feat(auto-update): track temporary pin lifecycle #137
No reviewers
Labels
No labels
area:authentication
area:flake-utilities
area:performance
area:tbd
host:chaos
host:electra
host:fleet
host:lyra
host:nova
host:vega
investigation
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
priority:high
priority:medium
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:auto-update-remediation
project:declarative-purity-cleanup
project:external-review
project:fleet-boundary-cleanup
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:nixos-build-deployment-pipeline
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
project:wiki-rebuild
repo:numtide/flake-utils
repo:numtide/nix-auth
repo:numtide/nixos-passthru-cache
repo:numtide/nix-relay
service:auto-update
service:mem0
service:nix
service:sillytavern
service:slskd
service:synthseek
No milestone
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
nimmo/nixos-config!137
Loading…
Reference in a new issue
No description provided.
Delete branch "issue-131-pin-lifecycle"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Refs #131
Implements controller-owned metadata and reverse-patch lifecycle controls for accepted temporary pins. Scheduled/manual trusted runs retest current nixpkgs in isolated worktrees, deduplicate unchanged failures, comment on recoveries or changed failure modes, and create only review-only removal PRs.
Validation: formatter, ShellCheck, actionlint, auto-update regressions, Nova benchmark, remediation regressions, lifecycle integration/regressions, and
nix flake checkall passed.No deployment, merge, automatic issue closing, or live pin-removal evidence is claimed.
Automated code review
Reviewed commit:
34e410d5baab112f9f8c75e68e406d93d1d2895eVerdict: Ready to merge
No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.
Overall assessment
Implements controller-owned metadata and reverse-patch lifecycle controls for accepted temporary pins. Adds a scheduled/manual pin-lifecycle job that retests unpinned candidates in isolated worktrees, deduplicates unchanged failures, comments on recoveries or changed failure modes, and creates review-only removal PRs using Refs. Updates policy validation, incident bundle generation, and remediation publication to enforce strict bounds, deterministic metadata, and non-closing PR semantics.
Blocking findings
None.
Important findings
None.
Suggestions
Python 3.11+ dependency for datetime.now(UTC) (scripts/nixos-pin-lifecycle.py:26; high confidence)
from datetime import UTC, date, datetime, timedelta
... datetime.now(UTC)
Impact: The script will fail on runners or environments using Python versions older than 3.11, which lack the UTC timezone class.
Suggested fix: Verify the runner's Python version meets 3.11+, or replace datetime.now(UTC) with datetime.utcnow() for broader compatibility.
Strict UTC timestamp regex may reject valid incident formats (scripts/nixos-update-remediation.py:43; medium confidence)
UTC_TIMESTAMP = re.compile(r"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$")
Impact: Incidents containing fractional seconds (e.g., .123Z) or explicit timezone offsets (e.g., +00:00) will fail validation, even if they are otherwise valid ISO 8601 timestamps.
Suggested fix: Relax the regex to allow optional fractional seconds and standard timezone designators, or document that only strict Z-suffixed timestamps without fractions are supported.
Tests and validation
Questions
Review limitations
Diff coverage
.forgejo/workflows/attic-cache.yml: reviewed — included in a context-limited batchREADME.md: reviewed — included in a context-limited batchremediation/nova-policy.json: reviewed — included in a context-limited batchscripts/nixos-pin-lifecycle.py: reviewed — included in a context-limited batchscripts/nixos-update-incident-bundle.sh: reviewed — included in a context-limited batchscripts/nixos-update-remediation.py: reviewed — included in a context-limited batchtests/nixos-pin-lifecycle-integration.py: reviewed — included in a context-limited batchtests/nixos-pin-lifecycle-regressions.sh: reviewed — included in a context-limited batchtests/nixos-update-remediation-integration.py: reviewed — included in a context-limited batchtests/nixos-update-remediation-regressions.sh: reviewed — included in a context-limited batchReview metadata
32006c1b6334e410d5baRebased onto current main
9308e9fand resolved the retained automated-review finding at34e410d.The scope is now explicit in code, documentation, and regression coverage: the controller has no accepted non-pin remediation path. Ineligible or unsafe incidents remain diagnosis-only and never publish a PR; every validated proposal is deliberately a temporary package/source pin with lifecycle metadata. Therefore
temporary_pin_pr_body()uses non-closingRefsfor all PRs this controller can publish, keeping the assigned tracking issue open through recovery, removal review, deployment, and no-op evidence.Fresh validation on the rebased six-host tree passed:
nix flake checkincluding formattinggit diff --checkNo deployment or updater run was forced.