fix(ci): free more disk space and add nix fallback for cache mismatches - #1929
Conversation
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
Disabled knowledge base sources:
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe PR expands the "Free Disk Space (Ubuntu)" GitHub Actions step in both ChangesCI Disk Cleanup and Nix Fallback
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures Nix to use the fallback option by default in both the Dockerfile and the Makefile. The reviewer points out that enabling --fallback globally in the Makefile can cause long build times in local development environments if the binary cache is unreachable, and suggests enabling it conditionally only in CI or Docker environments.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| fi) | ||
| NIX_ENV := $(shell . ~/.nix-profile/etc/profile.d/nix.sh 2>/dev/null || . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh 2>/dev/null || command -v nix >/dev/null 2>&1 || echo "not_found") | ||
| NIX_FLAGS := --extra-experimental-features 'flakes nix-command' --no-pure-eval --impure | ||
| NIX_FLAGS := --extra-experimental-features 'flakes nix-command' --no-pure-eval --impure --fallback |
There was a problem hiding this comment.
Adding --fallback globally to NIX_FLAGS affects local development environments. If a binary cache is temporarily unreachable or returns a hash mismatch locally, Nix will silently fall back to building packages from source. For large packages, this can cause extremely long build times and high resource consumption on developer machines.
It is safer to enable --fallback only in CI or Docker environments where automated builds need to be resilient to transient cache issues.
NIX_FLAGS := --extra-experimental-features 'flakes nix-command' --no-pure-eval --impure
ifneq ($(filter true,$(CI) $(IN_DOCKER)),)
NIX_FLAGS += --fallback
endif
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
| dotnet: true | ||
| haskell: true | ||
| large-packages: true | ||
| swap-storage: true |
There was a problem hiding this comment.
Removing swap increases OOM risk under the new fallback behavior: swap-storage: true deletes the runner's swap file. Combined with the new fallback = true (in e2e.yml extra_nix_config, Dockerfile nix.conf, and --fallback in the Makefile), heavyweight derivations that would previously be fetched from a substituter may now build from source and spike RSS. Without swap, a memory spike turns directly into an OOM kill — especially on the arm64 builder (ubuntu-24.04-arm) which has less headroom than ubuntu-latest. Note this matches the previous default (swap-storage defaults to true in this action), so the explicit value isn't a behavior change on its own — it's only worth surfacing because the fallback change makes from-source builds materially more common.
| echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf && \ | ||
| echo "filter-syscalls = false" >> /etc/nix/nix.conf && \ | ||
| echo "sandbox = true" >> /etc/nix/nix.conf && \ | ||
| echo "fallback = true" >> /etc/nix/nix.conf && \ |
There was a problem hiding this comment.
Image-level fallback affects downstream consumers: Adding fallback = true to /etc/nix/nix.conf persists into the published ghcr.io/.../dotfiles image, so any user who runs nix build/nix run inside the image inherits this behavior. Where they previously got an immediate error on a substituter miss (the upstream default), they will now silently build from source — potentially long jobs for things like Rust toolchains or Chromium. If the intent is only to harden CI for this repo, consider scoping the change to Makefile + the e2e workflow and leaving the image's nix.conf at defaults; if the broader behavior is intended, calling it out in the image docs would save downstream debugging.
| fi) | ||
| NIX_ENV := $(shell . ~/.nix-profile/etc/profile.d/nix.sh 2>/dev/null || . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh 2>/dev/null || command -v nix >/dev/null 2>&1 || echo "not_found") | ||
| NIX_FLAGS := --extra-experimental-features 'flakes nix-command' --no-pure-eval --impure | ||
| NIX_FLAGS := --extra-experimental-features 'flakes nix-command' --no-pure-eval --impure --fallback |
There was a problem hiding this comment.
--fallback is now applied to local dev runs too: Unlike the workflow- and image-scoped changes, this flag is global to every $(NIX_FLAGS) invocation, including a developer running make on their laptop. If a substituter is temporarily unreachable or returns a hash mismatch, Nix will silently start a from-source build (e.g., rustc, GHC, Chromium) rather than erroring — producing long, surprising builds. The conditional substituter block immediately below (ifeq ($(OS),Darwin) / else ifdef CI etc.) already demonstrates the pattern for gating; one option:
NIX_FLAGS := --extra-experimental-features 'flakes nix-command' --no-pure-eval --impure
ifneq ($(filter true,$(CI) $(IN_DOCKER)),)
NIX_FLAGS += --fallback
endifThis keeps the CI-resilience benefit while preserving fast-failure semantics locally.
1 participant
Summary
tool-cache: trueand explicit category flags infree-disk-spaceaction for both E2E and Docker workflows to reclaim ~5GB additional disk space (fixesNo space left on deviceduring nix build on Ubuntu)--fallbacktoNIX_FLAGSin Makefile andfallback = trueto nix.conf in Dockerfile and E2E workflow, so nix builds from source when binary cache returns hash mismatches (fixes arm64 Docker build failure:hash mismatch importing path .../cyrus-sasl-2.1.28-dev)Test plan
🤖 Generated with Claude Code
Summary by cubic
Free up more disk space on Linux runners and add Nix fallback to fix CI build failures. This prevents “No space left on device” and handles cache hash mismatches, stabilizing E2E and Docker builds (including
linux/arm64).tool-cache: trueand explicit categories injlumbroso/free-disk-space@v1.3.1to reclaim ~5 GB.fallback = truein nix.conf (Dockerfile and E2E) and add--fallbacktoNIX_FLAGSin the Makefile so builds continue from source on cache mismatches.Written for commit 0bd05d8. Summary will update on new commits.