@smoothbricks/cli 0.11.10 → 0.11.11

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -31,20 +31,16 @@ add_repo_paths() {
 # `--accept-flake-config` makes it worse than untidy: it pre-trusts the
 # substituters declared by a commit nobody looked at.
 #
-# Resolved lazily, on the install path only: a runner that already has devenv
-# never needs the rev, and that is the one branch which pays for a `nix eval`.
-devenv_flake() {
-  if [ -n "${DEVENV_FLAKE:-}" ]; then
-    printf '%s' "$DEVENV_FLAKE"
-    return 0
-  fi
+# Resolved lazily, on the paths that need it, because a host runner never does
+# and that is the one branch which must not pay for a `nix eval`.
+devenv_locked_rev() {
   local lock="$repo_root/tooling/direnv/devenv.lock" rev
   # nix, not jq: jq arrives with the shell this script is about to build, while
   # nix is guaranteed by the install step before it. fromJSON also beats
   # hand-rolled parsing of a file whose key order is not ours to assume.
   # Absolute-path readFile needs --impure; nix's own error is left on stderr
-  # rather than swallowed, because an unresolvable pin is the failure this
-  # function exists to prevent.
+  # rather than swallowed, because an unresolvable pin is the failure these
+  # functions exist to prevent.
   rev="$(nix eval --raw --impure --expr \
     "(builtins.fromJSON (builtins.readFile \"$lock\")).nodes.devenv.locked.rev")" || rev=""
   if [ -z "$rev" ]; then
@@ -52,26 +48,89 @@ devenv_flake() {
     echo "                set DEVENV_FLAKE to install a devenv explicitly" >&2
     return 1
   fi
-  printf 'github:cachix/devenv/%s' "$rev"
+  printf '%s' "$rev"
+}
+
+# Whether a devenv binary is the commit the lock names. `devenv version` prints
+# "devenv <semver>+<short rev> (<system>)", so the abbreviated commit is right
+# there and a prefix test against the full rev is the entire comparison — no
+# assumption about how many characters devenv chooses to abbreviate to. A build
+# with no "+<rev>" at all cannot prefix a 40-char hex rev, so it reads as a
+# mismatch, which is the safe direction.
+devenv_matches_lock() {
+  local bin="$1" rev="$2" printed
+  printed="$("$bin" version 2>/dev/null)" || return 1
+  printed="${printed#*+}"
+  printed="${printed%% *}"
+  [ -n "$printed" ] || return 1
+  case "$rev" in
+    "$printed"*) return 0 ;;
+  esac
+  return 1
 }
 
 install_devenv() {
-  # Shared host /nix/store is the package cache. Image may already provide
-  # devenv; otherwise profile-add the flake rev devenv.lock names (links store
-  # paths; re-fetch only when missing).
-  # The restored profile is not on PATH yet; look where the store cache put
-  # it before evaluating the devenv flake again.
-  local restored="$HOME/.nix-profile/bin/devenv"
+  local rev flake found=""
+  # Host runners own their Nix profile, and that profile roots a /nix/store the
+  # whole fleet shares, so an image-provided devenv is authoritative here
+  # whatever commit it is — and a wrong one is never REPLACED, because
+  # `nix profile remove --all` on a host would take the fleet's other roots with
+  # it. SMOO_HOST_RUNNER comes from setup-devenv's runner-kind detection.
+  #
+  # With none present these runners install from the FLOATING branch, not the
+  # locked rev, which is the one place this script deliberately accepts drift.
+  # The pin exists to make the ephemeral runners' cached devenv reproducible;
+  # a host installs into a long-lived shared profile whose blast radius is the
+  # whole fleet, and pinning it down to an older CLI than the fleet had been
+  # running broke it: run 34374650577 segfaulted the Rust linker
+  # (devenv-rust-linker, clang exit 139) building cowshed-cli tests, where run
+  # 34371205556 on the same commit range was green with floating 2a399e9.
+  # 190959a is TWO COMMITS OLDER than what these hosts had been getting, so the
+  # pin was moving them backwards. A host's toolchain moves when its image or
+  # the lock moves, not when a repository decides to hold it back.
+  if [ "${SMOO_HOST_RUNNER:-false}" = true ]; then
+    if command -v devenv >/dev/null 2>&1; then
+      echo "using host devenv: $(command -v devenv) ($(devenv version))"
+    else
+      flake="${DEVENV_FLAKE:-github:cachix/devenv}"
+      echo "host runner has no devenv; nix profile add ${flake}"
+      nix profile add --accept-flake-config "$flake"
+    fi
+    devenv_path_and_caches
+    return 0
+  fi
+
+  rev="$(devenv_locked_rev)"
+  # The store cache carries content only, never the Nix profiles, so the normal
+  # ephemeral case is that nothing is installed yet and this profile-adds the
+  # locked rev against an already-warm /nix — an evaluation and a link, not a
+  # download. Anything that does turn up on PATH is still checked rather than
+  # trusted, because "a devenv exists" was never the question.
   if command -v devenv >/dev/null 2>&1; then
-    echo "using existing devenv: $(command -v devenv) ($(devenv version))"
-  elif [ -x "$restored" ]; then
-    echo "using restored devenv: $restored ($("$restored" version))"
+    found="$(command -v devenv)"
+  elif [ -x "$HOME/.nix-profile/bin/devenv" ]; then
+    found="$HOME/.nix-profile/bin/devenv"
+  fi
+
+  if [ -n "$found" ] && devenv_matches_lock "$found" "$rev"; then
+    echo "using locked devenv: $found ($("$found" version))"
   else
-    local flake
-    flake="$(devenv_flake)"
+    flake="${DEVENV_FLAKE:-github:cachix/devenv/$rev}"
+    if [ -n "$found" ]; then
+      # Replacing needs the old entry gone first: `nix profile add` would
+      # otherwise refuse on a bin/devenv collision at equal priority. --all is
+      # exact rather than blunt, because devenv is the only thing this script
+      # ever profile-adds, so a wrong devenv means a wrong profile.
+      echo "replacing devenv $("$found" version 2>/dev/null) — lock names ${rev:0:7}"
+      nix profile remove --all
+    fi
     echo "nix profile add ${flake}"
     nix profile add --accept-flake-config "$flake"
   fi
+  devenv_path_and_caches
+}
+
+devenv_path_and_caches() {
   if [ -d "$HOME/.nix-profile/bin" ]; then
     echo "$HOME/.nix-profile/bin" >> "${GITHUB_PATH:-/dev/null}"
   fi

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -119,9 +119,29 @@ runs:
           keep-env-derivations = true
 
     # The store itself, restored as files: /nix/store plus the Nix database,
-    # merged into the fresh install. Profiles live outside /nix/var in
-    # single-user mode and ride along. The post phase collects garbage down
-    # to the live closure and saves when the primary key missed.
+    # merged into the fresh install. The post phase collects garbage down to the
+    # live closure and saves when the primary key missed.
+    #
+    # CONTENT ONLY — never the Nix profiles. `~/.nix-profile` and
+    # ~/.local/state/nix/profiles are mutable places whose whole job is to be
+    # gcroots, and restoring a previous run's copies over a freshly installed
+    # single-user Nix de-roots the Nix binary that is currently running. The post
+    # phase then garbage-collects it and cache-nix-action's own `nix --version`
+    # probe fails, at which point it skips the upload and still reports the step
+    # as a success — so the store cache silently stops being written and every
+    # later run pays a cold shell. Measured exactly that way: run 34371205556
+    # logged `nix (Nix) 2.34.7`, freed 2.7 GiB, then `nix: command not found`,
+    # and no `Cache saved` line for this key ever appeared.
+    #
+    # It only surfaced now because it needs a restore-prefix fallback rather than
+    # a cold store or an exact hit: a matching key restores profiles consistent
+    # with the store, while the diet rotated the key and pulled the previous
+    # store's profiles onto a different Nix.
+    #
+    # Dropping them costs nothing and buys determinism. devenv's closure still
+    # arrives inside /nix, so install-devenv's `nix profile add` of the locked
+    # rev is a link rather than a download, and the devenv in play is the one
+    # devenv.lock names instead of whichever run last populated the prefix.
     - name: 🧊 Cache Nix store
       id: nix-cache
       if: steps.runner-kind.outputs.host != 'true'
@@ -129,12 +149,10 @@ runs:
       with:
         paths: |
           /nix
-          ~/.nix-profile
-          ~/.local/state/nix/profiles
           ~/.cache/nix
         # prettier-ignore
-        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v4-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
-        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v4-
+        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v5-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
+        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v5-
         gc-max-store-size: 1G
 
     - name: ⚡ Enable Cachix
@@ -143,9 +161,17 @@ runs:
       with:
         name: devenv
 
+    # A host runner's devenv belongs to its image, so install-devenv accepts
+    # whatever is on PATH there. On an ephemeral runner the devenv came out of a
+    # cache this workflow wrote, so it is held to devenv.lock's rev: the store
+    # cache restores ~/.nix-profile wholesale and a prefix match hands the job
+    # the CLI of whichever run last populated the key, which outlived a lock bump
+    # until the check existed.
     - name: 🧰 Install devenv
       shell: bash
       working-directory: tooling/direnv
+      env:
+        SMOO_HOST_RUNNER: ${{ steps.runner-kind.outputs.host }}
       run: ./github-actions-bootstrap.sh install-devenv
 
     # node_modules + ttsc plugin binaries: GH Actions cache on ephemeral runners.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.10",
+  "version": "0.11.11",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {

package/src/monorepo/github-actions-bootstrap.test.ts

@@ -140,7 +140,7 @@ interface InstallRun {
   nixCalls: string;
 }
 
-function runInstallDevenv(lock: string, options: { devenvOnPath?: boolean } = {}): InstallRun {
+function runInstallDevenv(lock: string, options: { devenvVersion?: string; hostRunner?: boolean } = {}): InstallRun {
   const dir = mkdtempSync(join(tmpdir(), 'gab-install-'));
   try {
     const direnv = join(dir, 'root', 'tooling', 'direnv');
@@ -154,20 +154,22 @@ function runInstallDevenv(lock: string, options: { devenvOnPath?: boolean } = {}
     const stub = join(bin, 'nix');
     writeFileSync(stub, NIX_STUB);
     chmodSync(stub, 0o755);
-    if (options.devenvOnPath) {
+    if (options.devenvVersion !== undefined) {
+      // Shaped like the real thing: `devenv <semver>+<short rev> (<system>)`.
       const devenv = join(bin, 'devenv');
-      writeFileSync(devenv, '#!/usr/bin/env bash\necho 9.9.9-from-path\n');
+      writeFileSync(devenv, `#!/usr/bin/env bash\necho "${options.devenvVersion}"\n`);
       chmodSync(devenv, 0o755);
     }
     const r = spawnSync('bash', [join(direnv, 'github-actions-bootstrap.sh'), 'install-devenv'], {
       encoding: 'utf8',
-      // A bare PATH on purpose: an ambient devenv would select the
-      // already-installed branch and the pin would never be exercised.
+      // A bare PATH on purpose: an ambient devenv would decide these cases
+      // instead of the stub.
       env: {
         PATH: `${bin}:${dirname(REAL_NIX)}:/usr/bin:/bin`,
         HOME: join(dir, 'home'),
         NIX_CALLS: nixCalls,
         REAL_NIX,
+        ...(options.hostRunner ? { SMOO_HOST_RUNNER: 'true' } : {}),
       },
     });
     return {
@@ -181,10 +183,12 @@ function runInstallDevenv(lock: string, options: { devenvOnPath?: boolean } = {}
   }
 }
 
+const REV = 'f'.repeat(40);
+
 const LOCK_WITH_REV = JSON.stringify({
   nodes: {
     devenv: {
-      locked: { dir: 'src/modules', owner: 'cachix', repo: 'devenv', rev: 'f'.repeat(40), type: 'github' },
+      locked: { dir: 'src/modules', owner: 'cachix', repo: 'devenv', rev: REV, type: 'github' },
       original: { dir: 'src/modules', owner: 'cachix', repo: 'devenv', type: 'github' },
     },
   },
@@ -202,10 +206,10 @@ describe('github-actions-bootstrap install-devenv', () => {
     // The rev comes out of the lock, so the CLI is the commit whose modules the
     // shell is locked to. An unpinned `github:cachix/devenv` would install
     // whatever HEAD is on the day a cold runner misses the store cache.
-    expect(run.nixCalls).toContain(`nix profile add --accept-flake-config github:cachix/devenv/${'f'.repeat(40)}`);
+    expect(run.nixCalls).toContain(`nix profile add --accept-flake-config github:cachix/devenv/${REV}`);
     expect(run.nixCalls).not.toContain('github:cachix/devenv\n');
     // Announced, so a run's log names the version it installed.
-    expect(run.stdout).toContain(`github:cachix/devenv/${'f'.repeat(40)}`);
+    expect(run.stdout).toContain(`github:cachix/devenv/${REV}`);
   });
 
   it('refuses to install anything when the lock names no devenv rev', () => {
@@ -216,10 +220,60 @@ describe('github-actions-bootstrap install-devenv', () => {
     expect(run.nixCalls).not.toContain('profile add');
   });
 
-  it('keeps an already-installed devenv and never evaluates the flake', () => {
-    const run = runInstallDevenv(LOCK_WITH_REV, { devenvOnPath: true });
+  it('keeps a restored devenv built from the locked commit', () => {
+    const run = runInstallDevenv(LOCK_WITH_REV, { devenvVersion: 'devenv 2.3.1+fffffff (aarch64-darwin)' });
+    expect(run.status).toBe(0);
+    expect(run.stdout).toContain('using locked devenv');
+    // The warm path must cost nothing: no eval of the flake, no profile writes.
+    expect(run.nixCalls).toBe('');
+  });
+
+  it('replaces a restored devenv that is a different commit than the lock', () => {
+    // The real drift: the store cache restores ~/.nix-profile wholesale, so a
+    // rotated key hands the job the CLI of whichever run last populated the
+    // prefix. Observed in run 34369909403 as devenv 2.3.1+2a399e9 against a
+    // lock naming 190959a.
+    const run = runInstallDevenv(LOCK_WITH_REV, { devenvVersion: 'devenv 2.3.1+2a399e9 (aarch64-darwin)' });
+    if (run.status !== 0) {
+      printCommandOutput(run.stdout, run.stderr);
+    }
+    expect(run.status).toBe(0);
+    // Removal first: `nix profile add` collides on bin/devenv at equal priority.
+    const removeAt = run.nixCalls.indexOf('profile remove --all');
+    const addAt = run.nixCalls.indexOf(`profile add --accept-flake-config github:cachix/devenv/${REV}`);
+    expect(removeAt).toBeGreaterThanOrEqual(0);
+    expect(addAt).toBeGreaterThan(removeAt);
+    // Said out loud, with both commits, so a log explains the replacement.
+    expect(run.stdout).toContain('replacing devenv');
+    expect(run.stdout).toContain('2a399e9');
+  });
+
+  it('leaves a host runner its own devenv, whatever commit it is', () => {
+    // Host runners own their Nix profile; a repository rewriting it would take
+    // the whole fleet's shared store with it.
+    const run = runInstallDevenv(LOCK_WITH_REV, {
+      devenvVersion: 'devenv 2.3.1+2a399e9 (x86_64-linux)',
+      hostRunner: true,
+    });
     expect(run.status).toBe(0);
-    expect(run.stdout).toContain('using existing devenv');
+    expect(run.stdout).toContain('using host devenv');
     expect(run.nixCalls).toBe('');
   });
+
+  it('installs from the floating branch on a host runner with no devenv', () => {
+    // The one place drift is accepted deliberately. A host installs into a
+    // long-lived profile that roots the fleet's shared store, and holding it
+    // back to an older CLI than the fleet was running segfaulted the Rust
+    // linker in run 34374650577. Refusing to install at all was also wrong —
+    // that failed linux-release-candidate in run 34373420924.
+    const run = runInstallDevenv(LOCK_WITH_REV, { hostRunner: true });
+    if (run.status !== 0) {
+      printCommandOutput(run.stdout, run.stderr);
+    }
+    expect(run.status).toBe(0);
+    expect(run.nixCalls).toContain('nix profile add --accept-flake-config github:cachix/devenv\n');
+    expect(run.nixCalls).not.toContain(REV);
+    // Never on a host: the profile roots a store the whole fleet shares.
+    expect(run.nixCalls).not.toContain('profile remove');
+  });
 });