ci: add CI gate for branch protection (RIG-2213) - #3
Merged
Conversation
Add a `.github/workflows/rigel-ci.yml` whose job is named `CI` so the fork's `main` branch-protection ruleset can pin `["CI"]` as its required status check. The job runs `nix build .#devenv` — the same build command upstream's own `build.yml` runs — on a GitHub-hosted `ubuntu-latest` runner. It pulls the closure from the `devenv.cachix.org` substituter the flake already declares, so it is a real (non-vacuous) gate that can go green here. Why standalone rather than aggregating upstream's `pipeline`: upstream's per-system pipeline runs on `self-hosted` runners this fork does not have, so a `needs:`-aggregator over it would sit `queued` indefinitely and wedge the required-check pin. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
mintaka-rig-2213-devenv-ci
branch
from
August 21, 2026 18:44
0325431 to
c31c69c
Compare
rigel-mintaka
marked this pull request as ready for review
August 21, 2026 19:14
…e) (RIG-2213) Two pre-existing upstream workflows light up red/hung once Actions is enabled on the RigelBuild fork; neither has a monorepo consumer and the fork's real build gate is the standalone rigel-ci.yml `CI` producer (`nix build .#devenv`, GitHub-hosted, the branch-protection pin target): - generate.yml -> .disabled: regenerates docs and auto-commits via EndBug/add-and-commit on push, which 403s (the bot cannot push to a protected fork main) and then reds every PR on the uncommitted-diff check. We consume devenv as a pinned nix flake input, not its generated docs. - pr-test.yml: its `pipeline` matrix runs on upstream Cachix's self-hosted runners (warm nix store + native Apple Silicon) that RigelBuild has no runners for, so every leg sits `queued` forever on the fork. Scope it to the upstream owner (`if: github.repository_owner == 'cachix'`) so it skips cleanly. The richer multi-arch build + cache-push PR gate is deliberately left to RIG-2449; the release path (release.yml / release-test.yml) is untouched for the same reason. Spec-impact: none
rigel-mintaka
force-pushed
the
mintaka-rig-2213-devenv-ci
branch
from
August 22, 2026 01:55
f29ed24 to
c6e634c
Compare
The producer ran `nix build .#devenv` with no binary cache: the flake declares devenv.cachix.org only in `nixConfig.extra-substituters`, which nix ignores non-interactively without `--accept-flake-config`. So on the fork the gate cold-compiled the custom Nix fork (`github:cachix/nix/devenv-2.35`) and nixd from source — a 24-minute build one heavier closure away from exhausting the hosted runner, on the very check `main` will pin. Add `cachix/cachix-action` (pull-only, name `devenv`, no authToken), matching upstream build.yml, so the closure is substituted rather than built. Add a `concurrency` group so superseded pushes cancel instead of running redundant full builds to completion. Spec-impact: none
With the substituter wired the build is fast, but a substituter regression would fall back to a cold rebuild and hang to GitHub's 6h job default on the check `main` pins. Add `timeout-minutes: 20` so a regression surfaces as a fast failure. Spec-impact: none
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a job named
CIto the pull_request-triggered PR Test workflow thatneeds: [pipeline]and echoes success. This produces a check-run literally namedCIfor main branch protection to pin. It goes green iff the real per-system Rust/nix build+test pipeline passes, and deliberately excludes unrelated workflows such as the upstream generate-docs job (which is red on main). Bare passthrough: minimal, single-file addition, no toolchain or structural changes.Co-authored-by: Matt Wilkinson matt@rigel.build