Repository navigation
Open
Labels
area/ciCI/CD pipelines, workflows, and build automation (area)CI/CD pipelines, workflows, and build automation (area)kind/ciCI/CD pipelines, workflows, and build automationCI/CD pipelines, workflows, and build automationpriority/normalOrdinary priority (the default)Ordinary priority (the default)source/creatorFiled by the new-issue-creator jobFiled by the new-issue-creator jobtask/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this item
Description
Problem
PR #3025 (for #705) adds the basic: NixOS host evaluation job to nix-ci.yml, but the job cannot actually gate a merge:
- Since PR ci: main-only workflow triggers, cancel-in-progress everywhere #2630 (Drew's 2026-10-30 order, commit 814c514),
nix-ci.ymlhas nopull_requesttrigger — CI runs onpushto main,merge_group, schedule, andworkflow_dispatchonly. - The merge-queue ruleset (
main: merge queue pilot, see.github/ci-policy.md) requires onlybasic: proxy port fallbacks. HEADGREEN grouping means a failinghost-evaljob on a merge-group head does not eject the group. - Net effect: a host-breaking change can still merge green;
host-evalwould only fail afterwards on the push-to-main run (wheremain-broken.yml+ci-fixat least catch it automatically — better than amd: KRdp remote desktop, declaratively (package + user service) #699's laptop-switch discovery, but not the pre-merge gate ci: no PR check evaluates a NixOS host — PR #699's broken amd service merged green and failed only on the laptop switch #705 asked for).
Evidence
.github/workflows/nix-ci.ymlon main:on:= push[main], merge_group, schedule, workflow_dispatch (verified 2026-10-31)..github/ci-policy.md§ "Merge queue": "The queue enforces the same required check as branch protection —basic: proxy port fallbacks".- PR ci(nix-ci): add PR-tier NixOS host evaluation job (#705) #3025 Codex review (P2, comment 4431469149) independently flagged the missing PR feedback; disposition recorded on that thread.
Acceptance criteria
-
basic: NixOS host evaluationis added to the required status checks enforced by themain: merge queue pilotruleset (and branch protection, if it diverges), OR a documented decision records that host-eval stays advisory with main-tier detection as the accepted control. -
.github/ci-policy.mdmerge-requirement section updated to match the outcome. - A merge-group run with a deliberately broken host config (e.g. fix(amd): quote KRdp service name so it is one systemd unit #701's quoting reverted) is shown to eject / block, if the required-check route is taken.
Filed by queue worker lane C from task 4048 / PR #3025 verification.
Metadata
Metadata
Assignees
Labels
area/ciCI/CD pipelines, workflows, and build automation (area)CI/CD pipelines, workflows, and build automation (area)kind/ciCI/CD pipelines, workflows, and build automationCI/CD pipelines, workflows, and build automationpriority/normalOrdinary priority (the default)Ordinary priority (the default)source/creatorFiled by the new-issue-creator jobFiled by the new-issue-creator jobtask/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this item
Activity
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
developing-today commentedon Nov 3, 2026
🤖 Agent note · picked up
developing-today commentedon Nov 3, 2026
🤖 Agent note · done (triage verdict: STILL LIVE in substance, premise SUPERSEDED — routed as a docs-decision fix)
Evidence (fresh, 2026-11-03, main
77f911fbfc5):basic: NixOS host evaluationjob exists in.github/workflows/nix-ci.yml(line 53) — the job itself landed.285e425b7(2026-11-02, "ci: no PR triggers — workflows run on main push, schedule, or manual dispatch only") removed themerge_group/pull_requesttriggers. On current mainnix-ci.ymlruns onpush[main],schedule, andworkflow_dispatchonly — host-eval does not run in the merge queue at all now, so it still cannot gate a merge, for a stronger reason than the one filed..github/ci-policy.md(§ Merge queue, lines 47–60) is stale against that policy: it still says the queue enforcesbasic: proxy port fallbacksand that "nix cialso runs onmerge_groupevents".gh api repos/developing-today/code/rulesetsandbranches/main/protectionreturn empty for the worker token, so the ruleset's current required-check list could not be read directly this run.Routing — follow-up queue task 8675 enqueued (small_fix, docs-only, dedupe
repo-health:v1:fix:developing-today/code:issue:3039): take acceptance route (b) — update.github/ci-policy.mdto record that host-eval stays advisory under the 2026-11-02 main-only CI policy, naming the accepted main-tier controls (host-eval on push-to-main; ci-fix dispatch on host-eval failure, commit43807e56f;main-broken.yml), and reconcile the merge-queue section with the current triggers; then close #3039 on that record.Explicitly NOT routed: acceptance route (a) — adding host-eval to the ruleset's required checks — reverses Drew's 2026-11-02 main-only CI order and needs repo-admin access this token lacks. That is a Drew decision, not a worker fix; if it is ever wanted, task 8675's worker escalates rather than implements.
This triage (task 8008) completes as triaged.
(Note: posted via the developing.today GitHub App — the user-token content-creation secondary rate limit is still active this shift.)