Repository navigation
Conversation
* src/system/profiles/hercules-ci.nix: Document host overrides for runtime Effect credentials.
* src/erythron/etc/sops.yaml: Store encrypted public cache upload credentials for Effects. * src/erythron/profiles/hercules-ci.nix: Load Effect credentials from SOPS and restart the agent when they change.
* src/magnolia/etc/sops.yaml: Store encrypted public cache upload credentials and the dedicated deployment SSH private key. * src/magnolia/profiles/hercules-ci.nix: Load Effect credentials from SOPS, restart the agent when they change and advertise the deploy system feature.
* src/root/user.nix: Authorize the dedicated Hercules deployment key with SSH forwarding and terminal access restricted.
* ci/deploy.nix: Add a deployment Effect that verifies GitHub approval for the current main revision, pins SSH host keys and preserves deploy-rs rollback. Require the deploy feature and refuse self-deployment. * flake.lock: Lock hercules-ci-effects and reuse the existing flake-parts and nixpkgs inputs. * flake.nix: Add hercules-ci-effects for deployment Effects.
* .github/workflows/ci.yml: Select affected targets, check PRs on hosted runners and request Hercules builds on main. Require separate host approvals, carry pending deployments forward and reject stale revisions. * ci/flake-module.nix: Expose host and user targets with dependency paths. Run checks and deployment Effects only for matching request tags, excluding magnolia from automatic deployments.
* ci/finish.nix: Request host approvals with fresh Effect credentials and remove completed build request tags. * ci/flake-module.nix: Route trusted branches and target tags to hierarchical Hercules checks and deployment Effects. * ci/plan.nix: Select affected targets, carry pending deployments forward and wait for builds without blocking on child Effects.
* .github/workflows/ci.yml: Accept Hercules deployment requests, verify host checks and require approval for each current main host. * ci/deploy.nix: Verify repository dispatch approvals and allow the approval job to finish before its deployment Effect starts.
brsvh
changed the title
* src/system/modules/github-interaction-limits.nix: Renew six-month collaborator restrictions for every configured repository each month. Load the token through systemd credentials and retry failed renewals without skipping other repositories.
* src/magnolia/profiles/github.nix: Enable renewal for brsvh/fleet and load its GitHub token from the existing host SOPS file.
* src/magnolia/etc/sops.yaml: Add the encrypted GitHub token used by the repository interaction restriction renewal service.
* src/magnolia/etc/sops.yaml: Add the required Secret kind to the encrypted deployment credential so the agent can parse its secrets.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fleet builds now run on Hercules for main and the develop branch used for pull requests. The planner selects checks from host, user and shared configuration changes; flake inputs and shared wiring still trigger every target. Check names follow the global, user and host hierarchy.
GitHub Actions only handles deployment approvals. After the selected builds succeed, each affected host gets its own approval request for the current main revision. Hercules then verifies that approval and deploys through an Effect. Undeployed changes carry forward, and superseded revisions are rejected.
Magnolia remains manually maintained. Its deployment capability and SSH credential keep deployment Effects on that agent while both agents remain enabled. Credentials stay in the existing SOPS files, the deployment public key is declared inline, and deploy-rs rollback remains enabled.