ymrtech/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Activity Actions

vpn-mx: put the ymrtech build gate's ruby toolchain in the system profile (ymrtech#948) #1977

Merged
hermes merged 1 commit from kb/YMRT-948-icon-coverage-ruby into main 2026-10-13 16:18:15 -06:00
Conversation 0 Commits 1 Files changed 1 +21
hermes commented 2026-10-13 16:10:46 -06:00
Collaborator
Copy link

Card ymrtech#948, second half of the same fix as #1976 (already merged).

A [ci] job's PATH is its runner DAEMON's env, frozen at daemon start and never refreshed by a switch (stopIfChanged/restartIfChanged = false on the runner units). MEASURED with a throwaway probe workflow on branch probe/YMRT-948-ci-ruby-env (run 14962, three [ci] jobs):

probe arch command -v ruby
a x86_64 (giga) /nix/store/...-ruby-3.3.10/bin/ruby
b aarch64 (vpn-mx) MISSING
c aarch64 (vpn) /nix/store/...-ruby-3.3.10/bin/ruby

and the PATH probe b saw was the hostPackages list from BEFORE even attic-client was added — no ruby, and no /run/current-system/sw/bin. So #1976's hostPackages entry is correct but inert until that daemon restarts, which the fleet's runner units deliberately never do.

Same shape as the jq/attic-client entries already in this file: the tool goes in the SYSTEM PROFILE (which every switch DOES refresh) and the job prepends it — the fleet idiom (export PATH="/run/wrappers/bin:/run/current-system/sw/bin:$PATH", used in ten workflow steps today).

The matching ymrtech-side change (a guarded prepend step in the four jobs, active only where ruby is not already on PATH) follows as a separate PR in the ymrtech repo.

Card ymrtech#948, second half of the same fix as #1976 (already merged). A `[ci]` job's PATH is its runner DAEMON's env, frozen at daemon start and never refreshed by a switch (`stopIfChanged`/`restartIfChanged = false` on the runner units). MEASURED with a throwaway probe workflow on branch `probe/YMRT-948-ci-ruby-env` (run 14962, three `[ci]` jobs): | probe | arch | `command -v ruby` | |---|---|---| | a | x86_64 (giga) | /nix/store/...-ruby-3.3.10/bin/ruby | | b | aarch64 (vpn-mx) | **MISSING** | | c | aarch64 (vpn) | /nix/store/...-ruby-3.3.10/bin/ruby | and the PATH probe b saw was the hostPackages list from BEFORE even attic-client was added — no ruby, and no `/run/current-system/sw/bin`. So #1976's hostPackages entry is correct but inert until that daemon restarts, which the fleet's runner units deliberately never do. Same shape as the jq/attic-client entries already in this file: the tool goes in the SYSTEM PROFILE (which every switch DOES refresh) and the job prepends it — the fleet idiom (`export PATH="/run/wrappers/bin:/run/current-system/sw/bin:$PATH"`, used in ten workflow steps today). The matching ymrtech-side change (a guarded prepend step in the four jobs, active only where `ruby` is not already on PATH) follows as a separate PR in the ymrtech repo.
vpn-mx: put the ymrtech build gate's ruby toolchain in the system profile (ymrtech#948)
All checks were successful
PR base guard / Base drift / conflict check (pull_request) Successful in 4s
Details
NixOS Build Check / Flake input regression guard (pull_request) Successful in 7s
Details
NixOS Build Check / Scope changed deployable hosts (pull_request) Successful in 9s
Details
Secret Scan / gitleaks scan (pull_request) Successful in 18s
Details
NixOS Build Check / Build changed host closures (native, one eval) (pull_request) Successful in 25s
Details
NixOS Build Check / Worker-scope reaper worker signature (mutation-tested) (pull_request) Successful in 3s
Details
NixOS Build Check / Kanban pool capacity knob (runtime override + clamp, mutation-tested) (pull_request) Successful in 2s
Details
NixOS Build Check / Sentinel pass budget contract (prompt forbids the full board walk, mutation-tested) (pull_request) Successful in 2s
Details
NixOS Build Check / CI-scratch reaper class table (mutation-tested) (pull_request) Successful in 3s
Details
NixOS Build Check / Hermes runtime gates (one eval of vpn's runtime) (pull_request) Successful in 1m11s
Details
NixOS Build Check / Scheduled foremerge reap command line (mutation-tested) (pull_request) Successful in 4s
Details
foremerge intent (advisory) all 1 changed path(s) covered by a live foremerge intent
Details
NixOS Build Check / foremerge accept-order contract (real binary) (pull_request) Successful in 1m16s
Details
NixOS Build Check / .forgejo/tests python suites (hermetic) (pull_request) Successful in 38s
Details
NixOS Build Check / Repo gates (the folded selftest battery) (pull_request) Successful in 3m17s
Details
070ef4c18c 
A [ci] job's PATH is its runner DAEMON's env, frozen at daemon start and never
refreshed by a switch (stopIfChanged/restartIfChanged = false). Measured with a
throwaway probe workflow (run 14962): the PATH a job sees on this host is the
hostPackages list from before even attic-client was added - no ruby, and no
/run/current-system/sw/bin - so hostPackages alone cannot fix ymrtech's
'Verify icon font coverage' step (which needs an ambient ruby as the job's
FIRST step).

Same shape as the jq/attic-client entries above: the tool goes in the SYSTEM
PROFILE, which every switch DOES refresh, and the job prepends it.
hermes merged commit e8a1e38ba6 into main 2026-10-13 16:18:15 -06:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog

   
bug

   
enhancement

   
in-progress

   
review

   
todo
No labels
backlog
bug
enhancement
in-progress
review
todo
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ymrtech/nix-config!1977
No description provided.