ci: add downstream Nix integration builds - #722
Merged
Merged
Conversation
genebean
force-pushed
the
maintenance/dots-integration-ci
branch
from
September 20, 2026 20:31
d80af43 to
6815df9
Compare
- adopt the shared Renovate preset and schedule lock refreshes after Renovate - build representative NixOS and nix-darwin configurations on pull requests - use the pinned private flake with read-only access and configured caches Co-Authored-By: OpenAI Codex <noreply@openai.com>
genebean
force-pushed
the
maintenance/dots-integration-ci
branch
from
September 20, 2026 20:48
6815df9 to
28f168b
Compare
- remove the Flox flake input and its lock graph - drop Flox from the macOS and NixOS package sets - remove the unused Flox binary cache configuration Co-Authored-By: OpenAI Codex <noreply@openai.com>
Add a dedicated mightymac CI configuration that preserves the real host configuration while disabling its nested Linux builder. Build that target directly against the configured upstream caches because GitHub consistently throttles Magic Nix Cache on the macOS runner. Co-Authored-By: OpenAI Codex <noreply@openai.com>
genebean
force-pushed
the
maintenance/dots-integration-ci
branch
from
September 20, 2026 23:35
4fae66e to
43e0520
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
genebean/.githubRenovate preset and remove the root configuration that was shadowing it.flake.lockrefresh to Friday morning.CI_FLAKE_UPDATESto the shared lock-update workflow so its pull requests can trigger normal CI.nixnuc,hetznix01, and Apple Siliconmightymac.CI design
private-flakerevision fromflake.lock.CI_PRIVATE_FLAKE_READtoken.darwinConfigurations.mightymac-ci, which preserves the real host configuration but disables its nested Linux-builder VM closure for pull-request validation.Scope and security
The builds do not decrypt SOPS secrets, activate Homebrew or MAS, or require Apple credentials. The only new repository credential is narrowly scoped read access to
private-flake.The normal
darwinConfigurations.mightymacoutput remains unchanged and still includes its local Linux builder. Expanded Friday-only coverage for that nested VM,hetznix02,bigboy, and the standalone x86_64 Home Manager configuration is intentionally deferred to a follow-up PR.Verification
The final branch is verified by:
nixnuchetznix01mightymac-cion Apple Silicon