[ci] Ensure the use of a nix shell for jobs using install-nix - #5676
Draft
maru-ava wants to merge 5 commits into
Draft
[ci] Ensure the use of a nix shell for jobs using install-nix#5676maru-ava wants to merge 5 commits into
maru-ava wants to merge 5 commits into
Conversation
maru-ava
force-pushed
the
maru/ci-nix-shell-policy
branch
from
July 16, 2026 19:21
1cacaee to
7ecd739
Compare
maru-ava
force-pushed
the
maru/ci-nix-shell-policy
branch
2 times, most recently
from
July 16, 2026 19:35
e6b5a84 to
bced3a3
Compare
maru-ava
force-pushed
the
maru/ci-nix-shell-policy
branch
from
July 16, 2026 19:56
bced3a3 to
2d812b3
Compare
maru-ava
force-pushed
the
maru/doc-ci
branch
4 times, most recently
from
August 4, 2026 06:20
41d64db to
8cfe5f1
Compare
maru-ava
force-pushed
the
maru/ci-nix-shell-policy
branch
from
August 4, 2026 06:57
2d812b3 to
7f09e83
Compare
maru-ava
force-pushed
the
maru/doc-ci
branch
3 times, most recently
from
August 5, 2026 19:50
b1e88c1 to
16f19fc
Compare
maru-ava
force-pushed
the
maru/ci-nix-shell-policy
branch
2 times, most recently
from
August 6, 2026 01:17
9c9c2a2 to
1c7bea6
Compare
JuanLeon2
approved these changes
Aug 6, 2026
Document the CI conventions that keep workflow behavior reproducible and supply-chain updates reviewable and ensure mechanical checks where reasonable to do so. Change-Id: Ib194e94678b49acd6278845558d00f09ac8445ce
Change-Id: I71cd7107e2525391795823caff0b1f89d41a1dbc
Change-Id: I8aa29fb7382a963d6409bb36ba3309cd11c7284c
Previously, jobs using install-nix were inconsistently specifying a nix shell for task execution. Without a nix shell, go-task was being invoked with `go run` via the runner-provided golang. Since the version of the runner-provided golang will usually differ from the version we require, golang would proceed to download the required version and this download could flake (as with all things GitHub Actions). This change adds a check requiring a nix shell default to be set for all CI jobs that directly use the `install-nix` action, and ensures that existing jobs pass the check. This is intended to avoid the potential for infra flakes associated with golang download. Change-Id: Ie678d2a88546d52e58f80a72ef64135abc707a6f
Change-Id: I378fc64bc1425864a9d22bccab6be0e36cfdad67
maru-ava
force-pushed
the
maru/ci-nix-shell-policy
branch
from
August 7, 2026 00:12
736796a to
0cb9e7a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this should be merged
Previously, jobs using install-nix were inconsistently specifying a nix shell for task execution. Without a nix shell, go-task was being invoked with
go runvia the runner-provided golang. Since the version of the runner-provided golang will usually differ from the version we require, golang would proceed to download the required version and this download could flake (as with all things GitHub Actions).This change adds a check requiring a nix shell default to be set for all CI jobs that directly use the
install-nixaction, and ensures that existing jobs pass the check. This is intended to avoid the potential for infra flakes associated with golang download.How this was tested
CI