vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/swarm-builder
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas f4f459f0b2 move stored_secret from swarm-queue-client to swarm-secret-client 
The module is a rename (97% similar); everything else in the diff follows
from the move:

- stored_secret.rs: private `chain()` helper, the 8-line copy of the queue
  crate's `chain` the module called as `crate::chain`; the queue crate's
  public `chain` stays.
- stored_secret.rs: `Duration::from_mins(5)` in `MAX_REREAD_DELAY` is
  unchanged moved code, not a new use.
- swarm-secret-client Cargo.toml: gains futures-util, tokio and tracing as
  dependencies and tokio `test-util` plus tracing-subscriber as dev
  dependencies; the module and its tests use them.
- swarm-queue-client Cargo.toml: drops futures-util and the tracing-subscriber
  dev dependency, which only the moved module used; its tokio dev comment is
  reworded to the tests that remain.
- Cargo.lock: the same dependency moves, nothing else.
- swarm-queue-client lib.rs: imports `swarm_secret_client::stored_secret`,
  and its tests use a small local `Store` in place of the moved module's
  test-only `Fake`, which is no longer reachable.
- callers (hive-c0re, swarm-builder, swarm-ci-metrics, swarm-claude-login,
  swarm-controller, swarm-nats-auth, swarm-review-classifier): import path
  only; no re-export is left behind.
2026-10-18 09:00:08 +02:00
..
src move stored_secret from swarm-queue-client to swarm-secret-client 2026-10-18 09:00:08 +02:00
Cargo.toml swarm-builder: refuse a build that waited too long for the slot 2026-10-17 23:30:13 +02:00
README.md swarm-builder: list hyperhive-docs among the check flake's inputs in the readme 2026-10-17 13:39:42 +02:00

README.md

swarm-builder

The swarm builder's build service, in the swarm-builder container on the host that sets deploy.builder.enable. The design is docs/swarm/builder.md.

swarm-controller sends one request per config PR head: an agent, a commit and the PR. This service builds that agent config on the agent base this host was deployed with, through the host's nix daemon, and answers with the system closure's store path or the tail of what nix printed. The controller turns the answer into a swarm-builder commit status on the PR's head.

What a build is

  • nix build of nix/builder/check-flake's check output, with its four inputs overridden: hyperhive and nixpkgs to this host's own sources, hyperhive-docs to the docs/ source its hives use (c0re.hyperhiveDocs), and agent to git+https://<forge>/agent-configs/<agent>?ref=refs/pull/<pr>/head&rev=<rev>.
  • The evaluation runs here, pure; the builds run in the host daemon's sandbox as an untrusted client, so a config can neither set daemon options nor read this service's environment.
  • Nothing is pushed and nothing is recorded: the closure stays in the host's store until it is collected.

Credentials

The container holds one credential: its own store certificate, which nspawn hands in at start without a copy on disk. With it the service reads its queue client secret at start and again when authelia refuses it, and its read-only forge token at every build. git gets the token through a credential helper reading the child's environment, never in a URL or an argument, and the helper answers only an https request for the forge's host. Its store role reads exactly those two paths.

Archetypes

The service also answers archetype evaluations: nix eval of the meta of every hyperhiveArchetypes entry in this host's hyperhive source, with nixpkgs pointed at this host's. It fetches nothing and uses no token, and it doesn't wait for a running build. See docs/swarm/archetypes.md.