Skip to content

Revert "fix(atuin): record failed commands in history" #1608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
Apr 28, 2026
Merged

Revert "fix(atuin): record failed commands in history" #1608

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 0 additions & 9 deletions .dockerignore
View file
Open in desktop

This file was deleted.

15 changes: 4 additions & 11 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,28 +72,21 @@ jobs:
context: .
file: ./Dockerfile
platforms: ${{ matrix.build.platform }}
push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
push: true
tags: ${{ steps.metadata.outputs.tags }}
labels: ${{ steps.metadata.outputs.labels }}
build-args: |
COMMIT_SHA=${{ github.sha }}
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
GITHUB_PR=${{ github.event.pull_request.number }}
secrets: |
github_token=${{ secrets.GITHUB_TOKEN }}
cache-from: |
type=gha,scope=dotfiles-docker-${{ matrix.build.arch }}
type=registry,ref=${{ env.REGISTRY_IMAGE }}:buildcache-${{ matrix.build.arch }}
cache-to: |
type=gha,scope=dotfiles-docker-${{ matrix.build.arch }},mode=max
${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && format('type=registry,ref={0}:buildcache-{1},mode=max', env.REGISTRY_IMAGE, matrix.build.arch) || '' }}
cache-from: type=registry,ref=${{ env.REGISTRY_IMAGE }}:buildcache-${{ matrix.build.arch }}
cache-to: type=registry,ref=${{ env.REGISTRY_IMAGE }}:buildcache-${{ matrix.build.arch }},mode=max
- name: Export digest
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
run: |
mkdir -p ${{ runner.temp }}/digests
digest="${{ steps.build.outputs.digest }}"
touch "${{ runner.temp }}/digests/${digest#sha256:}"
- name: Upload digest
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
uses: actions/upload-artifact@v7
with:
name: digests-${{ matrix.build.arch }}
Expand Down
31 changes: 10 additions & 21 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
# syntax=docker/dockerfile:1.7

FROM ubuntu:26.04

# Set DEBIAN_FRONTEND to noninteractive to avoid prompts during package installations
Expand Down Expand Up @@ -29,6 +27,10 @@
ARG USER=runner
ARG USER_UID=1001
ARG USER_GID=$USER_UID
ARG COMMIT_SHA=main
ARG GITHUB_TOKEN

Check warning on line 31 in Dockerfile

View workflow job for this annotation

GitHub Actions / docker-build-push (linux/amd64, amd64, ubuntu-latest)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "GITHUB_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 31 in Dockerfile

View workflow job for this annotation

GitHub Actions / docker-build-push (linux/arm64, arm64, ubuntu-24.04-arm)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "GITHUB_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ARG GITHUB_PR
ENV GITHUB_PR=${GITHUB_PR}

RUN set -e; \
groupadd --gid $USER_GID $USER; \
Expand All @@ -47,30 +49,17 @@
echo "trusted-users = root $USER" > /etc/nix/nix.conf && \
echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf && \
echo "filter-syscalls = false" >> /etc/nix/nix.conf && \
echo "sandbox = true" >> /etc/nix/nix.conf

COPY --chown=$USER:$USER Makefile flake.nix flake.lock /tmp/dotfiles-cache/
COPY --chown=$USER:$USER lib /tmp/dotfiles-cache/lib
COPY --chown=$USER:$USER scripts/nix-cache-warmup.sh /tmp/dotfiles-cache/scripts/nix-cache-warmup.sh

RUN --mount=type=secret,id=github_token,mode=0444 \
set -e; \
/usr/bin/nix-daemon & \
sleep 5 && \
sudo -u "$USER" -H env GITHUB_TOKEN_FILE=/run/secrets/github_token IN_DOCKER=true USER="$USER" \
make -C /tmp/dotfiles-cache nix-cache-warmup

ARG COMMIT_SHA=main
ARG GITHUB_PR=
echo "sandbox = true" >> /etc/nix/nix.conf && \
if [ -n "$GITHUB_TOKEN" ]; then \
echo "access-tokens = github.com=$GITHUB_TOKEN" >> /etc/nix/nix.conf ; \
fi
Comment on lines +53 to +55

@gemini-code-assist gemini-code-assist Bot Apr 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Writing the GITHUB_TOKEN directly into /etc/nix/nix.conf within a RUN command persists the sensitive token in the image's filesystem and layer history. This is a security risk as the token can be extracted by anyone with access to the image. It is highly recommended to use Docker secrets (--mount=type=secret) to provide the token only during the build process without storing it in the final image.


RUN --mount=type=secret,id=github_token,mode=0444 \
set -e; \
/usr/bin/nix-daemon & \
RUN /usr/bin/nix-daemon & \
sleep 5 && \
# Run your dotfiles installation script.
# This script is expected to install fish and other tools.
# Make sure this script is idempotent or handles being run in a fresh environment.
sudo -u "$USER" -H env GITHUB_PR="$GITHUB_PR" GITHUB_TOKEN_FILE=/run/secrets/github_token IN_DOCKER=true USER="$USER" bash -c "curl -fsSL https://raw.githubusercontent.com/shunkakinoki/dotfiles/$COMMIT_SHA/install.sh | bash"
sudo -u $USER -E -H bash -c "curl -fsSL https://raw.githubusercontent.com/shunkakinoki/dotfiles/$COMMIT_SHA/install.sh | bash"
Comment on lines +57 to +62

@gemini-code-assist gemini-code-assist Bot Apr 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The set -e instruction was removed from this RUN block. It is best practice to include it to ensure the build fails immediately if any command in the sequence (such as the curl or bash execution) fails. Additionally, quoting $USER is recommended to prevent shell expansion issues if the username contains special characters or spaces.

RUN set -e; \
    /usr/bin/nix-daemon & \
    sleep 5 && \
    # Run your dotfiles installation script.
    # This script is expected to install fish and other tools.
    # Make sure this script is idempotent or handles being run in a fresh environment.
    sudo -u "$USER" -E -H bash -c "curl -fsSL https://raw.githubusercontent.com/shunkakinoki/dotfiles/$COMMIT_SHA/install.sh | bash"


# Switch to the non-root user
USER $USER
Expand Down
16 changes: 3 additions & 13 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@ ARCH := $(shell uname -m)
OS := $(shell uname -s)

# Git variables
GIT_REMOTE_ORIGIN_URL := $(shell git config --get remote.origin.url 2>/dev/null)
GIT_REMOTE_ORIGIN_URL := $(shell git config --get remote.origin.url)
GITHUB_REPO_PATH := $(shell echo $(GIT_REMOTE_ORIGIN_URL) | sed -n 's/.*github.com[:/]\(.*\)\.git/\1/p')
GITHUB_REPO_OWNER := $(shell echo $(GITHUB_REPO_PATH) | cut -d'/' -f1)
GITHUB_REPO_NAME := $(shell echo $(GITHUB_REPO_PATH) | cut -d'/' -f2)
GIT_COMMIT_SHA := $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
GIT_COMMIT_SHA := $(shell git rev-parse --short HEAD)
Comment on lines +15 to +19

@gemini-code-assist gemini-code-assist Bot Apr 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Removing the error suppression (2>/dev/null) and the fallback value for GIT_COMMIT_SHA makes the Makefile less robust. In environments where git is not initialized or available, these commands will emit error messages to stderr on every make invocation, which can clutter output and potentially break scripts parsing the output.

GIT_REMOTE_ORIGIN_URL := $(shell git config --get remote.origin.url 2>/dev/null)
GITHUB_REPO_PATH := $(shell echo $(GIT_REMOTE_ORIGIN_URL) | sed -n 's/.*github.com[:/]\(.*\)\.git/\1/p')
GITHUB_REPO_OWNER := $(shell echo $(GITHUB_REPO_PATH) | cut -d'/' -f1)
GITHUB_REPO_NAME := $(shell echo $(GITHUB_REPO_PATH) | cut -d'/' -f2)
GIT_COMMIT_SHA := $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)


# Env ironment variables
NIX_ALLOW_UNFREE := NIXPKGS_ALLOW_UNFREE=1
Expand Down Expand Up @@ -151,7 +151,7 @@ help: ## Show this help message.
##@ General

.PHONY: install
install: setup git-submodule-sync nix-cache-warmup nix-build nix-switch shell-install ## Set up full environment (setup, cache warmup, build, switch, shell-install).
install: setup git-submodule-sync nix-build nix-switch shell-install ## Set up full environment (setup, flake-update, build, switch, shell-install).

@gemini-code-assist gemini-code-assist Bot Apr 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The help description for the install target mentions flake-update, but the nix-flake-update target is not included in the prerequisites list. The description should be updated to accurately reflect the actions performed by the target.

install: setup git-submodule-sync nix-build nix-switch shell-install ## Set up full environment (setup, submodule-sync, build, switch, shell-install).


.PHONY: build
build: nix-build ## Build Nix configuration.
Expand Down Expand Up @@ -432,16 +432,6 @@ nix-install: ## Install Nix if not already installed.
fi
@echo "✅ Nix environment installed!"

.PHONY: nix-cache-warmup
nix-cache-warmup: nix-connect nix-trust ## Warm flake input metadata before build/switch.
@echo "🔥 Warming Nix flake cache..."
@if command -v nix >/dev/null 2>&1; then \
$(NIX_ALLOW_UNFREE) sh ./scripts/nix-cache-warmup.sh . $(NIX_FLAGS); \
echo "✅ Nix flake cache warmed"; \
else \
echo "⚠️ Nix unavailable; skipping cache warmup"; \
fi

##@ Nix

.PHONY: nix-update
Expand Down
3 changes: 0 additions & 3 deletions home-manager/programs/atuin/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,6 @@
sync_address = "https://api.atuin.sh";
search_mode = "fuzzy";
filter_mode = "global";
history = {
exit_code = "all";
};
sync = {
records = true;
};
Expand Down
19 changes: 0 additions & 19 deletions install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,25 +38,6 @@ else
echo "USER variable is already set to: $USER. Ensuring it is exported."
fi

NIX_GITHUB_TOKEN=""
if [ -n "${GITHUB_TOKEN:-}" ]; then
NIX_GITHUB_TOKEN="$GITHUB_TOKEN"
elif [ -n "${GITHUB_TOKEN_FILE:-}" ] && [ -r "$GITHUB_TOKEN_FILE" ]; then
NIX_GITHUB_TOKEN=$(cat "$GITHUB_TOKEN_FILE")
fi

if [ -n "$NIX_GITHUB_TOKEN" ]; then
if [ -n "${NIX_CONFIG:-}" ]; then
NIX_CONFIG="${NIX_CONFIG}
access-tokens = github.com=$NIX_GITHUB_TOKEN"
else
NIX_CONFIG="access-tokens = github.com=$NIX_GITHUB_TOKEN"
fi
export NIX_CONFIG
echo "Configured a GitHub token for Nix fetches during this install."
fi
unset NIX_GITHUB_TOKEN

# Install Nix if not already installed
if ! command -v nix >/dev/null 2>&1; then
echo "Installing Nix..."
Expand Down
33 changes: 0 additions & 33 deletions scripts/nix-cache-warmup.sh
View file
Open in desktop

This file was deleted.

5 changes: 0 additions & 5 deletions spec/coverage_spec.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,10 +117,6 @@ It 'has spec file for named-hosts/kyber/setup.sh'
The path "spec/kyber_setup_spec.sh" should be exist
End

It 'has spec file for scripts/nix-cache-warmup.sh'
The path "spec/nix_cache_warmup_spec.sh" should be exist
End

It 'has spec file for scripts/update-gitalias.sh'
The path "spec/update_gitalias_spec.sh" should be exist
End
Expand Down Expand Up @@ -443,7 +439,6 @@ scripts/check-nix-inline-scripts.sh
scripts/find-built-iso.sh
scripts/fishtape-wrapper.sh
scripts/llm-update.sh
scripts/nix-cache-warmup.sh
scripts/sync-codex-security.sh
scripts/sync-rtk-rewrite.sh
scripts/update-gitalias.sh
Expand Down
72 changes: 0 additions & 72 deletions spec/nix_cache_warmup_spec.sh
View file
Open in desktop

This file was deleted.

Loading