mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-06-11 08:42:11 +00:00
d02a59b679
* fix(nix): fix-lockfiles real-build verification + point auto-fix at nix/lib.nix Two related fixes to the npm lockfile-hash tooling that, together, let a broken nix build slip onto main and stay there: 1. fix-lockfiles trusted prefetch-npm-deps. It computes the hash from the lockfile *contents* and early-exited "ok" whenever that matched the pin, never running the real fetchNpmDeps + npmConfigHook build. Those two can disagree (the --apply path already works around it), so `--check` reported "ok" while a cold build was actually broken (e.g. lockfile engines/os/cpu fields the pinned nixpkgs strips from the deps cache, tripping npmConfigHook's consistency diff). Now, when prefetch says the hash matches, confirm with `nix build .#<attr>` before believing it: adopt the real fetchNpmDeps hash if nix reports a 'got:' mismatch, surface non-hash failures honestly (exit 1) instead of claiming "ok", and keep the transient-cache-failure skip. 2. nix-lockfile-fix.yml's auto-fix-main (and the PR-fix job) whitelisted and staged nix/tui.nix + nix/web.nix, but the single npmDepsHash moved to nix/lib.nix. So fix-lockfiles --apply edited nix/lib.nix, the guard flagged it as an "unexpected modified file", and the job exited without committing — the auto-healer could never push a fix. Point the guard regex and both `git add` lines at nix/lib.nix. * fix(nix): fix cold npm builds — adopt the deps-cache lockfile in patchPhase hermes-tui/hermes-agent could not be built from source on the pinned nixpkgs: prefetch-npm-deps strips advisory lockfile fields (engines/os/cpu/funding/ bin/…) that newer npm writes into package-lock.json, then npmConfigHook byte-compares the source lockfile against the cache's stripped copy and fails on the difference. CI only stayed green because it substitutes the prebuilt hermes-tui from Cachix and never cold-builds it; anyone building cold (e.g. a local path: input, or a cache miss) hit the failure. mkNpmPassthru's patchPhase now copies the cache's own normalized package-lock.json over the source before npmConfigHook runs, so the consistency check is trivially satisfied. The resolved dependency set (version/resolved/integrity/dependencies) is identical — fetchNpmDeps derived the cache from this very lockfile — so `npm ci` installs the same tree; only advisory metadata is dropped. Genuine drift is still caught by the fixed-output npmDepsHash check, which runs before this phase. Verified by cold-building .#tui and .#default (full hermes-agent) from scratch on the pinned nixpkgs (6201e2) — both succeed where they previously failed at npmConfigHook.
255 lines
10 KiB
YAML
255 lines
10 KiB
YAML
name: Nix Lockfile Fix
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'package-lock.json'
|
|
- 'package.json'
|
|
- 'ui-tui/package.json'
|
|
- 'apps/desktop/package.json'
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr_number:
|
|
description: 'PR number to fix (leave empty to run on the selected branch)'
|
|
required: false
|
|
type: string
|
|
issue_comment:
|
|
types: [edited]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: nix-lockfile-fix-${{ github.event.issue.number || github.event.inputs.pr_number || github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
# ── Auto-fix on main ───────────────────────────────────────────────
|
|
# Fires when a push to main touches package.json or package-lock.json.
|
|
# Runs fix-lockfiles and pushes the hash update commit directly to main
|
|
# so Nix builds never stay broken.
|
|
#
|
|
# Safety invariants:
|
|
# 1. The fix commit only touches nix/*.nix files, which are NOT in
|
|
# the paths filter above, so this cannot re-trigger itself.
|
|
# 2. An explicit file-whitelist check before commit aborts if
|
|
# fix-lockfiles ever modifies unexpected files.
|
|
# 3. Job-level concurrency with cancel-in-progress: true ensures
|
|
# back-to-back pushes collapse to the newest; ref: main checkout
|
|
# always operates on the latest branch state.
|
|
# 4. Uses a GitHub App token (not GITHUB_TOKEN) so the fix commit
|
|
# triggers downstream nix.yml verification.
|
|
auto-fix-main:
|
|
if: github.event_name == 'push'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 25
|
|
concurrency:
|
|
group: auto-fix-main
|
|
cancel-in-progress: true
|
|
steps:
|
|
- name: Generate GitHub App token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
|
|
with:
|
|
app-id: ${{ secrets.APP_ID }}
|
|
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: main
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
|
|
- uses: ./.github/actions/nix-setup
|
|
with:
|
|
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
|
|
|
- name: Apply lockfile hashes
|
|
id: apply
|
|
run: nix run .#fix-lockfiles -- --apply
|
|
|
|
- name: Commit & push
|
|
if: steps.apply.outputs.changed == 'true'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# Ensure only nix/lib.nix (home of the single npmDepsHash) was
|
|
# modified — prevents accidental self-triggering if fix-lockfiles
|
|
# ever touches package files.
|
|
unexpected="$(git diff --name-only | grep -Ev '^nix/lib\.nix$' || true)"
|
|
if [ -n "$unexpected" ]; then
|
|
echo "::error::Unexpected modified files: $unexpected"
|
|
exit 1
|
|
fi
|
|
|
|
# Record the base SHA before committing — used to detect package
|
|
# file changes if we need to rebase after a non-fast-forward push.
|
|
BASE_SHA="$(git rev-parse HEAD)"
|
|
|
|
git config user.name 'github-actions[bot]'
|
|
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
|
|
git add nix/lib.nix
|
|
git commit -m "fix(nix): auto-refresh npm lockfile hashes" \
|
|
-m "Source: $GITHUB_SHA" \
|
|
-m "Run: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
|
|
|
|
# Retry push with rebase in case main advanced with an unrelated
|
|
# commit during the nix build. Without this, a non-fast-forward
|
|
# rejection silently loses the fix. If package files changed during
|
|
# the rebase, abort — a fresh auto-fix run will handle the new state.
|
|
for attempt in 1 2 3; do
|
|
if git push origin HEAD:main; then
|
|
exit 0
|
|
fi
|
|
echo "::warning::Push attempt $attempt failed (non-fast-forward?), rebasing…"
|
|
git fetch origin main
|
|
|
|
# If package files changed between our base and the new main,
|
|
# our computed hashes are stale. Abort and let the next triggered
|
|
# run recompute from the correct package-lock state.
|
|
pkg_changed="$(git diff --name-only "$BASE_SHA"..origin/main -- \
|
|
'package-lock.json' 'package.json' \
|
|
'ui-tui/package.json' 'apps/desktop/package.json' || true)"
|
|
if [ -n "$pkg_changed" ]; then
|
|
echo "::warning::Package files changed since hash computation — aborting; a fresh run will recompute"
|
|
exit 0
|
|
fi
|
|
|
|
git rebase origin/main
|
|
done
|
|
echo "::error::Failed to push after 3 rebase attempts"
|
|
exit 1
|
|
|
|
# ── PR fix (manual / checkbox) ─────────────────────────────────────
|
|
# Existing behavior: run on manual dispatch OR when a task-list
|
|
# checkbox in the sticky lockfile-check comment flips from [ ] to [x].
|
|
fix:
|
|
if: |
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(github.event_name == 'issue_comment'
|
|
&& github.event.issue.pull_request != null
|
|
&& contains(github.event.comment.body, '[x] **Apply lockfile fix**')
|
|
&& !contains(github.event.changes.body.from, '[x] **Apply lockfile fix**'))
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 25
|
|
steps:
|
|
- name: Authorize & resolve PR
|
|
id: resolve
|
|
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
|
|
with:
|
|
script: |
|
|
// 1. Verify the actor has write access — applies to both checkbox
|
|
// clicks and manual dispatch.
|
|
const { data: perm } =
|
|
await github.rest.repos.getCollaboratorPermissionLevel({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
username: context.actor,
|
|
});
|
|
if (!['admin', 'write', 'maintain'].includes(perm.permission)) {
|
|
core.setFailed(
|
|
`${context.actor} lacks write access (has: ${perm.permission})`
|
|
);
|
|
return;
|
|
}
|
|
|
|
// 2. Resolve which ref to check out.
|
|
let prNumber = '';
|
|
if (context.eventName === 'issue_comment') {
|
|
prNumber = String(context.payload.issue.number);
|
|
} else if (context.eventName === 'workflow_dispatch') {
|
|
prNumber = context.payload.inputs.pr_number || '';
|
|
}
|
|
|
|
if (!prNumber) {
|
|
core.setOutput('ref', context.ref.replace(/^refs\/heads\//, ''));
|
|
core.setOutput('repo', context.repo.repo);
|
|
core.setOutput('owner', context.repo.owner);
|
|
core.setOutput('pr', '');
|
|
return;
|
|
}
|
|
|
|
const { data: pr } = await github.rest.pulls.get({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: Number(prNumber),
|
|
});
|
|
core.setOutput('ref', pr.head.ref);
|
|
core.setOutput('repo', pr.head.repo.name);
|
|
core.setOutput('owner', pr.head.repo.owner.login);
|
|
core.setOutput('pr', String(pr.number));
|
|
|
|
# Wipe the sticky lockfile-check comment to a "running" state as soon
|
|
# as the job is authorized, so the user sees their click was picked up
|
|
# before the ~minute of nix build work.
|
|
- name: Mark sticky as running
|
|
if: steps.resolve.outputs.pr != ''
|
|
uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
|
|
with:
|
|
header: nix-lockfile-check
|
|
number: ${{ steps.resolve.outputs.pr }}
|
|
message: |
|
|
### 🔄 Applying lockfile fix…
|
|
|
|
Triggered by @${{ github.actor }} — [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
repository: ${{ steps.resolve.outputs.owner }}/${{ steps.resolve.outputs.repo }}
|
|
ref: ${{ steps.resolve.outputs.ref }}
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
fetch-depth: 0
|
|
|
|
- uses: ./.github/actions/nix-setup
|
|
with:
|
|
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
|
|
|
- name: Apply lockfile hashes
|
|
id: apply
|
|
run: nix run .#fix-lockfiles
|
|
|
|
- name: Commit & push
|
|
if: steps.apply.outputs.changed == 'true'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
git config user.name 'github-actions[bot]'
|
|
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
|
|
git add nix/lib.nix
|
|
git commit -m "fix(nix): refresh npm lockfile hashes"
|
|
git push
|
|
|
|
- name: Update sticky (applied)
|
|
if: steps.apply.outputs.changed == 'true' && steps.resolve.outputs.pr != ''
|
|
uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
|
|
with:
|
|
header: nix-lockfile-check
|
|
number: ${{ steps.resolve.outputs.pr }}
|
|
message: |
|
|
### ✅ Lockfile fix applied
|
|
|
|
Pushed a commit refreshing the npm lockfile hashes — [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
|
|
|
|
- name: Update sticky (already current)
|
|
if: steps.apply.outputs.changed == 'false' && steps.resolve.outputs.pr != ''
|
|
uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
|
|
with:
|
|
header: nix-lockfile-check
|
|
number: ${{ steps.resolve.outputs.pr }}
|
|
message: |
|
|
### ✅ Lockfile hashes already current
|
|
|
|
Nothing to commit — [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
|
|
|
|
- name: Update sticky (failed)
|
|
if: failure() && steps.resolve.outputs.pr != ''
|
|
uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
|
|
with:
|
|
header: nix-lockfile-check
|
|
number: ${{ steps.resolve.outputs.pr }}
|
|
message: |
|
|
### ❌ Lockfile fix failed
|
|
|
|
See the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for logs.
|