docs(planning): fix plan annotation pointer to the final session report #2050
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nix flake check | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| branches: [master] | |
| jobs: | |
| nix-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # v16 | |
| with: | |
| extra-conf: | | |
| experimental-features = nix-command flakes pipe-operators | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Validate flake structure | |
| run: nix flake show --allow-import-from-derivation 2>&1 | head -20 | |
| - name: Run statix linter | |
| run: nix run nixpkgs#statix -- check . | |
| - name: Run deadnix linter | |
| run: nix run nixpkgs#deadnix -- --fail --no-lambda-pattern-names . | |
| - name: Check Nix formatting | |
| run: nix fmt -- --ci | |
| - name: Evaluate flake (no build) | |
| run: nix flake check --no-build | |
| - name: Check for unregistered port numbers | |
| run: | | |
| # Catches port assignments in modules that bypass lib/ports.nix. | |
| # The eval-time assertion in lib/default.nix catches duplicates WITHIN | |
| # ports.nix. This check catches raw numbers used outside the registry. | |
| # Only match bare numeric assignments (= NNNN) or proxy-style :NNNN at | |
| # end of string — avoids connection URIs, memory sizes, time values. | |
| UNREGISTERED=$( | |
| grep -rnE '(=|:)[[:space:]]*[0-9]{4,5}([^0-9MiB]|$)' --include="*.nix" modules/ 2>/dev/null | | |
| grep -vE 'ports\.|^\s*#|Timeout|Burst|Interval|Nice|Quota|Memory|Limit|Watchdog|Signal|UMask|Delay|Retry|Second|OnUnit|OnBoot|fallocate|offset|subvolid|Year|Month|threshold|priority|version|uid|gid|capacity|window|slim|tty|vtnr|code|exit|status|color|port_range|GOMEMLIMIT|BLOB_MAX|max-old-space|min-size|avg-size|bantime|Duration|default|stateVersion' || | |
| true | |
| ) | |
| # Filter out well-known ports inside Docker connection strings and | |
| # container port mappings (not configurable via lib/ports.nix) | |
| FILTERED=$(echo "$UNREGISTERED" | grep -vE '(postgres|redis|mongodb)://|containerPort|NODE_PORT|127\.0\.0\.1.*:|localhost.*:|max_old_space|postgresql://' || true) | |
| if [ -n "$FILTERED" ]; then | |
| echo "::warning::Potential unregistered port numbers found (review and move to lib/ports.nix if applicable):" | |
| echo "$FILTERED" | head -20 | |
| else | |
| echo "No unregistered port numbers detected" | |
| fi | |
| - name: Check templ generated files are committed | |
| run: scripts/check-templ-committed.sh | |
| - name: Flake input hygiene (ref=master + GOTOOLCHAIN) | |
| run: | | |
| # Fail on GOTOOLCHAIN=auto (sandbox purity violation) | |
| if grep -rnE 'GOTOOLCHAIN.*auto' --include="*.nix" . 2>/dev/null | grep -v 'GOTOOLCHAIN.*off' | grep -q .; then | |
| echo "::error::GOTOOLCHAIN=auto found — breaks Nix sandbox purity" | |
| grep -rnE 'GOTOOLCHAIN.*auto' --include="*.nix" . 2>/dev/null | grep -v 'GOTOOLCHAIN.*off' | |
| exit 1 | |
| fi | |
| # Warn on ref=master (reproducibility risk) | |
| MASTER_COUNT=$(grep -c 'ref\s*=\s*"master"' flake.nix 2>/dev/null || echo "0") | |
| if [ "$MASTER_COUNT" -gt 0 ]; then | |
| echo "::warning::$MASTER_COUNT flake inputs use ref=master — consider pinning" | |
| fi | |
| vm-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Enable KVM for VM tests | |
| run: | | |
| echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules | |
| sudo udevadm control --reload-rules | |
| sudo udevadm trigger --name-match=kvm | |
| - uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # v16 | |
| with: | |
| extra-conf: | | |
| experimental-features = nix-command flakes pipe-operators | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Run NixOS VM tests | |
| run: | | |
| nix build .#checks.x86_64-linux.boot --no-link --print-out-paths | |
| nix build .#checks.x86_64-linux.attic --no-link --print-out-paths | |
| nix build .#checks.x86_64-linux.searxng --no-link --print-out-paths | |
| nix build .#checks.x86_64-linux.browser-history --no-link --print-out-paths | |
| shellcheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # v16 | |
| with: | |
| extra-conf: | | |
| experimental-features = nix-command flakes pipe-operators | |
| - name: Run shellcheck on scripts | |
| run: nix shell nixpkgs#shellcheck --command shellcheck --severity=error scripts/*.sh .githooks/* |