nimmo/nixos-auto-update
Watch
1
0
Fork
You've already forked nixos-auto-update
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Standalone NixOS flake update, validation, and deployment automation
11 commits 3 branches 0 tags 97 KiB
  • Shell 84.8%
  • Nix 15.2%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Nimmo a32a0ba5a1
All checks were successful
Check / validate (push) Successful in 4s
Details
Merge pull request 'Identify directly failed builders in rejected updates' (#2) from fix/failed-builder-attribution into main 
Reviewed-on: #2
2026-09-09 18:37:16 +01:00
.forgejo/workflows ci: run checks on nova 2026-08-09 21:41:05 +01:00
modules feat: make module secret layout caller-owned 2026-08-09 21:26:20 +01:00
packages/nixos-auto-update legal: adopt EUPL-1.2 2026-09-06 17:13:10 +01:00
schema feat: export rejected update incident protocol 2026-08-13 16:39:50 +01:00
src Attribute rejected updates to directly failed builders 2026-09-09 17:04:38 +01:00
tests Attribute rejected updates to directly failed builders 2026-09-09 17:04:38 +01:00
flake.lock feat: publish standalone auto-update flake 2026-08-09 21:24:27 +01:00
flake.nix feat: export rejected update incident protocol 2026-08-13 16:39:50 +01:00
LICENSE legal: adopt EUPL-1.2 2026-09-06 17:13:10 +01:00
README.md Attribute rejected updates to directly failed builders 2026-09-09 17:04:38 +01:00

README.md

nixos-auto-update

Standalone NixOS flake update, validation, and deployment automation.

Licensed under the EUPL-1.2-or-later. This licence applies to this project's own source, schema, tests, and documentation. Dependencies, including Nixpkgs and the programs packaged into the runtime, remain under their own licences.

This flake exports:

  • packages.x86_64-linux.nixos-auto-update — the nixos-auto-update and nixos-auto-update-control commands.
  • nixosModules.default — the NixOS systemd module.
  • checks.x86_64-linux.auto-update-state-machine — hermetic VM coverage for detached activation, holds, failure state, and convergence.
  • share/nixos-auto-update/nixos-update-incident-bundle.sh — the generic, sourceable schema-v1 rejected-update incident emitter and fingerprint API.
  • share/nixos-auto-update/rejected-update-incident-v1.schema.json — the machine-readable incident bundle contract.
  • bin/nixos-update-incident-verify INCIDENT_JSON — validates the canonical incident fingerprint and bundle-directory identity, then prints the fingerprint.

The module deliberately consumes host policy and secret paths from its caller; it does not own a SOPS layout or any particular NixOS configuration repository. Callers retain ownership of the incident directory, publication workflow, remediation policy, and any issue or pull-request integration.

Producers should request --show-trace for Nix evaluation failures. Diagnostic excerpts reserve one third of the line budget for the last source locations and the rest for the last errors and named attribute/derivation/option contexts. Locations precede diagnostics; selected lines are not necessarily adjacent in the original trace. Generic builtin frames cannot displace all named context. Shared redaction, per-line limits, and the total byte limit still apply, with the final diagnostic retained when the byte limit truncates the excerpt.

Failing derivations come only from explicit Nix builder-failure diagnostics (legacy one-line errors, modern Cannot build / Reason: builder failed blocks, and fixed-output hash mismatches). Build plans, output paths and dependent-failure summaries are excluded. Multiple distinct failed builders remain distinct; unknown diagnostics provide no inferred culprit.