mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-05-03 02:11:48 +00:00
9a14540603
* fix(nix): replace magic-nix-cache with Cachix magic-nix-cache caused recurring CI failures (TwirpErrorResponse ResourceExhausted) by hitting GitHub Actions Cache's 10 GB limit and 200 req/min rate limit. This was flagged as 'unfixable infra flake' in #17836 but is actually a fixable architecture choice. Switch to Cachix (dedicated binary cache, no GHA quota dependency): - Replace DeterminateSystems/magic-nix-cache-action with cachix/cachix-action - Add cachix-auth-token input to nix-setup composite action - Pass CACHIX_AUTH_TOKEN secret through all three nix workflows - continue-on-error: true so cache failures never block CI Cache 'hermes-agent' is public at hermes-agent.cachix.org. Devs can pull locally with: cachix use hermes-agent * fix: correct cachix-action commit SHA pin --------- Co-authored-by: Hermes Agent <hermes@nousresearch.com>
76 lines
2.7 KiB
YAML
76 lines
2.7 KiB
YAML
name: Nix Lockfile Check
|
|
|
|
on:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: nix-lockfile-check-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
nix-lockfile-check:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- uses: ./.github/actions/nix-setup
|
|
with:
|
|
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
|
|
|
- name: Resolve head SHA
|
|
id: sha
|
|
shell: bash
|
|
run: |
|
|
FULL="${{ github.event.pull_request.head.sha || github.sha }}"
|
|
echo "full=$FULL" >> "$GITHUB_OUTPUT"
|
|
echo "short=${FULL:0:7}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Check lockfile hashes
|
|
id: check
|
|
continue-on-error: true
|
|
env:
|
|
LINK_SHA: ${{ steps.sha.outputs.full }}
|
|
run: nix run .#fix-lockfiles -- --check
|
|
|
|
- name: Fail if check crashed without reporting
|
|
if: steps.check.outputs.stale != 'true' && steps.check.outputs.stale != 'false'
|
|
run: |
|
|
echo "::error::fix-lockfiles exited without reporting stale status — likely an infrastructure or script failure"
|
|
exit 1
|
|
|
|
- name: Post sticky PR comment (stale)
|
|
if: steps.check.outputs.stale == 'true' && github.event_name == 'pull_request'
|
|
uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
|
|
with:
|
|
header: nix-lockfile-check
|
|
message: |
|
|
### ⚠️ npm lockfile hash out of date
|
|
|
|
Checked against commit [`${{ steps.sha.outputs.short }}`](${{ github.server_url }}/${{ github.repository }}/commit/${{ steps.sha.outputs.full }}) (PR head at check time).
|
|
|
|
The `hash = "sha256-..."` line in these nix files no longer matches the committed `package-lock.json`:
|
|
|
|
${{ steps.check.outputs.report }}
|
|
|
|
#### Apply the fix
|
|
|
|
- [ ] **Apply lockfile fix** — tick to push a commit with the correct hashes to this PR branch
|
|
- Or [run the Nix Lockfile Fix workflow](${{ github.server_url }}/${{ github.repository }}/actions/workflows/nix-lockfile-fix.yml) manually (pass PR `#${{ github.event.pull_request.number }}`)
|
|
- Or locally: `nix run .#fix-lockfiles -- --apply` and commit the diff
|
|
|
|
- name: Clear sticky PR comment (resolved)
|
|
if: steps.check.outputs.stale == 'false' && github.event_name == 'pull_request'
|
|
uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 # v2.9.1
|
|
with:
|
|
header: nix-lockfile-check
|
|
delete: true
|
|
|
|
- name: Fail if stale
|
|
if: steps.check.outputs.stale == 'true'
|
|
run: exit 1
|