Skip to content

Fix #39455: Update nix-lockfile-fix.yml to stage nix/lib.nix - #41004

Closed
iamlukethedev wants to merge 1 commit into
NousResearch:mainfrom
iamlukethedev:fix/39455-nix-lockfile-staging
Closed

Fix #39455: Update nix-lockfile-fix.yml to stage nix/lib.nix#41004
iamlukethedev wants to merge 1 commit into
NousResearch:mainfrom
iamlukethedev:fix/39455-nix-lockfile-staging

Conversation

@iamlukethedev

Copy link
Copy Markdown
Contributor

Fixes #39455: The nix-lockfile-fix.yml workflow can never commit its hash update because it stages the pre-refactor per-package hash files (nix/tui.nix, nix/web.nix), but fix-lockfiles now writes the consolidated single hash in nix/lib.nix.

Problem

  • Workflow runs nix run .#fix-lockfiles (which edits nix/lib.nix)
  • Guard checks for unexpected modified files outside whitelist
  • Staging command adds nix/tui.nix and nix/web.nix
  • Result: Guard flags nix/lib.nix as unexpected → job errors, nothing is staged/committed
  • Net effect: nix-lockfile-fix cannot auto-heal, contributor PRs with stale npmDepsHash get stuck

Solution

Update both jobs (auto-fix-main and fix) to stage nix/lib.nix instead:

  • Line 80: Guard pattern ^nix/(tui|web)\.nix$^nix/lib\.nix$
  • Line 92: git add nix/tui.nix nix/web.nixgit add nix/lib.nix
  • Line 219: Same update in the fix job

Impact

  • ✅ nix-lockfile-fix can now auto-heal stale npmDepsHash on main
  • ✅ PR lockfile refresh jobs are no longer stuck on stale hashes
  • ✅ Security audits (e.g., React DoS) can be resolved automatically
  • ✅ Required nix check can pass on contributor PRs

This is a simple 3-line fix that restores the intended auto-fix workflow.

…nix (not tui/web)

Fixes NousResearch#39455: The nix-lockfile-fix.yml workflow can never commit its hash update
because it stages the pre-refactor per-package hash files (nix/tui.nix, nix/web.nix),
but fix-lockfiles now writes the consolidated single hash in nix/lib.nix.

PROBLEM:
- Workflow runs: nix run .#fix-lockfiles (which edits nix/lib.nix)
- Guard checks: git diff shows only nix/(tui|web).nix changes
- Result: guard flags nix/lib.nix as unexpected → job errors
- Staging: git add nix/tui.nix nix/web.nix stages nothing (files unchanged)
- Net: no commit, auto-fix fails, PRs with stale npmDepsHash get stuck

SOLUTION:
- Update both jobs (auto-fix-main and fix) to stage nix/lib.nix instead
- Update guard regex from '^nix/(tui|web)\.nix$' to '^nix/lib\.nix$'
- Now the guard passes and the file is actually committed

IMPACT:
- ✅ nix-lockfile-fix can now auto-heal stale npmDepsHash on main
- ✅ PR lockfile refresh jobs are no longer stuck
- ✅ Security audits blocking on React/npm issues can be resolved automatically
- ✅ Required nix check can pass on contributor PRs

Changes:
- Line 80: Updated unexpected files guard pattern
- Line 92: Changed git add to nix/lib.nix
- Line 219: Changed git add to nix/lib.nix

Fixes NousResearch#39455
@alt-glitch alt-glitch added type/bug Something isn't working area/nix Nix flake, NixOS module, container packaging P2 Medium — degraded but workaround exists labels Jun 7, 2026
@teknium1

Copy link
Copy Markdown
Contributor

Thanks for identifying the old staging mismatch. This is now superseded by a later Nix refactor.

Automated hermes-sweeper review found:

  • 3ca0ef7e3 replaced npmDepsHash with importNpmLock; current nix/lib.nix:21-25 makes package-lock.json the single source of truth, so there is no hash update for this workflow to stage.
  • 9eb0bcd60 deleted .github/workflows/nix-lockfile-fix.yml as part of removing the Nix CI flow.
  • The related temporary hash refresh in fix(nix): refresh npmDepsHash after the Electron 40.10.2 pin (#47792) #48457 predates the permanent hashless refactor.

Closing as implemented on main.

@teknium1 teknium1 closed this Jul 14, 2026
@teknium1 teknium1 added the sweeper:implemented-on-main Sweeper: behavior already present on current main label Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/nix Nix flake, NixOS module, container packaging P2 Medium — degraded but workaround exists sweeper:implemented-on-main Sweeper: behavior already present on current main type/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

nix-lockfile-fix.yml can never commit its hash update — stages nix/tui.nix + nix/web.nix, but fix-lockfiles writes nix/lib.nix

3 participants