ci: Add verify-nix pipeline #27

This revision clears nearly all of the previous feedback: the trigger glob is widened to **/*.nix (which does reach the real derivations under .nix/), commands use the repo's $${VAR} escaping, the step builds .#recurring-events-image right away (no more default-package gap), nix path-info .#recurring-events-image is flakeref-scoped, depends_on with optional: true is fine on this instance's Woodpecker 3.16, and the redundant push trigger was dropped so the pipeline is PR/manual-only — its unique value. The flake.lock bump to my-nix-lib v0.1.2 correctly syncs with the ref = "v0.1.2" already in flake.nix.

The blocker carried over from the prior round remains: cachix authtoken $${CACHIX_AUTH_TOKEN} is the only unguarded cachix command, but Woodpecker does not expose secrets to pull_request events by default. On a PR run the token is empty and this command can fail the step (or silently no-op the caching), while the guarded push means PR builds never populate the cache regardless. Recommend guarding cachix setup+push on token presence (if [ -n "${CACHIX_AUTH_TOKEN:-}" ]) or restricting auth/push to events where the secret is available.

Worth tightening as well: the trailing || echo "⚠️ ... skipped" masks genuine push failures (registry down, revoked token) on manual runs, and without set -o pipefail a failing nix path-info pipes empty stdin into cachix push, which can exit 0 and swallow the real error. And because the repo mixes .yml/.yaml pipeline files, push.yaml/deploy.yaml still only exclude .woodpecker/*.yml — a default-branch push touching only this new config (which its own trigger lists) will spuriously rebuild/push the image and bump the cluster environment.

*🤖 Review by opencode (opencode/deepseek-v4-flash-free) — verdict: changes

# Review Summary This revision clears nearly all of the previous feedback: the trigger glob is widened to `**/*.nix` (which does reach the real derivations under `.nix/`), commands use the repo's `$${VAR}` escaping, the step builds `.#recurring-events-image` right away (no more `default`-package gap), `nix path-info .#recurring-events-image` is flakeref-scoped, `depends_on` with `optional: true` is fine on this instance's Woodpecker 3.16, and the redundant `push` trigger was dropped so the pipeline is PR/manual-only — its unique value. The `flake.lock` bump to `my-nix-lib` v0.1.2 correctly syncs with the `ref = "v0.1.2"` already in `flake.nix`. The blocker carried over from the prior round remains: `cachix authtoken $${CACHIX_AUTH_TOKEN}` is the only unguarded cachix command, but Woodpecker does not expose secrets to `pull_request` events by default. On a PR run the token is empty and this command can fail the step (or silently no-op the caching), while the guarded push means PR builds never populate the cache regardless. Recommend guarding cachix setup+push on token presence (`if [ -n "${CACHIX_AUTH_TOKEN:-}" ]`) or restricting auth/push to events where the secret is available. Worth tightening as well: the trailing `|| echo "⚠️ ... skipped"` masks genuine push failures (registry down, revoked token) on manual runs, and without `set -o pipefail` a failing `nix path-info` pipes empty stdin into `cachix push`, which can exit 0 and swallow the real error. And because the repo mixes `.yml`/`.yaml` pipeline files, `push.yaml`/`deploy.yaml` still only exclude `.woodpecker/*.yml` — a default-branch push touching only this new config (which its own trigger lists) will spuriously rebuild/push the image and bump the cluster environment. --- *🤖 Review by opencode (opencode/deepseek-v4-flash-free) — verdict: **changes**

clank-bot reviewed

2026-08-12 16:41:54 +00:00

clank-bot left a comment

Code review findings from opencode.

Code review findings from opencode.

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +3,4 @@

				  - event: pull_request

				    path:

				      include:

				        - "*.nix"

[bug] `*.nix` only matches Nix files at the repository root (doublestar `*` does not cross `/`). The package derivations live under `.nix/` (`pkgs.nix`, `image.nix`, `openapi-to-rust.nix`), so a change to any of them will not trigger this pipeline — defeating its purpose of catching Nix build failures. Use `**/*.nix` or add `.nix/*.nix` to the include list (both here and in the push block at line 13).

[bug] `*.nix` only matches Nix files at the repository root (doublestar `*` does not cross `/`). The package derivations live under `.nix/` (`pkgs.nix`, `image.nix`, `openapi-to-rust.nix`), so a change to any of them will not trigger this pipeline — defeating its purpose of catching Nix build failures. Use `**/*.nix` or add `.nix/*.nix` to the include list (both here and in the push block at line 13).

martin marked this conversation as resolved

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +15,4 @@

				        - ".woodpecker/verify-nix.yaml"

				depends_on:

				  - name: verify

[style] The `depends_on` entry as an object with `optional: true` was only added in Woodpecker 3.15 (May 2026) — on an older instance this config would be rejected as invalid. The other pipelines in this repo (`push.yaml`, `deploy.yaml`) use the plain string form. Please confirm the Woodpecker version supports this, or keep the existing plain `- verify` form for consistency.

[style] The `depends_on` entry as an object with `optional: true` was only added in Woodpecker 3.15 (May 2026) — on an older instance this config would be rejected as invalid. The other pipelines in this repo (`push.yaml`, `deploy.yaml`) use the plain string form. Please confirm the Woodpecker version supports this, or keep the existing plain `- verify` form for consistency.

It is 3.16

martin marked this conversation as resolved

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +26,4 @@

				        from_secret: cachix_auth_token

				      CACHE_NAME: martials

				    commands:

				      - cachix authtoken $CACHIX_AUTH_TOKEN

[bug] Woodpecker does not expose secrets to `pull_request` events by default (and never to fork PRs). Since this pipeline triggers on `event: pull_request`, `CACHIX_AUTH_TOKEN` will be empty there and `cachix authtoken $CACHIX_AUTH_TOKEN` — the only cachix command without an `||` guard — may fail the whole step (or silently no-op the caching). Guard the cachix setup/push on token presence (e.g. `if [ -n "${CACHIX_AUTH_TOKEN:-}" ]; then ...; fi`) or restrict the auth/push work to push/tag events. Also note: if the secret is enabled for PR events, executing untrusted PR code with the cache write token is a security risk.

[bug] Woodpecker does not expose secrets to `pull_request` events by default (and never to fork PRs). Since this pipeline triggers on `event: pull_request`, `CACHIX_AUTH_TOKEN` will be empty there and `cachix authtoken $CACHIX_AUTH_TOKEN` — the only cachix command without an `||` guard — may fail the whole step (or silently no-op the caching). Guard the cachix setup/push on token presence (e.g. `if [ -n "${CACHIX_AUTH_TOKEN:-}" ]; then ...; fi`) or restrict the auth/push work to push/tag events. Also note: if the secret is enabled for PR events, executing untrusted PR code with the cache write token is a security risk.

[style] Use the repo's established `$${VAR}` escaping and quoting convention for variables referenced in commands (see `push.yaml:47-49` which uses `$${CACHIX_AUTH_TOKEN}`/`$${CACHE_NAME}`). Bare `$VAR` is subject to Woodpecker's own variable interpolation, which can behave unexpectedly (e.g. unparseable variable-name warnings) when a variable isn't resolvable, and unquoted expansion risks word-splitting.

[style] Use the repo's established `$${VAR}` escaping and quoting convention for variables referenced in commands (see `push.yaml:47-49` which uses `$${CACHIX_AUTH_TOKEN}`/`$${CACHE_NAME}`). Bare `$VAR` is subject to Woodpecker's own variable interpolation, which can behave unexpectedly (e.g. unparseable variable-name warnings) when a variable isn't resolvable, and unquoted expansion risks word-splitting.

martin marked this conversation as resolved

martin added 1 commit

2026-08-12 16:49:19 +00:00

Update flake lockfile

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/verify Pipeline was successful

Details

ci/woodpecker/pr/verify-nix Pipeline was successful

Details

28c30d6823

clank-bot reviewed

2026-08-12 16:50:58 +00:00

clank-bot left a comment

Code review findings from opencode.

Code review findings from opencode.

.woodpecker/verify-nix.yaml

[style] The pipeline only builds the `default` package. The `recurring-events-image` derivation (nix2container-based, what `push.yaml` ships to prod) and the repo's treefmt formatting check (`nix flake check`, defined in `flake.nix`) are not verified, so a broken image or formatting derivation would still only be caught in the push pipeline. Consider adding `nix build .#recurring-events-image` and/or `nix flake check` so the pipeline fully verifies what it claims to.

[style] The pipeline only builds the `default` package. The `recurring-events-image` derivation (nix2container-based, what `push.yaml` ships to prod) and the repo's treefmt formatting check (`nix flake check`, defined in `flake.nix`) are not verified, so a broken image or formatting derivation would still only be caught in the push pipeline. Consider adding `nix build .#recurring-events-image` and/or `nix flake check` so the pipeline fully verifies what it claims to.

martin marked this conversation as resolved

.woodpecker/verify-nix.yaml

[performance] `nix path-info` with no arguments enumerates every valid path in the local store, not just the built derivation's closure. In the `cachix-flakes` image the store is usually fresh so this is bounded, but if the runner reuses a warm store this pushes a lot of unrelated paths. Scoping to the build output (`nix path-info -r $(nix build --no-link --print-out-paths)`) is more precise; the current blanket form is acceptable but worth being aware of.

[performance] `nix path-info` with no arguments enumerates every valid path in the local store, not just the built derivation's closure. In the `cachix-flakes` image the store is usually fresh so this is bounded, but if the runner reuses a warm store this pushes a lot of unrelated paths. Scoping to the build output (`nix path-info -r $(nix build --no-link --print-out-paths)`) is more precise; the current blanket form is acceptable but worth being aware of.

martin marked this conversation as resolved

martin added 1 commit

2026-08-12 16:57:40 +00:00

ci: Build image instead of drv

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/verify Pipeline was successful

Details

ci/woodpecker/pr/verify-nix Pipeline failed

Details

8ab1005378

clank-bot reviewed

2026-08-12 17:00:38 +00:00

clank-bot left a comment

Code review findings from opencode.

Code review findings from opencode.

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +6,4 @@

				        - "**/*.nix"

				        - "flake.lock"

				        - ".woodpecker/verify-nix.yaml"

				  - event: push

[performance] On default-branch pushes, `push.yaml` already builds `.#recurring-events-image` under `cachix watch-exec` and pushes its closure to the same `martials` cache (push.yaml:49-50), and it is not excluded for `.nix/*.nix` changes. The `push` trigger here therefore re-runs the same build + cache push on every nix-touching default-branch push — duplicated CI time (and a second full build if it lands on a different runner with a cold store) for no additional coverage. Consider dropping the `push` trigger and keeping this pipeline as PR/manual-only, since that is its unique value.

[performance] On default-branch pushes, `push.yaml` already builds `.#recurring-events-image` under `cachix watch-exec` and pushes its closure to the same `martials` cache (push.yaml:49-50), and it is not excluded for `.nix/*.nix` changes. The `push` trigger here therefore re-runs the same build + cache push on every nix-touching default-branch push — duplicated CI time (and a second full build if it lands on a different runner with a cold store) for no additional coverage. Consider dropping the `push` trigger and keeping this pipeline as PR/manual-only, since that is its unique value.

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +12,4 @@

				      include:

				        - "**/*.nix"

				        - "flake.lock"

				        - ".woodpecker/verify-nix.yaml"

[bug] `push.yaml` and `deploy.yaml` exclude only `.woodpecker/*.yml` (note: `.yml`), but these pipeline files use the `.yaml` extension. A default-branch push touching only `.woodpecker/verify-nix.yaml` (which this pipeline itself lists in its trigger) will therefore also start the `push` and `deploy` pipelines — rebuilding/pushing the image and auto-bumping the cluster deployment for a pure CI-config change. Add a `".woodpecker/*.yaml"` exclusion to `push.yaml` and `deploy.yaml` (ideally in this PR), or the repo's `.yml`/`.yaml` divergence will keep causing spurious deploys.

[bug] `push.yaml` and `deploy.yaml` exclude only `.woodpecker/*.yml` (note: `.yml`), but these pipeline files use the `.yaml` extension. A default-branch push touching only `.woodpecker/verify-nix.yaml` (which this pipeline itself lists in its trigger) will therefore also start the `push` and `deploy` pipelines — rebuilding/pushing the image and auto-bumping the cluster deployment for a pure CI-config change. Add a `".woodpecker/*.yaml"` exclusion to `push.yaml` and `deploy.yaml` (ideally in this PR), or the repo's `.yml`/`.yaml` divergence will keep causing spurious deploys.

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +29,4 @@

				      - cachix authtoken $${CACHIX_AUTH_TOKEN}

				      - cachix use $${CACHE_NAME}

				      - nix build .#recurring-events-image --print-build-logs --no-link

				      - nix path-info .#recurring-events-image | cachix push $${CACHE_NAME} || echo "⚠️ Cachix push skipped, continuing..."

[bug] The `|| echo` guard swallows *all* cachix push errors, not just the missing-token case on PRs. On a push event where the token is set, a real failure (registry down, revoked token, disk full) exits 0 and the pipeline is green while the cache silently stays stale. Additionally, without `set -o pipefail`, a `nix path-info` failure (e.g. flake eval error) makes `cachix push` read empty stdin and exit 0, masking that failure too. Prefer guarding cachix setup/push on token presence (`if [ -n "$CACHIX_AUTH_TOKEN" ]; then ...; fi`) and letting genuine push failures fail the step.

[bug] The `|| echo` guard swallows *all* cachix push errors, not just the missing-token case on PRs. On a push event where the token is set, a real failure (registry down, revoked token, disk full) exits 0 and the pipeline is green while the cache silently stays stale. Additionally, without `set -o pipefail`, a `nix path-info` failure (e.g. flake eval error) makes `cachix push` read empty stdin and exit 0, masking that failure too. Prefer guarding cachix setup/push on token presence (`if [ -n "$CACHIX_AUTH_TOKEN" ]; then ...; fi`) and letting genuine push failures fail the step.

martin added 1 commit

2026-08-12 17:08:59 +00:00

ci: Remove push event on verify-nix

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/verify-nix unknown status

Details

ci/woodpecker/pr/verify Pipeline was canceled

Details

1b5027b56f

clank-bot reviewed

2026-08-12 17:09:43 +00:00

clank-bot left a comment

Code review findings from opencode.

Code review findings from opencode.

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +5,4 @@

				      include:

				        - "**/*.nix"

				        - "flake.lock"

				        - ".woodpecker/verify-nix.yaml"

[style] This trigger lists `.woodpecker/verify-nix.yaml`, but `push.yaml`/`deploy.yaml` only exclude `.woodpecker/*.yml` (the repo mixes `.yml` and `.yaml`). A default-branch push touching only this config file will therefore also start `push` and `deploy`, rebuilding/pushing the image and auto-bumping the cluster env for a pure CI-config change. Add `".woodpecker/*.yaml"` to those pipelines' exclusions, ideally in this PR.

[style] This trigger lists `.woodpecker/verify-nix.yaml`, but `push.yaml`/`deploy.yaml` only exclude `.woodpecker/*.yml` (the repo mixes `.yml` and `.yaml`). A default-branch push touching only this config file will therefore also start `push` and `deploy`, rebuilding/pushing the image and auto-bumping the cluster env for a pure CI-config change. Add `".woodpecker/*.yaml"` to those pipelines' exclusions, ideally in this PR.

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +19,4 @@

				        from_secret: cachix_auth_token

				      CACHE_NAME: martials

				    commands:

				      - cachix authtoken $${CACHIX_AUTH_TOKEN}

[bug] `cachix authtoken $${CACHIX_AUTH_TOKEN}` is the only unguarded cachix command. Woodpecker does not expose secrets to `pull_request` events by default (never for fork PRs), so on a PR run the token is empty and this can fail the step or silently no-op the caching — while the guarded push means PR builds never populate the cache anyway. Guard cachix setup + push on token presence (`if [ -n "${CACHIX_AUTH_TOKEN:-}" ]; then ...; fi`) or move auth/push work to events where the secret is available.

[bug] `cachix authtoken $${CACHIX_AUTH_TOKEN}` is the only unguarded cachix command. Woodpecker does not expose secrets to `pull_request` events by default (never for fork PRs), so on a PR run the token is empty and this can fail the step or silently no-op the caching — while the guarded push means PR builds never populate the cache anyway. Guard cachix setup + push on token presence (`if [ -n "${CACHIX_AUTH_TOKEN:-}" ]; then ...; fi`) or move auth/push work to events where the secret is available.

It is exposed to pull requests

.woodpecker/verify-nix.yaml Outdated

					
				@ -0,0 +22,4 @@

				      - cachix authtoken $${CACHIX_AUTH_TOKEN}

				      - cachix use $${CACHE_NAME}

				      - nix build .#recurring-events-image --print-build-logs --no-link

				      - nix path-info .#recurring-events-image | cachix push $${CACHE_NAME} || echo "⚠️ Cachix push skipped, continuing..."

[bug] The `|| echo "skipped"` swallows every cachix push failure (auth failure, registry down, revoked token) and reports green while the cache silently stays stale. Combined with the pipe and no `set -o pipefail`, a `nix path-info` failure also goes unnoticed if `cachix push` reads empty stdin and exits 0. Prefer guarding cachix commands on token presence and letting genuine push failures fail the step.

[bug] The `|| echo "skipped"` swallows every cachix push failure (auth failure, registry down, revoked token) and reports green while the cache silently stays stale. Combined with the pipe and no `set -o pipefail`, a `nix path-info` failure also goes unnoticed if `cachix push` reads empty stdin and exits 0. Prefer guarding cachix commands on token presence and letting genuine push failures fail the step.

martin force-pushed verify-nix-pipeline from 1b5027b56f

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/verify-nix unknown status

Details

ci/woodpecker/pr/verify Pipeline was canceled

Details

to 1aaf0946ed

ci/woodpecker/pr/pr-review Pipeline failed

Details

ci/woodpecker/pr/verify Pipeline was successful

Details

ci/woodpecker/pr/verify-nix Pipeline was successful

Details

2026-08-16 10:28:17 +00:00

Compare

martin merged commit a105ee3c3b into master

2026-08-16 10:41:25 +00:00

martin deleted branch verify-nix-pipeline

2026-08-16 10:41:26 +00:00

martin referenced this pull request from a commit

2026-08-16 10:41:26 +00:00

ci: Add verify-nix pipeline (#27)

Sign in to join this conversation.

No reviewers

No labels

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

martin/recurring-events!27

Rows
Columns