Add shared-store Nix snapshotter CI builder #18

Merged

Mica merged 2 commits from feat/nix-snapshotter-ci into main 2026-10-13 17:52:35 +00:00

Conversation 1 Commits 2 Files changed 8 +176 -12

Mica commented 2026-10-13 16:05:29 +00:00

Collaborator

Copy link

Summary

Repository-owned Nix snapshotter CI image with GNU tar, Bash, Git, Nix and regression-test tools. Host daemon/store mounts remain read-only. Dedicated UID/GID 1774 is untrusted; no daemon trust, secret or webhook changes.

Operator rollout (authorized)

Built image: /nix/store/yiclqp72gdxfmy9q1lfrrz1rdfpm1wlc-nix-image-forgejo-ci.tar
Built T3 verification image: /nix/store/gyfrzn8fzqndfz5p1jhzn393pi1r9k2l-nix-image-t3-code.tar
Published both closures to existing Attic main cache; push reports all done (19 already cached, 201 upstream). All four node system closures built and pushed. Individual non-reboot activation is underway, before merging this reviewed runner-only PR for normal GitOps reconciliation. No T3/OpenCode workload deployment change.

Verification

Prior YAML/shell validation and six T3 Python regression tests passed. Live CI is pending runner reconciliation; previous runs 270-272 failed before workflow execution because the legacy image lacked tar. Final live build outcome will follow the rollout.

## Summary Repository-owned Nix snapshotter CI image with GNU tar, Bash, Git, Nix and regression-test tools. Host daemon/store mounts remain read-only. Dedicated UID/GID 1774 is untrusted; no daemon trust, secret or webhook changes. ## Operator rollout (authorized) Built image: /nix/store/yiclqp72gdxfmy9q1lfrrz1rdfpm1wlc-nix-image-forgejo-ci.tar Built T3 verification image: /nix/store/gyfrzn8fzqndfz5p1jhzn393pi1r9k2l-nix-image-t3-code.tar Published both closures to existing Attic main cache; push reports all done (19 already cached, 201 upstream). All four node system closures built and pushed. Individual non-reboot activation is underway, before merging this reviewed runner-only PR for normal GitOps reconciliation. No T3/OpenCode workload deployment change. ## Verification Prior YAML/shell validation and six T3 Python regression tests passed. Live CI is pending runner reconciliation; previous runs 270-272 failed before workflow execution because the legacy image lacked tar. Final live build outcome will follow the rollout.

Mica added 1 commit 2026-10-13 16:05:29 +00:00

ci: define snapshotter builder with shared host Nix daemon and store a09626756d

Mica added 1 commit 2026-10-13 17:41:26 +00:00

fix(ci): replace tar-less runner with built snapshotter image 61c8212d3c

Mica commented 2026-10-13 17:41:56 +00:00

Author

Collaborator

Copy link

Built the replacement on SammyLaptop (Nix 2.34.8) and pushed commit 61c8212. CI image: /nix/store/yiclqp72gdxfmy9q1lfrrz1rdfpm1wlc-nix-image-forgejo-ci.tar. T3 image: /nix/store/gyfrzn8fzqndfz5p1jhzn393pi1r9k2l-nix-image-t3-code.tar. All 6 runtime regression tests pass using the built T3 Python; replacement tools contain GNU tar 1.35. Runs 270, 271 and new run 272 (UI run 5) fail BEFORE workflow steps: plugin copyin cannot execute tar in the still-live legacy runner image. Updating this PR does not update the deployed runner. Required operator rollout remains: publish/otherwise make the closure available on eligible nodes, deploy the reviewed node configuration, then reconcile the runner HelmRelease. No cache publication, merge or live deployment was performed. CI is not green yet.

Built the replacement on SammyLaptop (Nix 2.34.8) and pushed commit 61c8212. CI image: /nix/store/yiclqp72gdxfmy9q1lfrrz1rdfpm1wlc-nix-image-forgejo-ci.tar. T3 image: /nix/store/gyfrzn8fzqndfz5p1jhzn393pi1r9k2l-nix-image-t3-code.tar. All 6 runtime regression tests pass using the built T3 Python; replacement tools contain GNU tar 1.35. Runs 270, 271 and new run 272 (UI run 5) fail BEFORE workflow steps: plugin copyin cannot execute tar in the still-live legacy runner image. Updating this PR does not update the deployed runner. Required operator rollout remains: publish/otherwise make the closure available on eligible nodes, deploy the reviewed node configuration, then reconcile the runner HelmRelease. No cache publication, merge or live deployment was performed. CI is not green yet.

Mica changed title from WIP: Add shared-store Nix snapshotter CI builder to Add shared-store Nix snapshotter CI builder 2026-10-13 17:51:21 +00:00

Mica merged commit 9222ad773a into main 2026-10-13 17:52:34 +00:00

Mica referenced this pull request from a commit 2026-10-13 17:52:36 +00:00

Add shared-store Nix snapshotter CI builder (#18)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Sammy/Servers!18

No description provided.