ci(nix): use runner nix on self-hosted lanes#243
Conversation
Jesssullivan
force-pushed
the
codex/socket-ci-narrow
branch
from
b953660 to
1749496
Compare
Jesssullivan
changed the title
Greptile SummaryThis PR introduces a shared All findings are P2: the hardcoded Confidence Score: 5/5Safe to merge; all findings are minor style/robustness suggestions with no impact on correctness. No P0 or P1 issues found. The daemon-mode wiring, polling loop, and --store daemon propagation are all logically sound. Remaining comments are low-risk cleanup (EOF delimiter, dead code, duplication). scripts/configure-self-hosted-nix.sh (EOF delimiter in emit_github_env); scripts/run-ssh-proxy-tests.sh (dead resolve_nix_interpreter function). Important Files Changed
Sequence DiagramsequenceDiagram
participant GHA as GitHub Actions Runner
participant CFG as configure-self-hosted-nix.sh
participant NIXD as Nix Daemon (daemon store)
participant WF as Workflow Step (nix --store daemon)
GHA->>CFG: bash scripts/configure-self-hosted-nix.sh
CFG->>NIXD: nix store info --store daemon (probe)
alt Daemon already running
NIXD-->>CFG: OK
CFG->>GHA: export NIX_REMOTE=daemon to GITHUB_ENV
else determinate-nixd available
CFG->>NIXD: nohup determinate-nixd daemon &
loop poll (100 x 0.2 s)
CFG->>NIXD: nix store info --store daemon
NIXD-->>CFG: OK (eventually)
end
CFG->>GHA: export NIX_REMOTE=daemon to GITHUB_ENV
else no daemon
CFG->>GHA: exit 1 + emit_diagnostics
end
CFG->>GHA: export NIX_CONFIG (substituters) to GITHUB_ENV
GHA->>WF: run subsequent steps
WF->>NIXD: nix --store daemon build / develop
NIXD-->>WF: build outputs via shared /nix/store
Reviews (1): Last reviewed commit: "ci(nix): use runner nix on self-hosted l..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| emit_github_env() { | ||
| local key="$1" | ||
| shift | ||
|
|
||
| { | ||
| printf '%s<<EOF\n' "$key" | ||
| printf '%s\n' "$@" | ||
| printf 'EOF\n' | ||
| } >>"$GITHUB_ENV" | ||
| } |
There was a problem hiding this comment.
EOF delimiter may truncate NIX_CONFIG
The GitHub Actions multiline env-file format requires that the chosen delimiter does not appear as a standalone line anywhere in the value. Using the fixed string EOF means any pre-existing NIX_CONFIG that contains a bare EOF line would silently truncate the exported value, causing downstream nix invocations to receive incomplete config with no error. GitHub's own documentation recommends generating a random delimiter (e.g. via $RANDOM or a hash) to eliminate the collision risk entirely.
| resolve_nix_interpreter() { | ||
| if [ -n "${NIX_LD:-}" ] && [ -e "${NIX_LD}" ]; then | ||
| printf '%s\n' "${NIX_LD}" | ||
| return 0 | ||
| fi | ||
|
|
||
| if [ -n "${NIX_CC:-}" ] && [ -r "${NIX_CC}/nix-support/dynamic-linker" ]; then | ||
| head -n 1 "${NIX_CC}/nix-support/dynamic-linker" | ||
| return 0 | ||
| fi | ||
|
|
||
| if command -v cc >/dev/null 2>&1; then | ||
| local cc_path cc_root | ||
| cc_path="$(command -v cc)" | ||
| cc_root="${cc_path%/bin/cc}" | ||
| if [ -r "${cc_root}/nix-support/dynamic-linker" ]; then | ||
| head -n 1 "${cc_root}/nix-support/dynamic-linker" | ||
| return 0 | ||
| fi | ||
| fi | ||
|
|
||
| if compgen -G "/nix/store/*glibc*/lib/ld-linux-x86-64.so.2" >/dev/null; then | ||
| ls /nix/store/*glibc*/lib/ld-linux-x86-64.so.2 2>/dev/null | sort -V | tail -1 | ||
| return 0 | ||
| fi | ||
|
|
||
| return 1 | ||
| } |
There was a problem hiding this comment.
resolve_nix_interpreter is unreachable in this script
On Linux runners, the script exits at line 57 (uname -s != Darwin) before resolve_nix_interpreter is ever called at line 69. On macOS (where execution continues), patchelf is not available, so the call at line 70–73 is a no-op. This makes the function dead code in every actual execution path. The parallel copy in run-socket-tests.sh is live (Linux-only script), but this one can be safely removed — or if patchelf support on macOS is ever intended, that plan should be documented.
| resolve_nix_interpreter() { | ||
| if [ -n "${NIX_LD:-}" ] && [ -e "${NIX_LD}" ]; then | ||
| printf '%s\n' "${NIX_LD}" | ||
| return 0 | ||
| fi | ||
|
|
||
| if [ -n "${NIX_CC:-}" ] && [ -r "${NIX_CC}/nix-support/dynamic-linker" ]; then | ||
| head -n 1 "${NIX_CC}/nix-support/dynamic-linker" | ||
| return 0 | ||
| fi | ||
|
|
||
| if command -v cc >/dev/null 2>&1; then | ||
| local cc_path cc_root | ||
| cc_path="$(command -v cc)" | ||
| cc_root="${cc_path%/bin/cc}" | ||
| if [ -r "${cc_root}/nix-support/dynamic-linker" ]; then | ||
| head -n 1 "${cc_root}/nix-support/dynamic-linker" | ||
| return 0 | ||
| fi | ||
| fi | ||
|
|
||
| if compgen -G "/nix/store/*glibc*/lib/ld-linux-x86-64.so.2" >/dev/null; then | ||
| ls /nix/store/*glibc*/lib/ld-linux-x86-64.so.2 2>/dev/null | sort -V | tail -1 | ||
| return 0 | ||
| fi | ||
|
|
||
| return 1 | ||
| } |
There was a problem hiding this comment.
resolve_nix_interpreter duplicated across both test scripts
The function body is identical in run-socket-tests.sh and run-ssh-proxy-tests.sh. Maintaining two copies means any future fix (e.g. supporting aarch64 interpreter paths) must be applied in both places. Consider extracting it to a shared helper such as scripts/nix-lib.sh and sourcing it from both callers.
1 participant
Summary
Validation
bash -n scripts/configure-self-hosted-nix.sh scripts/run-socket-tests.sh scripts/run-ssh-proxy-tests.shgit diff --checkmainfailure boundary on this fork: run24747790637failed immediately atBuild libghostty (Nix)with/nix/var/nix/db/big-lock: Permission deniedContext
This is the narrowed restack of the larger
codex/socket-ci-truthfulnessbranch. The goal is to land the self-hosted runner contract fix on the real fork base without pulling in unrelated socket/runtime feature work.