build: Update nix config to match core Crossplane - #332
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (8)
📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe PR enables parallel Nix builds in the Renovate entrypoint. It removes the pinned ChangesNix workflow updates
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This PR updates the Nix build configuration, parallelizes isolated build work, and exposes the vendor package without introducing a concrete user or production impact that remains unresolved. No actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 6✅ Passed checks (6 passed)
Full details: Breaking ChangesExplanation PASS. The pull-request diff changes only Full details: Feature Gate RequirementExplanation PASS: The pull request changes only Nix and Renovate build configuration. The diff has no changes under ✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2978362 to
538a915
Compare
Since we separated the CLI out of core Crossplane and copied its nix-based build system, three significant build changes have happened in core: 1. We've started using nix's standard `buildGoModule` instead of `gomod2nix` in order to ensure the produced artifacts have necessary dependency data for security scanning (crossplane/crossplane#7549). 2. The nix build has been updated to give each build job its own writeable home directory, solving the `/homeless-shelter` errors we occaisionally see in CI (crossplane/crossplane#7652). 3. The nixpkgs channel has been updated to the latest 26.05 from the EOL 25.11 (crossplane/crossplane#7715). All of these changes are relevant improvements for the CLI build as well, so port them over. This should make our renovate runs more reliable (they often hit issue 2 today) and improve our security posture. Signed-off-by: Adam Wolfe Gordon <awg@upbound.io>
538a915 to
2b043e1
Compare
| # needing to create the nixbld group and users in this ephemeral container. | ||
| build-users-group = | ||
|
|
||
| # One build at a time, so no build starts before we can clean up /homeless-shelter. |
There was a problem hiding this comment.
@jbw976 thats what i mean is it safe ? with all your work around /homeless-shelter the last weeks?
There was a problem hiding this comment.
great question, yes I think it is safe actually, because this PR removes the gomod2nix derivation that had to be built from source often. with that gone, all go builds we do will route through our go-builders.nix which gives each a safe HOME to write to instead of writing to the /homeless-shelter. Plus, we still have the clean-up in our crossplane-nix launcher and the post-build-hook to also help.
So I think we can use max-jobs = auto again safely! 🙏
jbw976
left a comment
jbw976
left a comment
There was a problem hiding this comment.
Thanks for making this update @adamwg! I think the vulnerability scanning improvement is critical just like it was for core crossplane, so thanks for taking the initiative to doing it here too 🙇♂️
Referring to the /homeless-shelter errors:
This should make our renovate runs more reliable (they often hit issue 2 today)
are you sure about that? after all the work we did in this repo to fix them, I thought that issue was fixed, e.g.:
i had my agent pull all the Renovate logs for the last month+ and it seems like we haven't seen one of those failures since Aug 8. Are you seeing otherwise?
That being said, the PR looks reasonable and my testing/builds seems to be working OK with these changes too. So LGTM! 🙌
3 participants
Description of your changes
Since we separated the CLI out of core Crossplane and copied its nix-based build system, three significant build changes have happened in core:
buildGoModuleinstead ofgomod2nixin order to ensure the produced artifacts have necessary dependency data for security scanning (build(nix): build with buildGoModule so images are vulnerability-scannable crossplane#7549)./homeless-sheltererrors we occaisionally see in CI (build: give every Go build its own writable HOME crossplane#7652).All of these changes are relevant improvements for the CLI build as well, so port them over. This should make our renovate runs more reliable (they often hit issue 2 today) and improve our security posture.
I have:
./nix.sh flake checkto ensure this PR is ready for review.- [ ] Added or updated unit tests.- [ ] Linked a PR or a docs tracking issue to document this change.backport release-x.ylabels to auto-backport this PR.