From c7ab969692cfbcb1a82e0f504baaf26b210e458e Mon Sep 17 00:00:00 2001 From: Sam Date: Sun, 30 Aug 2026 22:40:50 +0900 Subject: [PATCH 1/2] fix(nix): advance the rust-overlay pin to the toolchain's nightly `flake.nix` derives the toolchain from the checked-in pin with `fromRustupToolchainFile ./rust-toolchain.toml`, so the lock's `rust-overlay` revision has to know every nightly that file names. `fe616639d` moved the pin to `nightly-2026-08-28` without touching the lock, leaving `rust-overlay` at a 2026-05-09 revision that predates it. Every flake output then failed to evaluate with `Nightly 2026-08-28 is not available` -- the dev shell `CONTRIBUTING.md` recommends and the `cargo-oxide` package alike. Only the `rust-overlay` node moves. `nixpkgs` and every other input stay at their current revisions, so the shell's CUDA, LLVM, and support packages are unchanged and the fix is confined to the input that went stale. Verified on the updated lock: both `devShells.x86_64-linux.default` and `packages.x86_64-linux.cargo-oxide` evaluate, and `nix develop` reports rustc 1.100.0-nightly (e457a7b0d 2026-08-27) with LLVM 23.1.0 alongside CUDA 13.2.51 -- the toolchain `fe616639d` intended to pin. Signed-off-by: Sam --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index 005271198f..c55a6c4d15 100644 --- a/flake.lock +++ b/flake.lock @@ -64,11 +64,11 @@ ] }, "locked": { - "lastModified": 1778296574, - "narHash": "sha256-DVmg1JCjG0VJTa+FF6tH6tkQChaxzK1EzPL98RiRWU0=", + "lastModified": 1788077403, + "narHash": "sha256-c20YZQKzQ27qC6Wh729fWRTpI7oV4+7Ur4icKssD4Wc=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "1d634a90dffb59ec9ba52652de311b15528c1595", + "rev": "89e26eeaafa88a2ede4778734acc794ff0299beb", "type": "github" }, "original": { From 104658bfbe9dcea13b286370ea2a4b86eaa2794b Mon Sep 17 00:00:00 2001 From: Sam Date: Sun, 30 Aug 2026 22:50:42 +0900 Subject: [PATCH 2/2] ci(flake): evaluate the flake so the lock cannot drift off the pin The preceding commit fixed a lock that had fallen four months behind the nightly `rust-toolchain.toml` names. Nothing would have caught it: no workflow mentions Nix, so no job evaluates the flake. `scripts/check-toolchain-parity.sh` is the closest existing guard, and it is the wrong place for this. It compares copies of the pin's *text* -- the nested pin, the scaffold, the devcontainer, the book's quoted blocks -- while `flake.lock` instead has to be able to *resolve* the pin. The only comparison a text guard could make is the overlay's `lastModified` against the nightly's date, a proxy that passes whenever the dates happen to line up regardless of whether the flake works. Evaluating the flake checks the property that actually broke. It is also cheap: forcing the two output derivations builds no toolchain and takes about a second once the inputs are fetched, so the job's cost is installing Nix and fetching inputs. Both public outputs are covered, because the failure hit the dev shell `CONTRIBUTING.md` recommends and the `cargo-oxide` package alike. `check-flake` mirrors the gate locally but stays out of `check` and `check-guards`, which must keep running for contributors without Nix. The `check-guards` comment records that so the omission reads as a decision rather than the drift that comment exists to prevent. Signed-off-by: Sam --- .github/workflows/flake.yml | 37 +++++++++++++++++++++++++++++++++++++ Justfile | 17 ++++++++++++++--- 2 files changed, 51 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/flake.yml diff --git a/.github/workflows/flake.yml b/.github/workflows/flake.yml new file mode 100644 index 0000000000..7a0b364c6c --- /dev/null +++ b/.github/workflows/flake.yml @@ -0,0 +1,37 @@ +--- +name: flake + +on: + push: + branches: [main] + pull_request: + branches: [main] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref_name }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + # flake.nix derives its toolchain from rust-toolchain.toml, so flake.lock has + # to know every nightly that file names. #1201 moved the pin without moving + # the lock, and every flake output stopped evaluating. The toolchain-pin + # parity guard does not cover this: it compares copies of the pin text, not + # the lock's capacity to resolve it. + evaluation: + name: flake evaluation + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Clone repository + uses: actions/checkout@v4 + + - name: Install Nix + uses: cachix/install-nix-action@v31.11.1 + + - name: Evaluate development shell and cargo-oxide package + run: | + nix eval .#devShells.x86_64-linux.default.drvPath + nix eval .#packages.x86_64-linux.cargo-oxide.drvPath diff --git a/Justfile b/Justfile index 56bf0e17fc..09a06d7a8a 100644 --- a/Justfile +++ b/Justfile @@ -131,6 +131,14 @@ check-intrinsics base_ref="HEAD^": cargo run -p cuda-intrinsics-gen -- probe --all --skip-terminal cargo run -p cuda-intrinsics-gen -- check-abi-history --base-ref {{base_ref}} +# flake.lock has to be able to resolve the pin in rust-toolchain.toml, and +# nothing else checks that. Kept out of `check` and `check-guards` so those +# stay runnable without Nix. +# Evaluate the dev shell and cargo-oxide package against flake.lock (needs Nix) +check-flake: + nix eval .#devShells.x86_64-linux.default.drvPath + nix eval .#packages.x86_64-linux.cargo-oxide.drvPath + # Build docs warning-free + run doctests (mirrors the docs CI gate). The `test` # recipe uses `--all-targets`, which skips doctests, so this covers them. # cuda-bindings is excluded from doctests (its generated C doc comments are not @@ -221,9 +229,12 @@ check-errors: # failed. Keep this list in step when a guard is added to any of the three # workflows -- the crate-inventory and toolchain-parity jobs were added to CI # without being added here, which is the same drift this recipe exists to -# prevent. Prerequisites: `cargo-deny` on PATH (`cargo install cargo-deny -# --locked`) and `python3` (most of the scripts drive it). The scripts are -# invoked via `bash` as CI does, since not all of them carry an exec bit. +# prevent. The flake evaluation gate has its own `check-flake` recipe and is +# deliberately not part of `check-guards`, so contributors without Nix can +# still run this list. Prerequisites: `cargo-deny` on PATH (`cargo install +# cargo-deny --locked`) and `python3` (most of the scripts drive it). The +# scripts are invoked via `bash` as CI does, since not all of them carry an +# exec bit. # Run the status-guard, naming-guard and cargo-deny CI jobs (needs cargo-deny, python3) check-guards: bash scripts/check-error-example-status.sh