Repository navigation
ci: cache Smoke's Nix runtime packages on main - #7662
Conversation
Quest-Claim: 70923595651a7e0f
Nightly run 40506938673 entered the dev shell in about a minute with nothing compiled. Narrow the quest to the release push, bucket sizes, and Cachix retirement, and note the smoke nix channel's cache gap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Quest-Claim: 40509a86543a98c9
…/ci/nix-cache-verify
Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
|
Design change: Publish the dev shell before runtime builds, then build both runtime packages in one Nix invocation. Cache runtime closures only on x86 Linux, Smoke's only current nix platform; retain dev-shell warming on all three platforms. This avoids unused ARM/macOS package builds and preserves shell publication when a runtime build fails. Existing timeout limits stay until hosted evidence justifies changing them. (Written by GPT-6.1 Sol) |
Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
|
Design change: Reuse the existing Serialize Cache per ref, finish the active publication, and retain only the newest pending run. This bounds overlapping builds while avoiding starvation from canceling a cold dependency build on every merge. GitHub documents this behavior for concurrency without cancel-in-progress. The macOS Smoke comment now calls out the runtime-cache platform gate. (Written by GPT-6.1 Sol) |
Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
|
Design change: Keep the existing three-platform dev-shell matrix unchanged and publish runtime packages in a separate x86 Linux job in Cache. Only the runtime job serializes its active and newest pending runs, so ARM/macOS shells never queue behind Rust builds. Its 75-minute cold-build budget matches the existing Smoke Nix lane; this job does not warm the dev shell too. Dependency artifact publication still happens before the runtime builds. Documentation now names patched (Written by GPT-6.1 Sol) |
Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
kixelated
changed the title
Move the release-tag proof, Cachix retirement, and bucket-size checks to quest/m2/release-nix-cache.md behind the release cut (maintainer, 2026-11-05, #7975), leaving m0 the main-branch runtime evidence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 3 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
kixelated
left a comment
kixelated
left a comment
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed head 82efe9fd6350569eaf81da6d614c16852028c1a3 against base 62ae716265b59681faa82b7f433d91a2f2e5f2e6.
Findings: No actionable defects found in the 12-file diff. There are no earlier published review findings to carry forward.
Direction: The separate x86 Linux runtime job preserves dev-shell independence, serializes publication without canceling active builds, and uploads existing Crane dependency artifacts before both runtime closures. Keeping Smoke read-only and separating post-merge runtime proof from release-cut verification is consistent with the stated scope.
Verification limits: GitHub-only static review of the workflow, recipe, publisher, existing signing/upload helper, flake/Crane definitions, and quest changes. I did not run builds or tests, verify credentials, or observe a hosted upload/substitution. The successful main Cache runtime upload and subsequent Smoke cache hits remain required evidence; current checks do not establish those results.
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
- New
runtimejob in Cache — an independentRuntime (ubuntu-24.04)job gated onrefs/heads/main, with a 75-minute budget, thecache-writeenvironment, and job-levelcache-runtime-<ref>concurrency that finishes the active run and replaces only the pending one. The three-platformwarmmatrix is untouched. sh/gh/cache-runtime.shandjust gh cache-runtime— publishes.#moq-relay.cargoArtifacts/.#moq.cargoArtifactsfirst, then.#moq-relay/.#moq, both tonix-ci-moq-dev; out-links are globbed likesh/gh/cache.sh.- Docs —
flake.nixnow states thatnix.moq.devcaches the default branch's dev shell plusmoq-relay/moqon x86 Linux with the 30-day expiry, and that release tags become permanent only after the cut;smoke.ymlcomments the cold-build dependency and the platform-matrix requirement;infra/README.mddocuments the job, the dependency-artifact ordering, and the serialization. - Quest split —
quest/m0/ci/nix-cache-verify.mdnarrows to themainevidence with a## Waitingitem, and the newquest/m2/release-nix-cache.mdcarries the release-tag proof, bucket sizes, and Cachix retirement, with the m0/m2 index links updated.
Verified the load-bearing mechanics: .#pkg.cargoArtifacts resolves (Crane passes it through mkCargoDerivation/mkDerivation, and builtins.derivation preserves the input attribute set), the multi-installable --out-link glob matches the existing sh/gh/cache.sh pattern, and Crane's deps-only derivation launders the source down to manifests/lock plus the extraDummyScript kio sources, so the artifacts are reusable across source-only commits as infra/README.md claims. shellcheck and the flake/YAML parses are clean. Smoke's actual substitution is deferred to the m0 quest's post-merge evidence by design.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏
Problem
Smoke's Nix channel builds
main'smoq-relayandmoq, but Cache only published the dev shell. Since moq-dev/moq#7431 removed Smoke's Cachix push, neither runtime closure was published for new heads.Approach
Keep the existing three-platform dev-shell matrix (now also carrying
@moq/libavfrommain) unchanged. Add an independent x86 Linux runtime job in Cache, matching Smoke's current Nix platform. Publish the existing Crane dependency artifacts first, then build and publish both runtime closures. Keep all writes incache-write; Smoke remains a reader.Only the runtime job serializes its active and newest pending runs, avoiding duplicate builds without starving cold uploads or delaying dev shells. It uses Smoke's existing 75-minute cold-build budget. Update the cache docs.
Quest split
Decided 2026-11-05 (maintainer, /quest-audit, recorded in moq-dev/moq#7975): ✅ keep in m0 only what can finish on
main, and move the cut-dependent verification to m2 behind/quest/m2/release/cut.md, since the maintainer mergesmainintoreleasewith the next minor cut (decided 2026-11-04), after m1. Not chosen: moving the whole quest; mergingmainintoreleasenow.quest/m0/ci/nix-cache-verify.mdis now[XS] Verify the Nix runtime cache: after this PR merges, record a successful CacheRuntime (ubuntu-24.04)upload and a scheduled or push Smokeubuntu-latest / nixrun substituting both closures. Never dispatch Nightly for it.quest/m2/release-nix-cache.md, requiring the cut: the first tag's Release Nix uploads on all three legs, clean-machinenix runsubstitution, Cachix retirement, and bucket sizes (not before 2026-11-24, Cloudflare access). Same pattern as quest: audit m0 and m1 (2026-11-05) #7975'squest/m2/mbx-r2-release-cache.mdandquest/m2/release-tag-publishers.md; those land with quest: audit m0 and m1 (2026-11-05) #7975, not here.quest/m0/ci/README.md,quest/m0/ci/mbx-r2-verify.md,quest/m0/ci/publish-release-only.md, andquest/m2/README.mdfollow the split.The m0 quest cannot finish inside this PR: its evidence needs the
mainruntime job this PR adds, and Cache only writes frommainthroughcache-write. It clears on the first Cache run after merge plus the next daily (08:00 UTC) Smoke run.Impact
Alternatives
Reuse the existing Cache workflow instead of adding Smoke credentials or another workflow. Separate its runtime job from the dev-shell matrix to keep their scheduling and cold-build budgets independent. The settled scope is the relay and CLI runtime closures. Keep the existing main-push trigger for the settled runtime cache coverage; a nightly-only warm would narrow public HEAD coverage. Limit runtime builds to x86 Linux, the current consumer; retain dev shells on all three platforms. Do not add unused ARM/macOS package builds or a shared dependency-artifact API.
Validation
nix build .#moq-relay .#moqpassed on x86 Linux; both evaluate for x86 Linux, ARM Linux, and ARM macOS.82efe9fd63(main merged):quest gate nix develop --command just ci origin/mainpassed (exit 0).quest check --base origin/main,git diff --check, andshellcheck sh/gh/cache-runtime.sh sh/gh/cache.shpass.sh/gh/cache-runtime.shnow globs its out-links ("$roots"/deps*), matchingmain'ssh/gh/cache.sh.Follow-ups
None beyond the m2 quest above.
Review
Codex,
gpt-6.1-sol, medium effort, reviewed head82efe9fd6350569eaf81da6d614c16852028c1a3againstorigin/main(c0888cfefb), session round 1: no findings.Previous: Claude Code (
claude-opus-5-5, medium) reviewed54deb8cdf8(GPT-6.1 Sol's cache changes) with every finding fixed or refuted.(Written by Claude Opus 5.5)