hinterland/hearth
2
2
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rework: fix all vulnerabilities
runner nix smoke / nix label and flake smoke (push) Failing after 7s
Details

Browse Source
This commit is contained in:
yukkop
2026-09-08 10:36:38 +00:00
parent 01a0d6e00a
commit 6f80f672f2
17 changed files with 62 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/runner-nix-smoke.yaml
+8 -3
View File
@@ -10,10 +10,15 @@ on:
- flake.lock
- flake.nix
- infra/gitea-runners/**
- lib/**
- legacy/**
- nixos/**
- package/**
- test/**
jobs:
smoke:
name: nix label smoke
name: nix label and flake smoke
runs-on: nix
steps:
- name: Checkout repository
@@ -26,7 +31,7 @@ jobs:
nix config show substituters
nix config show trusted-public-keys
- name: Repository flake metadata
- name: Repository flake evaluation
run: |
set -eu
nix flake metadata --no-write-lock-file
nix --option eval-cache false flake check --no-build --no-write-lock-file
package/db-tool/default.nix
+10 -10
View File
@@ -16,16 +16,16 @@ let
"errexit"
"nounset"
];
excludeShellChecks = [ "SC2209" ];
excludeShellChecks = [ "SC1091" "SC2209" ];
name = "database";
runtimeInputs = [ hectic.migrator hectic.parse-uri postgresql neovim openssh coreutils gawk ];
text = ''
${builtins.readFile hectic.helpers.posix-shell.log}
${builtins.readFile hectic.helpers.posix-shell.change_namespace}
${builtins.readFile hectic.helpers.posix-shell.quote}
${builtins.readFile hectic.helpers.posix-shell.pager_or_cat}
${builtins.readFile hectic.helpers.posix-shell.with_closed_fds}
. ${hectic.helpers.posix-shell.log}/bin/log.sh
. ${hectic.helpers.posix-shell.change_namespace}/bin/change_namespace.sh
. ${hectic.helpers.posix-shell.quote}/bin/quote.sh
. ${hectic.helpers.posix-shell.pager_or_cat}/bin/pager_or_cat.sh
. ${hectic.helpers.posix-shell.with_closed_fds}/bin/with_closed_fds.sh
${applyBundle}
${builtins.readFile ./db-dev.sh}
'';
@@ -44,13 +44,13 @@ let
"errexit"
"nounset"
];
excludeShellChecks = [ "SC2209" ];
excludeShellChecks = [ "SC1091" "SC2209" ];
name = "db-ops";
runtimeInputs = [ postgresql coreutils ];
text = ''
${builtins.readFile hectic.helpers.posix-shell.log}
${builtins.readFile hectic.helpers.posix-shell.change_namespace}
. ${hectic.helpers.posix-shell.log}/bin/log.sh
. ${hectic.helpers.posix-shell.change_namespace}/bin/change_namespace.sh
${applyBundle}
${builtins.readFile ./db-ops.sh}
'';
@@ -70,7 +70,7 @@ let
runtimeInputs = [ postgresql coreutils ];
text = ''
${builtins.readFile hectic.helpers.posix-shell.with_closed_fds}
. ${hectic.helpers.posix-shell.with_closed_fds}/bin/with_closed_fds.sh
${builtins.readFile ./postgres-init.sh}
'';
package/default.nix
+2 -8
View File
@@ -10,15 +10,9 @@
};
};
buildPostgresqlExtension =
pkgs: pkgs.callPackage (import (builtins.path {
name = "extension-builder";
path = ./buildPostgresqlExtension.nix;
}));
pkgs: pkgs.callPackage ./buildPostgresqlExtension.nix;
buildPgrxExtension = pkgs:
pkgs.callPackage (import (builtins.path {
name = "extension-builder";
path = ./buildPgrxExtension.nix;
})) {
pkgs.callPackage ./buildPgrxExtension.nix {
cargo-pgrx = pkgs.cargo-pgrx_0_12_6;
inherit (pkgs.darwin.apple_sdk.frameworks) Security;
};
package/deploy/default.nix
+2 -1
View File
@@ -8,6 +8,7 @@ let
deploy = hectic.writeShellApplication {
inherit shell bashOptions;
excludeShellChecks = [ "SC1091" "SC2034" ];
name = "deploy";
runtimeInputs = [
ssh-to-age
@@ -15,7 +16,7 @@ let
];
text = ''
${builtins.readFile hectic.helpers.posix-shell.log}
. ${hectic.helpers.posix-shell.log}/bin/log.sh
${builtins.readFile ./deploy.sh}
'';
};
package/hemar/parser/default.nix
+2 -1
View File
@@ -8,13 +8,14 @@ let
hemar = hectic.writeShellApplication {
inherit shell bashOptions;
excludeShellChecks = [ "SC1091" ];
name = "hemar";
runtimeInputs = [ yq-go ];
text = ''
# shellcheck disable=SC2034
WORKSPACE=${./.}
${builtins.readFile hectic.helpers.posix-shell.log}
. ${hectic.helpers.posix-shell.log}/bin/log.sh
${builtins.readFile ./hemar.sh}
'';
};
package/hemar/parser/hemar.sh
+6 -6
View File
@@ -299,7 +299,7 @@ parse_tag() {
log trace "tag in ws -> type: \`${TAG_type:-}\`"
case "${TAG_type:-unknown}" in
unknown) finalize_first_arg ;;
for)
'for')
# NOTE:
# grammar: for i in key."subkey" ; so we know
# 1st argument after `for` - string (name of variable)
@@ -427,13 +427,13 @@ finish() {
unknown)
finish_interpolation_tag
;;
done)
'done')
finish_done_tag
;;
'{[')
finish_bracket_tag
;;
for) ;;
'for') ;;
*) log panic 'unexpected TAG_type on finish'; exit 13; ;;
esac
}
@@ -442,14 +442,14 @@ finalize_first_arg() {
log trace "finalize first arg"
log trace "buffer: $(cat "$CURRENT_STAGE_BUFFER")"
case "$(cat "$CURRENT_STAGE_BUFFER")" in
for)
'for')
TAG_type='for'
# NOTE: we know that next argument after `for` is string
TAG_grammar_mode=string
log error 'for unimplemented'
exit 13
;;
done)
'done')
finish_done_tag
;;
'{[')
@@ -651,4 +651,4 @@ if [ -z "${AS_LIBRARY+x}" ]; then
# return the output
# shellcheck disable=SC2086
yq ${OUTPUT_ARGS:-} -o j "$AST"
fi
fi
package/linux-devshell/default.nix
+1 -1
View File
@@ -13,7 +13,7 @@ let
inherit shell bashOptions;
name = "linux-devshell";
runtimeInputs = [ curl coreutils gawk procps ];
excludeShellChecks = [ "SC2034" "SC1090" ];
excludeShellChecks = [ "SC1090" "SC1091" "SC2034" ];
text = ''
${logHelpers}
package/merge-archive/default.nix
+3 -3
View File
@@ -8,13 +8,13 @@ hectic.writeShellApplication {
"errexit"
"nounset"
];
excludeShellChecks = [ "SC2209" ];
excludeShellChecks = [ "SC1091" "SC2209" ];
name = "merge-archive";
runtimeInputs = [ git gnutar gzip bzip2 xz unzip coreutils file ];
text = ''
${builtins.readFile hectic.helpers.posix-shell.log}
${builtins.readFile hectic.helpers.posix-shell.pager_or_cat}
. ${hectic.helpers.posix-shell.log}/bin/log.sh
. ${hectic.helpers.posix-shell.pager_or_cat}/bin/pager_or_cat.sh
${builtins.readFile ./merge-archive.sh}
'';
package/migrator/default.nix
+2 -1
View File
@@ -10,11 +10,12 @@ let
migrator = hectic.writeShellApplication {
inherit shell bashOptions;
excludeShellChecks = [ "SC1091" ];
name = "migrator";
runtimeInputs = [ sqlite postgresql_17 gawk coreutils ];
text = ''
${builtins.readFile hectic.helpers.posix-shell.log}
. ${hectic.helpers.posix-shell.log}/bin/log.sh
${applyBundle}
${builtins.readFile ./migrator.sh}
'';
package/slpt.nix
+8 -5
View File
@@ -1,12 +1,15 @@
{ lib, writeShellScriptBin, fetchFromGitHub, pkgs }: let
{ lib, fetchFromGitHub, runCommand, makeWrapper, jq }: let
src = fetchFromGitHub {
owner = "nativerv";
repo = "slpt";
rev = "8d70db4d8dfcd624ed49b9e6fb0ad449b6f25b89";
hash = "sha256-sCHZsf7Y36iAesh7BeSxy9WhE/uQv13/VWmjlaVSEcU=";
};
in writeShellScriptBin "slpt" ''
#!${pkgs.runtimeShell}
PATH=${lib.makeBinPath [ pkgs.jq ]}:$PATH
${builtins.readFile "${src}/slpt"}
in runCommand "slpt" {
inherit src;
nativeBuildInputs = [ makeWrapper ];
} ''
install -Dm755 "$src/slpt" "$out/bin/slpt"
patchShebangs "$out/bin/slpt"
wrapProgram "$out/bin/slpt" --prefix PATH : "${lib.makeBinPath [ jq ]}"
''
package/windows-devshell/default.nix
+8 -24
View File
@@ -1,26 +1,10 @@
{ pkgs, writeTextFile, lib, linux-devshell-standalone }:
let
psScriptTemplate = builtins.readFile ./windows-devshell.ps1;
# Get the linux-devshell standalone script content and base64 encode it
linuxDevShellBase64 = lib.removeSuffix "\n"
(builtins.readFile
(pkgs.runCommand "base64-linux-devshell" {}
''
${pkgs.coreutils}/bin/base64 -w 0 ${linux-devshell-standalone} > $out
''));
# Standalone PowerShell script (single file for Windows)
windowsDevShellStandalone = writeTextFile {
name = "windows-devshell.ps1";
executable = false;
text = lib.replaceStrings ["@LINUX_DEVSHELL_BASE64@"] [linuxDevShellBase64] psScriptTemplate;
meta = {
description = "Standalone windows-devshell PowerShell script (single file)";
};
};
in
{ pkgs, linux-devshell-standalone }:
{
windows-devshell-standalone = windowsDevShellStandalone;
windows-devshell-standalone = pkgs.runCommand "windows-devshell.ps1" {
meta.description = "Standalone windows-devshell PowerShell script (single file)";
} ''
linux_dev_shell_base64=$(${pkgs.coreutils}/bin/base64 -w 0 ${linux-devshell-standalone})
${pkgs.gnused}/bin/sed "s|@LINUX_DEVSHELL_BASE64@|$linux_dev_shell_base64|g" \
${./windows-devshell.ps1} > "$out"
'';
}
test/package/db-tool/default.nix
+2 -2
View File
@@ -51,7 +51,7 @@
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
buildInputs = [ database dbOps postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash ];
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
test=${testDrv}
export HECTIC_LOG=trace
set -eu
@@ -67,7 +67,7 @@
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
buildInputs = [ database dbOps postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash pkgs.netcat-openbsd ];
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
test=${testDrv}
export HECTIC_LOG=trace
set -eu
test/package/hemar/default.nix
+1 -1
View File
@@ -37,7 +37,7 @@
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
buildInputs = [ hemar pkgs.yq-go pkgs.which ];
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
test=${testDrv}
${builtins.readFile ./lauch.sh}
test/package/linux-devshell/default.nix
+3 -3
View File
@@ -47,7 +47,7 @@
linuxDevShell = linuxDevShell;
linuxDevShellStandalone = linuxDevShellStandalone;
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
export HECTIC_LOG=trace
test=${testDrv}
linuxDevShell="${linuxDevShell}"
@@ -64,7 +64,7 @@
linuxDevShellStandalone = linuxDevShellStandalone;
archBootstrap = archBootstrap;
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
export HECTIC_LOG=trace
log notice "test case: ''${WHITE}arch ${name}"
@@ -156,7 +156,7 @@
linuxDevShellStandalone = linuxDevShellStandalone;
ubuntuBootstrap = ubuntuBootstrap;
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
export HECTIC_LOG=trace
log notice "test case: ''${WHITE}ubuntu ${name}"
test/package/migrator/default.nix
+2 -2
View File
@@ -41,7 +41,7 @@
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
buildInputs = [ pkgs.which migrator pkgs.postgresql ];
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
test=${testDrv}
export HECTIC_LOG=trace
${builtins.readFile ./util.sh}
@@ -57,7 +57,7 @@
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
buildInputs = [ pkgs.which migrator pkgs.sqlite ];
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
test=${testDrv}
export HECTIC_LOG=trace
${builtins.readFile ./util.sh}
test/package/sentinèlla/default.nix
+1 -1
View File
@@ -34,7 +34,7 @@
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
buildInputs = [ sentinella pkgs.curl pkgs.jq pkgs.socat ];
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
export HECTIC_LOG=trace
test=${testDrv}
${builtins.readFile ./launch.sh}
test/package/windows-devshell/default.nix
+1 -1
View File
@@ -9,7 +9,7 @@ let
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep ];
windowsDevShellStandalone = windowsDevShellStandalone;
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
. ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
test=${testDrv}
${builtins.readFile ./launch.sh}
mkdir -p "$out"