Conversation
ci.yml builds darwinConfigurations.k.system on the free arm64 macOS runner and nebula's NixOS toplevel on ubuntu (disk-reclaim first — gaming profile, nvidia, source-built hyprland). update-flake-lock.yml opens a weekly bump PR with a fine-grained PAT (FLAKE_UPDATE_PAT) since GITHUB_TOKEN-created events never trigger workflows. Load-bearing security property: builds never decrypt sops secrets, so CI's only credential is the read-only okflight deploy key (OKFLIGHT_DEPLOY_KEY, same secret pages.yml uses) — no signing key, no age key, ever. See knowledge/decisions/ci-github-actions.md. Claude-Session: https://claude.ai/code/session_01Si4x5wbNVNuHgh4TyU66D8
… 5xx First runs: darwin-k green in 41m (and it does fetch okf, so ssh-agent is required); nixos-nebula died twice in eval on codeberg.org 503/504 fetching snowglobe-lib — reproduced from a residential IP, a real Codeberg outage. Only the nebula eval forces that input. Add a retried `nix flake archive` step (~10 min backoff) so fetch blips stop killing the build step; if Codeberg flakiness turns chronic, mirror snowglobe-lib to GitHub instead. Claude-Session: https://claude.ai/code/session_01Si4x5wbNVNuHgh4TyU66D8
Swap the darwin job's magic-nix-cache-action (GHA cache, ~10 GiB) for DeterminateSystems/flakehub-cache-action and add it to the nebula job, so every closure CI builds lands in the private FlakeHub cache (paid Determinate account). Auth is the workflow's OIDC JWT via 'id-token: write' — FlakeHub forbids ad-hoc push, so CI is the cache's only writer and no cache secret exists; OKFLIGHT_DEPLOY_KEY stays the sole CI credential. Hosts pull with a one-time 'determinate-nixd login' (done + verified on k; pending on mini, SOC-Kris-Williams, nebula) — Determinate Nix writes the substituter, netrc, and trusted keys itself, no nix config changes.
kriswill
added a commit
that referenced
this pull request
Jul 12, 2026
…wn PR (#35) The CI commits (ci.yml + update-flake-lock.yml + decision record) were carried on this branch but belong in their own PR; they now live on ci-builds (PR #35) with the FlakeHub cache integration on top. The 370592b commit had bundled this branch's codesigning log entry with the CI log entry — restore the codesigning half here. Transient: two dangling-link warnings (nas-mount-codesigning.md and nas-mount.md -> ci-github-actions.md) until this branch merges main after #35 lands.
…able cached-CI workflow okf went public with the okflight rebrand, so the flake input becomes a plain github: fetch (same pinned rev, relocked) and the deploy-key machinery (OKFLIGHT_DEPLOY_KEY, webfactory/ssh-agent, known_hosts) leaves ci.yml, update-flake-lock.yml, and pages.yml. CI now holds zero build credentials; FLAKE_UPDATE_PAT (bump PRs) is the sole repo secret. Retire the OKFLIGHT_DEPLOY_KEY secret and okflight's deploy key after merge. New .github/workflows/nix-build-cache.yml (workflow_call): any kriswill/* repo gets Determinate Nix + FlakeHub-cache CI from a one-job caller that grants id-token: write — the cache is account-scoped, so there is no per-repo registration or secret.
This was referenced Jul 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the CI work out of #32 into its own PR, plus the FlakeHub Cache integration.
What's here
ci.yml(from darwin: auto-mount UNAS Pro 4 via nas.home.lan with a signed, attributed launchd agent #32, unchanged in substance): builds the two deployed closures on every PR / push to main —darwinConfigurations.k.systemon the free arm64 macOS runner,nixosConfigurations.nebulatoplevel on ubuntu behind a disk-reclaim step and a retriednix flake archive(Codeberg 5xx mitigation).update-flake-lock.yml(from darwin: auto-mount UNAS Pro 4 via nas.home.lan with a signed, attributed launchd agent #32): weekly flake.lock bump PR via the fine-grainedFLAKE_UPDATE_PAT.DeterminateSystems/flakehub-cache-action; everything CI builds lands in the private FlakeHub cache (paid Determinate account) and is pulled back on later runs. Replacesmagic-nix-cache-action's ~10 GiB GHA backend on the darwin job. Auth is the workflow's OIDC JWT (permissions: id-token: write) — FlakeHub forbids ad-hoc push, so CI is the cache's only writer and no cache secret exists.OKFLIGHT_DEPLOY_KEY(read-only okflight deploy key) remains CI's sole secret.ci-github-actionsdecision record + log entries; links into the nas-mount codesigning record are plain text until darwin: auto-mount UNAS Pro 4 via nas.home.lan with a signed, attributed launchd agent #32 merges (noted in-file to re-link).Host pull side (no repo changes needed)
determinate-nixd loginonce per machine — Determinate Nix writes the substituter/netrc/trusted keys itself. Done + verified onk; pending onmini,SOC-Kris-Williams,nebula.Note for #32
The CI commits will be dropped from #32 (its
nas-mount-codesigning.md/nas-mount.mdlinks to the CI decision record dangle until it merges main after this lands).