fix: pin kernel to 6.12 and use nightly deno for build - #905
Conversation
Pin kernel to 6.12 for CrowdStrike Falcon compatibility (RFM on 6.19). Pull deno from nixpkgs-nightly to work around broken check phase in nixpkgs-unstable deno 2.6.10 (integration_tests vs integration_test).
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements crucial system stability and build process improvements. It ensures compatibility with security software by pinning the Linux kernel to a specific version and resolves a critical build failure for the Deno runtime by sourcing it from a more up-to-date nightly channel. These changes collectively enhance the system's reliability and development environment consistency. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
📝 WalkthroughSummary by CodeRabbit
WalkthroughPin kernelPackages to Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR addresses two operational issues on the matic host: pinning the Linux kernel to version 6.12 to maintain CrowdStrike Falcon compatibility and working around a broken deno package in nixpkgs-unstable.
Changes:
- Pin Linux kernel to 6.12 on the matic host to prevent CrowdStrike Falcon from entering Reduced Functionality Mode on kernel 6.19
- Override deno package to use nixpkgs-nightly version to avoid broken check phase in deno 2.6.10 from nixpkgs-unstable
- Update nixpkgs-nightly flake lock to a newer commit containing the deno fix
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| overlays/default.nix | Adds deno package override to pull from nixpkgs-nightly, following the established pattern for codex, claude-code, and opencode |
| named-hosts/matic/default.nix | Changes kernel from latest to 6.12 with explanatory comment about CrowdStrike Falcon compatibility |
| flake.lock | Updates nixpkgs-nightly lock to newer commit (Feb 24, 2026) containing the deno fix |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
The pull request successfully addresses two main issues: a build failure in Deno 2.6.10 on nixpkgs-unstable and a compatibility issue between the latest Linux kernels and CrowdStrike Falcon. By pinning the kernel to 6.12 (LTS) for the matic host and pulling Deno from the nightly (master) branch, the build and system stability are restored. I have one minor suggestion regarding the documentation of the kernel pin to ensure clarity for future maintenance.
| # Pin kernel to 6.12 for CrowdStrike Falcon compatibility (RFM on 6.19) | ||
| boot.kernelPackages = pkgs.linuxPackages_6_12; |
There was a problem hiding this comment.
There appears to be a typo in the comment mentioning kernel version 6.19, as the current mainline kernel is 6.13. It's likely you meant 6.13 or 6.11. Additionally, the previous comment about AMD AI 300 support was removed; it's helpful to retain that context so future maintainers know that 6.12 is the minimum required version for this hardware.
# Pin kernel to 6.12 for CrowdStrike Falcon compatibility (RFM on 6.13+)
# Also maintains support for AMD AI 300
boot.kernelPackages = pkgs.linuxPackages_6_12;
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
named-hosts/matic/default.nix (1)
17-19:⚠️ Potential issue | 🟡 MinorComment is misleading about eval mode requirements — update to document
--impuredependencyThe Makefile already passes
--impureviaNIX_FLAGS, so the flake evaluation will not hard-error. However, the inline comment at line 18 is misleading: saying "In CI, this will be false" omits the critical detail thatbuiltins.pathExistson an absolute path requires--impureto work at all. In pure eval mode (flakes default), it would error before returningfalse.Update the comment to clarify that this check depends on impure evaluation, e.g.:
"With --impure enabled, returns true if the .deb exists; false otherwise."This documents why the code works despite using an absolute path.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@named-hosts/matic/default.nix` around lines 17 - 19, Update the misleading inline comment for the falconDebExists definition: clarify that builtins.pathExists on an absolute path requires impure evaluation (e.g. --impure) so the expression will error in pure flake eval but, with --impure enabled (as NIX_FLAGS in the Makefile supplies), it returns true if /etc/nixos/falcon-sensor.deb exists and false otherwise; reference the falconDebExists binding and the builtins.pathExists call when making this comment change.
🧹 Nitpick comments (1)
overlays/default.nix (1)
41-43: Consider linking the upstream nixpkgs fix so this override can be removed when it lands.The workaround is correct and the comment is helpful. Without a pointer to the upstream nixpkgs issue or PR that fixes the
integration_tests→integration_testrename, it will be easy to forget to revert once nixpkgs-unstable picks up the corrected derivation.✏️ Suggested comment update
- # deno 2.6.10 on nixpkgs-unstable has broken check phase (integration_tests vs integration_test) - # Use nightly (master) which has the fix and is in the binary cache + # TODO: revert once nixpkgs-unstable cuts a deno release past 2.6.10 + # deno 2.6.10 check phase is broken: test target renamed integration_tests → integration_test + # Track: https://github.com/NixOS/nixpkgs/issues/<issue-number> + # Using nightly (master) which has the fix and is available in the binary cache deno = final.nightlyPkgs.deno;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@overlays/default.nix` around lines 41 - 43, Add a link to the upstream nixpkgs issue or PR that fixes the integration_tests → integration_test rename and note the condition to remove the override; specifically update the comment near the deno override (the line "deno = final.nightlyPkgs.deno;") to reference the nixpkgs issue/PR URL (or ticket number) and state that the override should be removed once that PR lands into nixpkgs-unstable (or include the merge commit/PR number) so future maintainers know when to revert the workaround.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@named-hosts/matic/default.nix`:
- Around line 17-19: Update the misleading inline comment for the
falconDebExists definition: clarify that builtins.pathExists on an absolute path
requires impure evaluation (e.g. --impure) so the expression will error in pure
flake eval but, with --impure enabled (as NIX_FLAGS in the Makefile supplies),
it returns true if /etc/nixos/falcon-sensor.deb exists and false otherwise;
reference the falconDebExists binding and the builtins.pathExists call when
making this comment change.
---
Nitpick comments:
In `@overlays/default.nix`:
- Around line 41-43: Add a link to the upstream nixpkgs issue or PR that fixes
the integration_tests → integration_test rename and note the condition to remove
the override; specifically update the comment near the deno override (the line
"deno = final.nightlyPkgs.deno;") to reference the nixpkgs issue/PR URL (or
ticket number) and state that the override should be removed once that PR lands
into nixpkgs-unstable (or include the merge commit/PR number) so future
maintainers know when to revert the workaround.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
flake.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
named-hosts/matic/default.nixoverlays/default.nix
Mesa DescriptionTL;DRPinned the What changed?
Description generated by Mesa. Update settings |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="named-hosts/matic/default.nix">
<violation number="1" location="named-hosts/matic/default.nix:46">
P1: Kernel version in code (6.18) contradicts PR description and title (6.12).</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@named-hosts/matic/default.nix`:
- Around line 46-47: The PR title/description incorrectly state kernel 6.12
while the code/comment and intent use 6.18; update the PR title and description
to reference "pin kernel to 6.18" (and mention AMD AI 300 display / CrowdStrike
Falcon compatibility as appropriate) so they match the actual change where
boot.kernelPackages is set to pkgs.linuxPackages_6_18 and the inline comment
references 6.18/RFM on 6.19.
- Around line 46-47: The pin to boot.kernelPackages = pkgs.linuxPackages_6_18
may deploy a kernel missing the MT7925E driver and break WiFi (this host uses
options mt7925e disable_aspm=1); update the config to either ensure the nixpkgs
lock references a 6.18 patch that contains CONFIG_MT7925E (e.g., 6.18.2), or
change boot.kernelPackages to a confirmed-working kernel (e.g.,
linuxPackages_6_17 or linuxPackages_latest), or add a comment and gating check
to verify the kernel patch version before merging so the mt7925e driver is
present.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
named-hosts/matic/default.nix
Summary
integration_testsvsintegration_test)Test plan
make buildsucceeds (deno fetched from binary cache, no source compile)make switchapplies successfullySummary by cubic
Pinned matic to Linux kernel 6.18 to avoid CrowdStrike Falcon RFM and support AMD AI 300 display. Switched Deno to nixpkgs-nightly to fix the 2.6.10 check phase and keep using cached binaries; resolved flake.lock merge from main.
Written for commit 006e324. Summary will update on new commits.