nimmo/nixos-config

Watch

Fork 0

High: make flake input inventory and host validation coverage complete #51

New issue

Closed

opened 2026-07-13 07:56:55 +01:00 by nimmo · 3 comments

nimmo commented

2026-07-13 07:56:55 +01:00

Owner

Context

The update policy previously lived as duplicated shell literals and had drifted from flake.nix:

removed input claude-code-nix was still updated even though Nix only warned and exited successfully
active inputs hermes-agent and lanzaboote had no direct policy
Lyra and Electra were omitted from shared foundation validation
the fixed sbomnix package source was silently omitted instead of documented as pinned

Commit a3fb725 replaces that table with a flake-exported, auditable policy and an enforced drift check.

Implementation

lib/auto-update-policy.nix declares eight update groups, consumer hosts, and rationales.
flake.lib.autoUpdatePolicy.rootInputs is generated from the actual root input argument set, avoiding another hand-maintained inventory.
The runner evaluates the actual nixosConfigurations host names.
Validation fails on missing, unknown, or duplicate inputs; unknown or uncovered hosts; malformed groups; and undocumented pinned inputs.
nixpkgs-sbomnix-176 is explicitly pinned with its compatibility rationale.
The required Forgejo regression workflow exercises valid inventory, injected drift failure, explicit policies, shared-host coverage, and the policy-driven group runner.
README documents ownership: any root input addition or removal must update the policy in the same commit.

Completion criteria

No stale input names remain.
Hermes and Lanzaboote have deliberate update policies.
Nixpkgs/shared module changes validate Lena, Vega, Lyra, and Electra where applicable.
CI fails on an unclassified root input.
Intentionally pinned inputs are listed with rationale.

Closure validation

After pushing a3fb725:

Confirm the Auto-Update Regression Tests workflow passes.
Confirm the Attic workflow is triggered by the common policy runner change.
On the next scheduled or forced input-update run, confirm it logs validation of 19 root inputs and 4 hosts before processing groups.
Confirm no claude-code-nix warning appears and the pinned sbomnix rationale is logged.

## Context The update policy previously lived as duplicated shell literals and had drifted from `flake.nix`: - removed input `claude-code-nix` was still updated even though Nix only warned and exited successfully - active inputs `hermes-agent` and `lanzaboote` had no direct policy - Lyra and Electra were omitted from shared foundation validation - the fixed sbomnix package source was silently omitted instead of documented as pinned Commit `a3fb725` replaces that table with a flake-exported, auditable policy and an enforced drift check. ## Implementation - `lib/auto-update-policy.nix` declares eight update groups, consumer hosts, and rationales. - `flake.lib.autoUpdatePolicy.rootInputs` is generated from the actual root input argument set, avoiding another hand-maintained inventory. - The runner evaluates the actual `nixosConfigurations` host names. - Validation fails on missing, unknown, or duplicate inputs; unknown or uncovered hosts; malformed groups; and undocumented pinned inputs. - `nixpkgs-sbomnix-176` is explicitly pinned with its compatibility rationale. - The required Forgejo regression workflow exercises valid inventory, injected drift failure, explicit policies, shared-host coverage, and the policy-driven group runner. - README documents ownership: any root input addition or removal must update the policy in the same commit. ## Completion criteria - [x] No stale input names remain. - [x] Hermes and Lanzaboote have deliberate update policies. - [x] Nixpkgs/shared module changes validate Lena, Vega, Lyra, and Electra where applicable. - [x] CI fails on an unclassified root input. - [x] Intentionally pinned inputs are listed with rationale. ## Closure validation After pushing `a3fb725`: 1. Confirm the Auto-Update Regression Tests workflow passes. 2. Confirm the Attic workflow is triggered by the common policy runner change. 3. On the next scheduled or forced input-update run, confirm it logs validation of 19 root inputs and 4 hosts before processing groups. 4. Confirm no `claude-code-nix` warning appears and the pinned sbomnix rationale is logged.

nimmo added this to the Automated Update Reliability Review milestone

2026-07-13 07:56:55 +01:00

nimmo added the

host:fleet

project:auto-update-reliability

service:auto-update

phase:module

labels

2026-07-13 07:56:55 +01:00

nimmo commented

2026-07-16 14:23:20 +01:00

Author

Owner

Implemented locally as a3fb725 (fix: enforce flake input update policy).

Validation passed:

Nix formatting check
ShellCheck
actionlint
full auto-update regression suite
nix flake check for Electra, Lena, Vega, and Lyra
git diff --check

The commit is not pushed automatically. The ticket remains open for Forgejo workflow and real producer-policy evidence.

Implemented locally as `a3fb725` (`fix: enforce flake input update policy`). Validation passed: - Nix formatting check - ShellCheck - actionlint - full auto-update regression suite - `nix flake check` for Electra, Lena, Vega, and Lyra - `git diff --check` The commit is not pushed automatically. The ticket remains open for Forgejo workflow and real producer-policy evidence.

nimmo commented

2026-07-16 15:41:05 +01:00

Author

Owner

Post-push validation update:

Auto-Update Regression Tests run 315 passed.
Attic cache push-triggered run 314 passed.
Local checkout is clean and matches origin at a3fb725.

The remaining closure evidence is the scheduled input-update run: it must evaluate the 19-input/4-host policy, log the deliberate sbomnix pin, process the declared groups without a stale Claude warning, and complete safely. No further repository changes should be mixed into that candidate before the scheduled run.

Post-push validation update: - Auto-Update Regression Tests run 315 passed. - Attic cache push-triggered run 314 passed. - Local checkout is clean and matches origin at `a3fb725`. The remaining closure evidence is the scheduled input-update run: it must evaluate the 19-input/4-host policy, log the deliberate sbomnix pin, process the declared groups without a stale Claude warning, and complete safely. No further repository changes should be mixed into that candidate before the scheduled run.

nimmo commented

2026-07-16 16:45:03 +01:00

Author

Owner

Final producer validation passed in run 316.

The scheduled job completed successfully and Nova published d0feca790f6a0d0dabd54ff1a4b980965f04c10a (chore: Auto-update flake inputs). Comparing its lock file with parent a3fb725 shows accepted root-input changes for:

hermes-agent
nixpkgs-unstable-small
nur
paseo
trilium-next

and their changed transitive lock nodes.

The accepted Hermes change is direct live proof that the new inventory ran: Hermes was absent from the former hard-coded updater table. The new policy, required regression workflow, drift injection, full host coverage, explicit Lanzaboote policy, documented sbomnix pin, real builds, cache push, commit, and publication have all passed. Closing.

Final producer validation passed in run 316. The scheduled job completed successfully and Nova published `d0feca790f6a0d0dabd54ff1a4b980965f04c10a` (`chore: Auto-update flake inputs`). Comparing its lock file with parent `a3fb725` shows accepted root-input changes for: - `hermes-agent` - `nixpkgs-unstable-small` - `nur` - `paseo` - `trilium-next` and their changed transitive lock nodes. The accepted Hermes change is direct live proof that the new inventory ran: Hermes was absent from the former hard-coded updater table. The new policy, required regression workflow, drift injection, full host coverage, explicit Lanzaboote policy, documented sbomnix pin, real builds, cache push, commit, and publication have all passed. Closing.

nimmo closed this issue

2026-07-16 16:45:08 +01:00

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

nimmo/nixos-config#51

No description provided.

Rows
Columns