claude
061d8b266c
Split out of the four repos per weblib-archive#44. All three files were byte-identical across every repo at this moment, which will not stay true -- they converged only because four twin PRs landed within hours today, and report_job_log.py had already drifted once before that. Taken from weblib-archive, verified identical to every other copy first: with-nixpkgs.sh ca43fa20 (cfbypass, archive, fs) report_job_log.py aaef8f62 (cfbypass, archive) sync_blocked_label.py e6ddb21d (all four) action.yml is included so the `uses:` question can be re-measured now the repo is public; it did not work while private. Co-authored-by: bit <bit@das-labor.org>
2.4 KiB
weblib-ci
The CI scripts shared by cfbypass, weblib-archive, weblib-fs and weblib-viewer. Split out per weblib-archive#44, where they had been hand-copied into each repo and had already drifted once.
Public deliberately. Nothing here is a secret or specific to the archive's contents: a nixpkgs-pinning wrapper, a log poster and a label reconciler. Public means a consumer needs no deploy key, no ssh setup and no secret to fetch it — which was measured to be the difference between one step and three.
What is here
| file | what it does |
|---|---|
with-nixpkgs.sh |
Runs a command with one nixpkgs package on PATH, pinned to the consuming repo's flake.lock. Avoids nix shell nixpkgs#x, which re-resolves the registry and refetches a channel tarball whenever the branch moves. |
report_job_log.py |
Posts the tail of a build log as a PR comment. Exists because actions/jobs/{id}/logs returns 500 for every id on Gitea 1.25.2, so a red job otherwise says only that it failed. |
sync_blocked_label.py |
Keeps Status/Blocked in step with Gitea's dependency graph. |
All three are standard library / plain bash only. They are run, not built, so this repo has no flake.
Using it
with-nixpkgs.sh reads the consuming repo's flake.lock relative to the
working directory, so it keeps working from a subdirectory.
- uses: actions/checkout@v4
- name: fetch the shared CI tools
run: git clone --depth 1 https://git.chaosbit.de/weblib/weblib-ci.git .ci
- run: bash .ci/with-nixpkgs.sh python3 python3 .ci/report_job_log.py /tmp/build.log
No credentials: the repo is public, which is the whole point of it being so.
Why not uses:
uses: pointing at a repo on this instance was measured on weblib-archive#44
and did not work, in either the bare weblib/weblib-ci@main form or with a
full URL — while a plain clone with the same access did. action.yml is kept
here so the question can be re-checked cheaply if the instance changes; the
README records the answer so nobody has to re-derive it.
Why not a flake input
These are scripts a workflow runs, not derivations. A flake input would cost a
flake.lock bump in four repos every time one changes, and buys nothing.