Repository navigation
ci: serve the Nix cache from nix.moq.dev instead of Cachix - #5693
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
R2 behind a Worker replaces kixelated.cachix.org: a release bucket that never expires and a CI bucket that a lifecycle rule expires after 30 days. cache.yml pushes the dev shell from main and release-nix.yml (formerly cachix.yml) pushes tagged packages, each through a GitHub Environment that holds the signing key. Workflows install Nix through one local action that accepts the flake's nixConfig, so flake.nix is the only place naming the cache. The public key is a placeholder until the maintainer generates it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Quest outcome: implementation done, left as a draft. It is blocked on the maintainer bootstrap in (Written by Claude Opus 5.5) |
# Conflicts: # .github/workflows/check.yml # .github/workflows/ts.yml # .github/workflows/uring.yml
flake.nix now trusts the generated nix.moq.dev-1 key instead of the all-zero placeholder. With one signing key, a second Environment for releases only guarded the bucket token: anything reaching the key can sign any path. So release-nix deploys to cache-write, which also admits the release tags, and one R2 token covers both buckets. keygen writes only there, and bucket creation no longer offers to add bindings to wrangler.jsonc. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep main's queue-only Check and Test, its alert list without Cache and Check, and its removal of the drill-sensitivity job. Route the two new Nightly jobs through the nix composite, and point audit.md and the epic README at nix-cache-verify.md, carrying main's Nightly baseline into it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Take #5685's dev-shell-only cache.yml and push it to nix.moq.dev from cache-write. List the mbx and nix infra side by side, and point the Nightly tooling test and the remaining quest links at the nix composite and nix-cache-verify.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 19 seconds. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 805776c92e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replaces
kixelated.cachix.orgwithnix.moq.dev, an R2-backed binary cache behind a Worker. Completesquest/m0/ci/nix-cache.md.Changes
infra/nix: a Worker fornix.moq.devthat serves two R2 buckets as one cache.nix-moq-devholds released packages and never expires.nix-ci-moq-devholds CI dev shells.lifecycle.jsondeletes its objects after 30 days.nix-cache-infoitself, withPriority: 41, so Nix asks here only after cache.nixos.org..narinfogets a 5-minuteCache-Controlandnar/gets immutable.just infra nix create | lifecycle | deploy | keygen | push.keygenstores the signing key incache-writewithout writing it to disk, then prints the public key..github/actions/nix: a single composite action replaces every directnix-installer-actioncall, including the Nightly jobs added on main since. It setsaccept-flake-config = true, soflake.nixis the only file that names the cache and its key. The CI checkout is already trusted code, so this adds no trust. Nightly's tooling test now requires every dev-shell job to use it.flake.nix:nixConfignow nameshttps://nix.moq.dev, trustsnix.moq.dev-1:BZ0DtCypDFv1ESX3hxuB42yc0vitSA1YHojSmVwB5bk=, and setsfallback = true. Expiry can delete a dependency before the path that needs it, andfallbackbuilds the missing piece instead of failing.cache.yml: after ci: cache Rust builds in R2, written from the merge queue #5685 it warms only the dev shell, and that push now goes tonix-ci-moq-devfrom thecache-writeEnvironment. Each warm uploads only missing paths, which also restores anything that expired.cachix.yml->release-nix.yml("Release Nix"): pushes the tagged package tonix-moq-devfrom thecache-writeEnvironment, which also admits the five release tag patterns.cachix pinis no longer needed because that bucket never expires.alert.ymlfollows the rename.infra/README.md: adds the bootstrap beside the mbx one. The doc, overlay, and scrub comments now point at the new cache.nix-cache.mdand addsnix-cache-verify.md, a condition quest that waits on this merge, then verifies the cache and retires Cachix. Links fromaudit.md,mbx-r2-verify.mdand the epic README now point at it.Maintainer actions
Done 2026-10-19 and 2026-10-20 (README "Bootstrapping the Nix cache"):
moq-{relay,cli,boy,c,gst}-v*to moq-bot and RepositoryRole 2.nix-moq-devandnix-ci-moq-devwith the CI lifecycle rule; the Worker servesnix.moq.dev.NIX_SIGNING_KEYincache-write; its public half is inflake.nix.cache-write's deployment policy, and the unusednix-releaseEnvironment is gone.NIX_R2_ACCESS_KEY_ID/NIX_R2_SECRET_ACCESS_KEYincache-write.just infra nix deploy) without the straynix_moq_devbinding thatwrangler r2 bucket createhad added towrangler.jsonc.createnow passes--update-config=false.Remaining after merging: delete
CACHIX_AUTH_TOKEN(tracked in the verify quest).cache-writealso admits the merge queue since #5685, so merge-queue jobs can reach the signing key too. The maintainer accepted that: enqueuing a PR is treated as landing it.Public API and wire impact
No API or wire changes; this touches CI and infra only. Downstream users who run
--accept-flake-configon a new tag will now trustnix.moq.devinstead of Cachix.Checks
just check,just gh checkandquest checkpass, and so doessh/gh/nightly.test.py.wrangler deploy --dry-runbundles both bindings, and stricttscand biome are clean.just infra nix pushreaches the R2 S3 endpoint with this URL format; it was rejected only on fake credentials. Missing secrets fail loudly. A signednix copyto a localfile://cache works.cache.ymlorrelease-nix.ymlagainst the real buckets, which first happens after merge, or macOS. Since ci: run cloud CI only in the merge queue #6038, main PRs skip Check and Test, so the queue is this PR's first cloud run of them.Decisions (confirmed by the maintainer 2026-10-19)
cachix pinused to protect. Nix's S3 store can't write under a prefix, so a lifecycle rule can't tell the two apart.nix.moq.dev.accept-flake-configinstead of naming the cache in each workflow. One source of truth inflake.nix.nix-releasefolded intocache-write. Two buckets stay so CI paths expire and released ones don't.Suggested follow-ups
nix-cache-verify(added here)./, so composite-action pins under.github/actions/*drift:setup-packagingwas already on an oldernix-installer-action. Adddirectories.(Written by Claude Opus 5.5)
🤖 Generated with Claude Code