemon as an
untrusted client. The private config repo is fetched with the token of a
new read-only `builder` forge account (in the `hives` team), which the
controller mints into `swarm/services/builder/forge/token`; git gets it
from a credential helper reading the child's environment, so it is in no
argument or URL.
Credentials: a `builder` store leaf minted by glue-bao-tls on the store
host, a `swarm-builder` reader policy (forge token + its own OIDC client
secret), an authelia machine client, and a `--builder-client` grant in the
queue's auth-callout responder. The controller gains a grant on the token
path and the secret publisher a deny on it.
This is the agent-config build check atlas scoped on #5081 (slice 3):
nothing is pushed to a cache, nothing is written to KV, and a red status
gates no deploy. The check composes agent-base + the config without the
values a hive adds (CA, docs, claude-code path, ports, input follows), so
it can disagree with a hive's own build.
75 lines
2.6 KiB
Rust
75 lines
2.6 KiB
Rust
//! The swarm builder's builds: the subject swarm-controller sends a build on,
|
|
//! and what travels each way.
|
|
//!
|
|
//! Three crates name these: the controller sends the request, the builder
|
|
//! answers it, and the auth-callout responder grants the one subject to each.
|
|
|
|
use std::time::Duration;
|
|
|
|
use serde::{Deserialize, Serialize};
|
|
|
|
/// The subject every build goes to. The controller is its one publisher and
|
|
/// the builder its one subscriber; the builder answers on the request's reply
|
|
/// subject.
|
|
pub const SUBJECT: &str = "$SWARM.builder.build";
|
|
|
|
/// The queue group the builder subscribes in, so a second instance shares the
|
|
/// requests instead of running each one twice.
|
|
pub const QUEUE_GROUP: &str = "builder";
|
|
|
|
/// The longest one build may take before the builder stops it and answers
|
|
/// with a timeout.
|
|
pub const BUILD_DEADLINE: Duration = Duration::from_hours(1);
|
|
|
|
/// How long the controller waits for the reply, and the queue lets the
|
|
/// builder answer: the build at its deadline, plus a minute for the rest.
|
|
pub const REPLY_DEADLINE: Duration = Duration::from_mins(61);
|
|
|
|
/// One build: an agent's config repo at one commit, on the builder's own
|
|
/// agent base.
|
|
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
|
|
pub struct BuildAgent {
|
|
/// The agent, which is also its config repo's name.
|
|
pub agent: String,
|
|
/// The commit to build.
|
|
pub rev: String,
|
|
/// The PR the commit is the head of; its `refs/pull/<pr>/head` is the ref
|
|
/// the builder fetches the commit through.
|
|
pub pr: u64,
|
|
}
|
|
|
|
/// The builder's answer to one [`BuildAgent`].
|
|
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
|
|
#[serde(tag = "state", rename_all = "kebab-case")]
|
|
pub enum Reply {
|
|
/// The config built; `out_path` is the system closure's store path.
|
|
Built { out_path: String },
|
|
/// The build did not finish: the last lines `nix` printed, or why the
|
|
/// builder could not start it.
|
|
Failed { error_tail: String },
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn the_wire_tags_the_reply_by_state() {
|
|
let json = serde_json::to_value(Reply::Built {
|
|
out_path: "/nix/store/x".to_owned(),
|
|
})
|
|
.expect("encodes");
|
|
assert_eq!(json["state"], "built");
|
|
assert_eq!(json["out_path"], "/nix/store/x");
|
|
let json = serde_json::to_value(Reply::Failed {
|
|
error_tail: "e".to_owned(),
|
|
})
|
|
.expect("encodes");
|
|
assert_eq!(json["state"], "failed");
|
|
}
|
|
|
|
#[test]
|
|
fn the_reply_deadline_outlasts_the_build() {
|
|
assert!(REPLY_DEADLINE > BUILD_DEADLINE);
|
|
}
|
|
}
|