ci: Add schedueled updater

2025-12-29 17:32:41 +01:00
parent 033b61dd4f
commit 65928c4064
4 changed files with 179 additions and 51 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,5 @@
 # yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
 variables:
-    SDK_VERSION: 9.0
    SKIP_TESTS: "true"

 default:
@@ -9,10 +8,12 @@ default:

 include:
    - project: oceanbox/gitlab-ci
-      ref: v4.4
+      ref: v4.5
      file: template/Base.gitlab-ci.yml
    - local: "/src/Atlantis/.gitlab-ci.yml"
      rules:
+          - if: $CI_PIPELINE_SOURCE == "schedule"
+            when: never
          - changes:
                - "src/Atlantis/**/*"
                - "nix/packages/atlantis.nix"
@@ -20,32 +21,44 @@ include:
                - "nix/containers.nix"
    - local: "/src/Sorcerer/.gitlab-ci.yml"
      rules:
+          - if: $CI_PIPELINE_SOURCE == "schedule"
+            when: never
          - changes:
                - "src/Sorcerer/**/*"
                - "nix/packages/sorcerer.nix"
                - "nix/containers.nix"
    - local: "/src/Archivist/.gitlab-ci.yml"
      rules:
+          - if: $CI_PIPELINE_SOURCE == "schedule"
+            when: never
          - changes:
                - "src/Archivist/**/*"
                - "nix/packages/archivist.nix"
    - local: "/src/Interfaces/.gitlab-ci.yml"
      rules:
+          - if: $CI_PIPELINE_SOURCE == "schedule"
+            when: never
          - changes:
                - "src/Interfaces/**/*"
                - "nix/packages/api.nix"
    - local: "/src/DataAgent/.gitlab-ci.yml"
      rules:
+          - if: $CI_PIPELINE_SOURCE == "schedule"
+            when: never
          - changes:
                - "src/DataAgent/**/*"
                - "nix/packages/dataagent.nix"
    - local: "/src/ServerPack/.gitlab-ci.yml"
      rules:
+          - if: $CI_PIPELINE_SOURCE == "schedule"
+            when: never
          - changes:
                - "src/ServerPack/**/*"
                - "nix/packages/serverpack.nix"
    - local: "/src/Codex/.gitlab-ci.yml"
      rules:
+          - if: $CI_PIPELINE_SOURCE == "schedule"
+            when: never
          - changes:
                - "src/Codex/**/*"
                - "nix/packages/node-modules.nix"
--- a/nix/default.nix
+++ b/nix/default.nix
@@ -9,8 +9,15 @@
 */
 # Generated by npins. Do not modify; will be overwritten regularly
 let
-  data = builtins.fromJSON (builtins.readFile ./sources.json);
-  version = data.version;
+  # Backwards-compatibly make something that previously didn't take any arguments take some
+  # The function must return an attrset, and will unfortunately be eagerly evaluated
+  # Same thing, but it catches eval errors on the default argument so that one may still call it with other arguments
+  mkFunctor =
+    fn:
+    let
+      e = builtins.tryEval (fn { });
+    in
+    (if e.success then e.value else { error = fn { }; }) // { __functor = _self: fn; };

  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
  range =
@@ -21,7 +28,6 @@ let

  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
-  concatMapStrings = f: list: concatStrings (map f list);
  concatStrings = builtins.concatStringsSep "";

  # If the environment variable NPINS_OVERRIDE_${name} is set, then use
@@ -48,41 +54,87 @@ let

  mkSource =
    name: spec:
+    {
+      pkgs ? null,
+    }:
    assert spec ? type;
    let
+      # Unify across builtin and pkgs fetchers.
+      # `fetchGit` requires a wrapper because of slight API differences.
+      fetchers =
+        if pkgs == null then
+          {
+            inherit (builtins) fetchTarball fetchurl;
+            # For some fucking reason, fetchGit has a different signature than the other builtin fetchers …
+            fetchGit = args: (builtins.fetchGit args).outPath;
+          }
+        else
+          {
+            fetchTarball =
+              {
+                url,
+                sha256,
+              }:
+              pkgs.fetchzip {
+                inherit url sha256;
+                extension = "tar";
+              };
+            inherit (pkgs) fetchurl;
+            fetchGit =
+              {
+                url,
+                submodules,
+                rev,
+                name,
+                narHash,
+              }:
+              pkgs.fetchgit {
+                inherit url rev name;
+                fetchSubmodules = submodules;
+                hash = narHash;
+              };
+          };
+
+      # Dispatch to the correct code path based on the type
      path =
        if spec.type == "Git" then
-          mkGitSource spec
+          mkGitSource fetchers spec
        else if spec.type == "GitRelease" then
-          mkGitSource spec
+          mkGitSource fetchers spec
        else if spec.type == "PyPi" then
-          mkPyPiSource spec
+          mkPyPiSource fetchers spec
        else if spec.type == "Channel" then
-          mkChannelSource spec
+          mkChannelSource fetchers spec
        else if spec.type == "Tarball" then
-          mkTarballSource spec
+          mkTarballSource fetchers spec
+        else if spec.type == "Container" then
+          mkContainerSource pkgs spec
        else
          builtins.throw "Unknown source type ${spec.type}";
    in
    spec // { outPath = mayOverride name path; };

  mkGitSource =
+    {
+      fetchTarball,
+      fetchGit,
+      ...
+    }:
    {
      repository,
      revision,
      url ? null,
      submodules,
      hash,
-      branch ? null,
      ...
    }:
    assert repository ? type;
    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
    # In the latter case, there we will always be an url to the tarball
    if url != null && !submodules then
-      builtins.fetchTarball {
+      fetchTarball {
        inherit url;
-        sha256 = hash; # FIXME: check nix version & use SRI hashes
+        sha256 = hash;
      }
    else
      let
@@ -93,6 +145,8 @@ let
            "https://github.com/${repository.owner}/${repository.repo}.git"
          else if repository.type == "GitLab" then
            "${repository.server}/${repository.repo_path}.git"
+          else if repository.type == "Forgejo" then
+            "${repository.server}/${repository.owner}/${repository.repo}.git"
          else
            throw "Unrecognized repository type ${repository.type}";
        urlToName =
@@ -107,40 +161,89 @@ let
          "${if matched == null then "source" else builtins.head matched}${appendShort}";
        name = urlToName url revision;
      in
-      builtins.fetchGit {
+      fetchGit {
        rev = revision;
-        inherit name;
-        # hash = hash;
-        inherit url submodules;
+        narHash = hash;
+
+        inherit name submodules url;
      };

  mkPyPiSource =
-    { url, hash, ... }:
-    builtins.fetchurl {
+    { fetchurl, ... }:
+    {
+      url,
+      hash,
+      ...
+    }:
+    fetchurl {
      inherit url;
      sha256 = hash;
    };

  mkChannelSource =
-    { url, hash, ... }:
-    builtins.fetchTarball {
+    { fetchTarball, ... }:
+    {
+      url,
+      hash,
+      ...
+    }:
+    fetchTarball {
      inherit url;
      sha256 = hash;
    };

  mkTarballSource =
+    { fetchTarball, ... }:
    {
      url,
      locked_url ? url,
      hash,
      ...
    }:
-    builtins.fetchTarball {
+    fetchTarball {
      url = locked_url;
      sha256 = hash;
    };
+
+  mkContainerSource =
+    pkgs:
+    {
+      image_name,
+      image_tag,
+      image_digest,
+      ...
+    }:
+    if pkgs == null then
+      builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers"
+    else
+      pkgs.dockerTools.pullImage {
+        imageName = image_name;
+        imageDigest = image_digest;
+        finalImageTag = image_tag;
+      };
 in
-if version == 5 then
-  builtins.mapAttrs mkSource data.pins
-else
-  throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
+mkFunctor (
+  {
+    input ? ./sources.json,
+  }:
+  let
+    data =
+      if builtins.isPath input then
+        # while `readFile` will throw an error anyways if the path doesn't exist,
+        # we still need to check beforehand because *our* error can be caught but not the one from the builtin
+        # *piegames sighs*
+        if builtins.pathExists input then
+          builtins.fromJSON (builtins.readFile input)
+        else
+          throw "Input path ${toString input} does not exist"
+      else if builtins.isAttrs input then
+        input
+      else
+        throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset";
+    version = data.version;
+  in
+  if version == 7 then
+    builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins
+  else
+    throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
+)
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -11,7 +11,7 @@
      "submodules": false,
      "revision": "fcdea223397448d35d9b31f798479227e80183f6",
      "url": "https://github.com/ryantm/agenix/archive/fcdea223397448d35d9b31f798479227e80183f6.tar.gz",
-      "hash": "1d4m7hsq727q7ndjqmgyl8vkbkqjwps962ygmv2mcc5dbqzgn963"
+      "hash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ="
    },
    "nix-utils": {
      "type": "Git",
@@ -23,13 +23,13 @@
      "submodules": false,
      "revision": "098f594425d2b9dde0657becad0f6498d074f8b3",
      "url": null,
-      "hash": "0hh52w1fkpr1xx6j8cjm6g88j2352yv2ysqm1q51j59y6f583vyb"
+      "hash": "sha256-y++BijM+FRkKDhVrL7YXZQiJ0DNVMiRN7yHf6QIXBUI="
    },
    "nixpkgs": {
      "type": "Channel",
      "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre905319.f720de590661/nixexprs.tar.xz",
-      "hash": "07n4hhch0j6n69b0zchdjg0l80z2xrdk7k57ykv90cvhklim5dz1"
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre915325.3a7affa77a5a/nixexprs.tar.xz",
+      "hash": "sha256-U7dmoZ67f+Xi70kIbfWNy1jzlmR3D215330OIJ3Td6Y="
    },
    "pre-commit": {
      "type": "Git",
@@ -40,10 +40,10 @@
      },
      "branch": "master",
      "submodules": false,
-      "revision": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
-      "url": "https://github.com/cachix/git-hooks.nix/archive/50b9238891e388c9fdc6a5c49e49c42533a1b5ce.tar.gz",
-      "hash": "01z1ihgpc7z7s97k9gn7vskw5zl8p6xavysdlmis1w0w4c3jfms2"
+      "revision": "b68b780b69702a090c8bb1b973bab13756cc7a27",
+      "url": "https://github.com/cachix/git-hooks.nix/archive/b68b780b69702a090c8bb1b973bab13756cc7a27.tar.gz",
+      "hash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0="
    }
  },
-  "version": 5
+  "version": 7
 }
--- a/shell.nix
+++ b/shell.nix
@@ -4,48 +4,60 @@
  pre-commit ? import ./nix/pre-commit.nix,
 }:
 let
-  dotnet-sdk = pkgs.dotnetCorePackages.sdk_9_0;
+  dotnet-sdk = pkgs.dotnetCorePackages.sdk_10_0;
  agenix = pkgs.callPackage "${sources.agenix}/pkgs/agenix.nix" { };
+  fable = pkgs.buildDotnetGlobalTool {
+    pname = "fable";
+    version = "4.28.0";
+    nugetHash = "sha256-t5Kex6sVe1B/xErMfDav+WGEjeZjndRNQA2r0FvL92g=";
+  };
 in
 pkgs.mkShellNoCC {
  buildInputs = [ dotnet-sdk ];

-  packages = with pkgs; [
+  packages = [
    # F#
    fable
-    dotnet-outdated
-    fantomas
-    fsautocomplete
+    pkgs.dotnet-outdated
+    pkgs.fantomas
+    pkgs.fsautocomplete

    # JavaScript
-    bun
-    nodejs
+    pkgs.bun
+    pkgs.nodejs

    # Devlopment tools
-    npins
-    mkcert
-    dive
-    nix-output-monitor
-    just
+    pkgs.npins
+    pkgs.mkcert
+    pkgs.dive
+    pkgs.nix-output-monitor
+    pkgs.just

    # Secret management with agenix
    agenix

    # Kubernetes tools
-    tilt
-    dapr-cli
-    kustomize
-    kubernetes-helm
+    pkgs.tilt
+    pkgs.dapr-cli
+    pkgs.kustomize
+    pkgs.kubernetes-helm
  ];

  # Environment variables
  DOTNET_ROOT = "${dotnet-sdk}/share/dotnet";
-  DOTNET_CLI_TELEMETRY_OPTOUT = "true";
  LOG_LEVEL = "verbose";

  # Alternative shells
  passthru = pkgs.lib.mapAttrs (name: value: pkgs.mkShellNoCC (value // { inherit name; })) {
    pre-commit.shellHook = pre-commit.shellHook;
+    ci-shell = {
+      packages = [
+        pkgs.npins
+      ];
+      shellHook = ''
+        export NPINS_DIRECTORY="nix"
+      '';
+    };
    agenix-gen = {
      packages = [ agenix ];
      shellHook = ''