nimmo/nixos-config

Watch

Fork 0

Harden Git synchronization and lock publication against concurrent changes #55

New issue

Closed

opened 2026-07-13 07:57:20 +01:00 by nimmo · 1 comment

nimmo commented

2026-07-13 07:57:20 +01:00

Owner

Context

Consumers use git pull origin main without an explicit fast-forward policy. The producer commits after potentially long builds, then runs git pull --rebase immediately before push. A concurrent main update can therefore change the parent/configuration after validation; the rebased lock commit may no longer describe exactly the tree that was built and cached.

The emergency local producer also continues switching after push failure, leaving a local-only lock commit and divergent deployment state.

Scope

Require explicit fast-forward-only consumer pulls and handle local-ahead/diverged states deliberately.
Bind producer validation to the exact base commit and lock content being published.
On concurrent main changes, re-evaluate/rebuild or abort and retry rather than rebase unvalidated results.
Define explicit behaviour for push failure in emergency mode (abort, local-only activation with warning, or retry).
Use atomic/lease-aware push semantics where appropriate.
Ensure an auto-update commit cannot suppress the cache workflow for unrelated concurrent code changes.

Completion criteria

Consumers never create automatic merge commits.
Published lock commits can be traced to a validated base SHA and cached closure set.
Concurrent main updates cause safe retry/abort.
Push-failure behaviour is tested and documented.
No unvalidated combined tree is presented as cache-ready.

## Context Consumers use `git pull origin main` without an explicit fast-forward policy. The producer commits after potentially long builds, then runs `git pull --rebase` immediately before push. A concurrent main update can therefore change the parent/configuration after validation; the rebased lock commit may no longer describe exactly the tree that was built and cached. The emergency local producer also continues switching after push failure, leaving a local-only lock commit and divergent deployment state. ## Scope - Require explicit fast-forward-only consumer pulls and handle local-ahead/diverged states deliberately. - Bind producer validation to the exact base commit and lock content being published. - On concurrent main changes, re-evaluate/rebuild or abort and retry rather than rebase unvalidated results. - Define explicit behaviour for push failure in emergency mode (abort, local-only activation with warning, or retry). - Use atomic/lease-aware push semantics where appropriate. - Ensure an auto-update commit cannot suppress the cache workflow for unrelated concurrent code changes. ## Completion criteria - [ ] Consumers never create automatic merge commits. - [ ] Published lock commits can be traced to a validated base SHA and cached closure set. - [ ] Concurrent main updates cause safe retry/abort. - [ ] Push-failure behaviour is tested and documented. - [ ] No unvalidated combined tree is presented as cache-ready.

nimmo added this to the Automated Update Reliability Review milestone

2026-07-13 07:57:20 +01:00

nimmo added the

host:fleet

project:auto-update-reliability

service:auto-update

phase:deploy

labels

2026-07-13 07:57:20 +01:00

nimmo commented

2026-07-16 22:37:59 +01:00

Author

Owner

Implemented in 9eb45a9 (fix: make flake lock publication race-safe).

Validation evidence:

Auto-Update Regression Tests run #320 passed.
Attic cache build run #319 passed.
Electra's live pull-only updater completed successfully (Result=success, ExecMainStatus=0) and deployed configurationRevision=9eb45a94e63f7f98437be0f02f0a10e0cb9b0fdf.
Hermetic Git tests cover equal/behind/ahead/diverged histories, exact lease arguments, push-failure propagation, and a real bare remote rejecting stale publication without overwriting a concurrent main update.

Consumers now accept only fast-forwards. Producer publication is tied to the validated base SHA, lock hash, and closure-manifest hash; concurrent main changes abort before publication, and the atomic exact lease prevents a race after the final fetch. Emergency publication failure aborts local activation. Closing as complete.

Implemented in `9eb45a9` (`fix: make flake lock publication race-safe`). Validation evidence: - Auto-Update Regression Tests run [#320](https://git.nimmog.uk/nimmo/nixos-config/actions/runs/320) passed. - Attic cache build run [#319](https://git.nimmog.uk/nimmo/nixos-config/actions/runs/319) passed. - Electra's live pull-only updater completed successfully (`Result=success`, `ExecMainStatus=0`) and deployed `configurationRevision=9eb45a94e63f7f98437be0f02f0a10e0cb9b0fdf`. - Hermetic Git tests cover equal/behind/ahead/diverged histories, exact lease arguments, push-failure propagation, and a real bare remote rejecting stale publication without overwriting a concurrent main update. Consumers now accept only fast-forwards. Producer publication is tied to the validated base SHA, lock hash, and closure-manifest hash; concurrent main changes abort before publication, and the atomic exact lease prevents a race after the final fetch. Emergency publication failure aborts local activation. Closing as complete.

nimmo closed this issue

2026-07-16 22:38:04 +01:00

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

nimmo/nixos-config#55

No description provided.

Rows
Columns