Repository navigation
Conversation
Lets a repo gate an action on green CI. Success actions run only after every build of the commit succeeded; when one fails their app-build check is concluded cancelled rather than left queued forever.
znaniye
added a commit
that referenced
this pull request
Sep 9, 2026
Nix's github fetcher only skips api.github.com when an input carries a rev. Given a ref -- even when that ref is a full 40-char commit sha -- it first calls repos/OWNER/REPO/commits/REF to resolve it. That endpoint allows 60 requests/hour to unauthenticated clients, counted per source IP, so concurrent runs on one runner drain the quota and evaluation dies with a 403. The failure does not read as a quota problem. FlakeInputAuthorization turns any metadata failure into "is private or doesn't exist (or your flake.lock file is outdated)", which points the investigation at permissions that were never involved. Seen on PR #25: error: unable to download 'https://api.github.com/repos/garnix-io/garnix-lib/commits/d3f3a98...': HTTP error 403 API rate limit exceeded for 144.76.85.226. Module.hs passed already-pinned shas as ?ref=, spending an API round trip per module build to resolve a sha to itself. ?rev= reaches the tarball directly. The incremental build specs tracked incrementalize/main, so they spent quota resolving a branch head on every run and could go red from someone else's push with no change of ours. A spec that follows a branch head is a monitor, not a test; pinned to the commit it was passing against. check-immutable-flake-refs fails the build if either form returns. Unlike the original version of this change, the WATCHDOG_GITHUB_ACCESS_TOKEN_FILE block is kept. That version removed it on the grounds that nothing ever set the variable, so the guard could only ever write an invalid access-tokens line. The preceding commit gives the variable a real default and stages the file, so the objection no longer holds, and the two remedies are complementary: ?rev= removes the dependency on the quota for inputs we pin ourselves, while the token still covers inputs a user's flake resolves by ref or branch head.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ActionTriggerhad a single constructor, with a comment saying it existed only for documentation and backwards compatibility. This adds the second one.A
pushaction still runs as soon as its own app is built, concurrently with the other builds. Asuccessaction runs only once every build of the commit has succeeded — the same gate module publishing already uses — so a repo can hang a deploy notification off green CI.The failure path matters more than the happy one.
setupActionsregisters each action's app-build check up front, and nothing will build it once the gate refuses, so it is concluded cancelled here. Left alone it sits queued forever and a required check never resolves.The config schema golden is regenerated:
ongoes from aconstto a two-valueoneOf.One note for review: the VM-backed tests in
ActionSpec's@slow @skip-cicontext cannot run here, becausenixosConfigurations.action-runner2no longer exists andwithActionRunnerfails at thearoundAllhook. That is pre-existing, not introduced by this PR. The gate's failure path is therefore covered by a test placed outside that hook, which needs no VM and does run.