ci: push to the niks3 cache at build time through one composite action #477

Merged

natsukium merged 3 commits from ci/niks3-push-action into main 2026-09-26 12:23:57 +09:00

Conversation 0 Commits 3 Files changed 6 +100 -157

natsukium commented 2026-09-26 10:41:53 +09:00

Owner

Copy link

Two commits:

1. One composite action for the niks3 push. The OIDC-token exchange and niks3 push were copied into four jobs and had drifted (readlink -f result in two, nix path-info .#felis in two). .forgejo/actions/niks3-push carries the one copy and resolves the path with nix path-info.
2. Push at build time, not behind the smoke. The derivation is content-addressed, so a revision the cache lacks still builds to the same store path for a user; gating the cache withheld only speed. The push now runs in the job that builds the package: pr.yml linux-smoke and darwin.yml darwin-build on a push to main, and release.yml linux-smoke / darwin-package (renamed from darwin-publish) on a tag, after the identity check. linux-publish and darwin-publish are gone. The release page still waits on every job of the tag's chains (its needs: now names flake-check, build and proto-compat directly, which it previously reached through the publish jobs). Pull requests never push.

Docs: the decision in explanation/testing.md ("The cache is a substituter; the release is the claim", with the rejected per-target publish job and a Revisit if) and the facts in reference/workspace.md follow.

Not exercised by this PR's own CI: pushes happen only on main and tags. The first main run after merge is the check. Conflicts textually with #485 in explanation/testing.md; whichever merges second takes the other's structure.

Two commits: 1. **One composite action for the niks3 push.** The OIDC-token exchange and `niks3 push` were copied into four jobs and had drifted (`readlink -f result` in two, `nix path-info .#felis` in two). `.forgejo/actions/niks3-push` carries the one copy and resolves the path with `nix path-info`. 2. **Push at build time, not behind the smoke.** The derivation is content-addressed, so a revision the cache lacks still builds to the same store path for a user; gating the cache withheld only speed. The push now runs in the job that builds the package: `pr.yml` `linux-smoke` and `darwin.yml` `darwin-build` on a push to `main`, and `release.yml` `linux-smoke` / `darwin-package` (renamed from `darwin-publish`) on a tag, after the identity check. `linux-publish` and `darwin-publish` are gone. The release page still waits on every job of the tag's chains (its `needs:` now names flake-check, build and proto-compat directly, which it previously reached through the publish jobs). Pull requests never push. Docs: the decision in `explanation/testing.md` ("The cache is a substituter; the release is the claim", with the rejected per-target publish job and a _Revisit if_) and the facts in `reference/workspace.md` follow. Not exercised by this PR's own CI: pushes happen only on `main` and tags. The first `main` run after merge is the check. Conflicts textually with #485 in `explanation/testing.md`; whichever merges second takes the other's structure.

natsukium added 1 commit 2026-09-26 10:41:53 +09:00

ci: push to the niks3 cache through one composite action ... c9e4d0fb9f

The OIDC-token script and niks3 push were copied into four jobs
(pr.yml, darwin.yml, and both publish jobs in release.yml), and the
copies had already drifted: two resolved the store path with
`readlink -f result`, two with `nix path-info .#felis`. The action takes
the path from `nix path-info`, which works on both runners without
depending on the `result` symlink, so a fix to the token exchange now
lands once.

Assisted-by: Claude Code

natsukium scheduled this pull request to auto merge when all checks succeed 2026-09-26 10:53:50 +09:00

natsukium canceled auto merging this pull request when all checks succeed 2026-09-26 11:15:55 +09:00

natsukium added 2 commits 2026-09-26 11:17:49 +09:00

Merge remote-tracking branch 'origin/main' into ci/niks3-push-action 6bed31b9c3

ci: push to the niks3 cache as the package builds, not behind the smoke ... d15e8afa43

The cache push waited in its own job (linux-publish, darwin-publish)
until that revision's suite and smoke passed, on the argument that a
cached path is a claim someone installs. It is not: the derivation is
content-addressed, so a revision the cache lacks still builds to the
same store path on a user's machine, and holding the push back withheld
only speed. What a user installs on the project's word is the release,
and release.yml's page still waits on every job of the tag's chains.

The push now runs in the job that builds the package (pr.yml's
linux-smoke and darwin.yml's darwin-build on a push to main, and
release.yml's linux-smoke and the renamed darwin-package on a tag, each
after the identity check). That drops two jobs and a second `nix build`
evaluation per main revision from the runners, and lets the release's
darwin chain start without waiting on the Linux gates. Pull requests
still never push.

Assisted-by: Claude Code

natsukium changed title from ci: push to the niks3 cache through one composite action to ci: push to the niks3 cache at build time through one composite action 2026-09-26 11:18:01 +09:00

natsukium scheduled this pull request to auto merge when all checks succeed 2026-09-26 11:28:56 +09:00

natsukium referenced this pull request 2026-09-26 11:36:38 +09:00

docs: give each decision in the dense pages its own section #485

natsukium merged commit f7973e6d4a into main 2026-09-26 12:23:57 +09:00

natsukium deleted branch ci/niks3-push-action 2026-09-26 12:23:57 +09:00

natsukium referenced this pull request from a commit 2026-09-26 12:23:57 +09:00

ci: push to the niks3 cache at build time through one composite action (#477)

natsukium referenced this pull request from a commit 2026-09-26 12:49:28 +09:00

docs: give each decision in the dense pages its own section (#485)

natsukium referenced this pull request 2026-09-26 13:49:30 +09:00

ci: republish each Forgejo release on the GitHub mirror #487

natsukium referenced this pull request from a commit 2026-09-26 15:10:33 +09:00

ci: republish each Forgejo release on the GitHub mirror (#487)

Commenting is not possible because the repository is archived.

Reviewers

No reviewers

Labels

Clear labels   

priority/P0

Must be resolved before the v0.1.0 tag

  

priority/P1

Must be settled before the first public contract freezes

  

priority/P2

Explicitly deferred until after v0.1.0

  

release/v0.1.0

Work tracked for the first tagged release

  

status/blocked

Cannot start now: waits on an upstream release, another issue, or a recorded revisit trigger

  

status/planned

Triaged with a source-grounded plan and a passed pi review; ready to implement

  

type/bug

Shipped behavior that contradicts the docs or the code's own intent; needs a product code change

  

type/design

An open scope or trade-off question; needs a recorded decision in the owning explanation doc before code

  

type/test-gap

Documented or reviewed behavior that no test pins; usually split from a review finding, needs no product code change

  

type/tracker

Parent issue that tracks child work

No labels

priority/P0

priority/P1

priority/P2

release/v0.1.0

status/blocked

status/planned

type/bug

type/design

type/test-gap

type/tracker

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

natsukium/felis!477

No description provided.