ci: Convert GHA workflows to Woodpecker CI pipelines - #546
Open
DaRacci wants to merge 28 commits into
Open
Conversation
Contributor
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis change migrates CI workflows to Woodpecker, adds shared Nix/Nushell tooling, introduces isolated Nix storage for Woodpecker agents, builds a new Lix container image, and documents the resulting service and testing workflows. ChangesShared tooling and CI applications
NixOS service and documentation
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Woodpecker as Woodpecker pipeline
participant Detector as detect-affected-outputs/discover-packages
participant Attic as setup-attic
participant Nix as nix-fast-build
participant Vulnix as vulnix
Woodpecker->>Detector: Check changed host, home, or package
Detector-->>Woodpecker: Return affected targets
Woodpecker->>Attic: Authenticate and optionally watch cache
Woodpecker->>Nix: Build selected target with Attic cache
Nix-->>Woodpecker: Write result link
Woodpecker->>Vulnix: Scan host result when present
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Merge ProtectionsYour pull request matches the following merge protections and will not be merged until they are valid. 🟢 📃 Configuration Change RequirementsWonderful, this rule succeeded.Mergify configuration change
🟢 Enforce conventional commitWonderful, this rule succeeded.Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 Do not merge outdated PRsWonderful, this rule succeeded.Make sure PRs are almost up to date before merging
|
Contributor
🧪 CI InsightsHere's what we observed from your CI run for a0a3211. 🟢 All jobs passed!But CI Insights is watching 👀 |
There was a problem hiding this comment.
Pull request overview
Converts CI execution from GitHub Actions workflows to Woodpecker pipelines and adds supporting Nushell/Nix utilities for affected-output and package discovery/build automation.
Changes:
- Added Woodpecker pipelines for flake checks, output builds, package builds, and automated package updates.
- Introduced shared Nushell library helpers and flake-change detection utilities used by CI scripts.
- Updated Nix packaging helper to bundle Nushell libs and adjust runtime inputs for CI scripting.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| lib/package.nix | Extends Nu app builder to vendor sources/libs into the store and copy lib/*.nu during build. |
| lib/nu-lib/lib.nu | Adds reusable Nushell utilities (logging setup and required env var checks). |
| flake/dev/scripts/lib/flake.nu | Adds helpers to read flake lock inputs and detect changed files across a git range. |
| flake/dev/scripts/lib | Points dev scripts at the shared lib/nu-lib module directory. |
| flake/dev/scripts/default.nix | Wires dev scripts to the shared Nu lib source. |
| flake/ci/scripts/setup-attic.nu | Adds CI helper script to login to Attic and optionally watch the store. |
| flake/ci/scripts/lib | Adds a lib pointer for CI scripts (currently absolute). |
| flake/ci/scripts/eval.nix | Adds Nix helper to locate package source positions for package discovery. |
| flake/ci/scripts/discover-packages.nu | Adds CI script to list/filter packages and detect which changed in a git range. |
| flake/ci/scripts/default.nix | Exposes new CI scripts and wires them to the shared Nu lib source. |
| .woodpecker/update-packages.yaml | Adds Woodpecker cron/manual pipeline to run nix-update and open PRs. |
| .woodpecker/packages.yaml | Adds Woodpecker matrix pipeline to build packages with basic “affected” skipping. |
| .woodpecker/ci.yaml | Adds Woodpecker pipelines to build only affected NixOS/Home-Manager outputs plus treefmt checks. |
| .github/workflows/update-packages.yaml | Disables the GHA schedule trigger (migration to Woodpecker). |
| .github/workflows/packages.yaml | Disables the GHA PR/push triggers (migration to Woodpecker). |
Comments suppressed due to low confidence (1)
flake/ci/scripts/lib:1
- This looks like a symlink target committed as an absolute path. In CI and for other contributors,
/persist/nix-config/...likely won’t exist, breakinguse lib/...imports. Prefer a repo-relative symlink/loader path (as inflake/dev/scripts/lib) so the checkout is self-contained.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
DaRacci
force-pushed
the
push-ssqumvutkzmu
branch
from
March 18, 2026 13:32
67ce93c to
a0a3211
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 29
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/update-packages.yaml:
- Around line 4-5: The scheduled cron trigger was commented out leaving no
automated updates; add a clear comment next to the disabled schedule explaining
that the cron is migrated to Woodpecker and requires creating a cron job named
"update-packages" in the Woodpecker UI (or document this migration in the repo
README/migration guide) so reviewers/operators know automated updates remain
disabled until that manual UI step is performed.
In @.opencode/agent/test.md:
- Line 129: Fix the typo in the README line by replacing the incorrect command
string "detect-affecteded-outputs" with the correct "detect-affected-outputs" in
the .opencode/agent/test.md content; search for the exact token
"detect-affecteded-outputs" and update it to "detect-affected-outputs" so the
displayed command name matches the actual module output.
In @.woodpecker/checks.yaml:
- Line 131: Update the error message string in the echo command that currently
reads "Missing packages in packages.yaml: $${MISSING_PACKAGES[@]}" to reference
the correct filename "ci-packages.yaml" instead, i.e., modify the echo
invocation that mentions the MISSING_PACKAGES array so it prints "Missing
packages in ci-packages.yaml: $${MISSING_PACKAGES[@]}".
- Line 169: The grep pattern in the if clause (the line using echo
"$CHANGED_FILES" | grep -E 'ci-(hosts|homes|packages|update-packages)\.yaml' >
/dev/null; then) doesn't match the actual filename update-packages.yaml; update
the regex to explicitly allow either the ci- prefixed files or the standalone
update-packages.yaml, e.g. replace the pattern with one that matches
(ci-(hosts|homes|packages)\.yaml|update-packages\.yaml) so changes to
update-packages.yaml are detected.
- Around line 68-154: The four matrix validation jobs (matrix-ci-hosts.yaml,
matrix-ci-homes.yaml, matrix-packages.yaml, matrix-update-packages.yaml) behave
inconsistently on mismatches (some auto-fix, some exit, some only echo); pick a
single policy and apply it to all jobs: either (A) auto-fix by updating the YAML
with yq and git add the file (mirror the behavior in matrix-ci-hosts.yaml) for
matrix-ci-homes.yaml, matrix-packages.yaml and matrix-update-packages.yaml, or
(B) fail fast by echoing the missing items and exit 1 for the auto-fixing jobs
(matrix-ci-hosts.yaml and matrix-update-packages.yaml); also fix the obvious
loop typo in matrix-update-packages.yaml (the for package in
"$${ALL_PACKAGES}[@]}"; do should iterate over "$${ALL_PACKAGES[@]}") so the
consistency change applies correctly.
- Line 145: The for-loop in .woodpecker/checks.yaml uses a malformed expansion
of the ALL_PACKAGES array (the extra closing brace in the expression used to
iterate causes a bash syntax error); fix the loop that iterates the ALL_PACKAGES
variable by removing the stray brace and using a proper, quoted array expansion
of ALL_PACKAGES so the loop iterates elements correctly.
- Line 171: Update the git add invocation that currently lists
".woodpecker/packages.yaml" to reference the correct file name
".woodpecker/ci-packages.yaml" so the command becomes: git add
.woodpecker/ci-hosts.yaml .woodpecker/ci-homes.yaml .woodpecker/ci-packages.yaml
.woodpecker/update-packages.yaml; modify the line containing that git add
command in the checks.yaml where it's currently written.
- Around line 118-119: Update the MATRIX_PACKAGES and ALL_PACKAGES assignments:
change the filename reference used by MATRIX_PACKAGES from
".woodpecker/packages.yaml" to the correct ".woodpecker/ci-packages.yaml", and
fix the flake attribute path used by ALL_PACKAGES from ".#package.x86_64-linux"
to ".#packages.x86_64-linux" so the commands that populate MATRIX_PACKAGES and
ALL_PACKAGES (the variables named MATRIX_PACKAGES and ALL_PACKAGES in the diff)
point to the correct file and flake attribute.
- Line 142: The ALL_PACKAGES line uses an invalid Nix expression (calling a
non‑existent `filter` in `--apply`) and must be replaced with a valid approach:
either change the nix eval --apply expression to a proper Nix filter that
operates on attributes (e.g., use builtins.attrValues and builtins.filter to
select items with passtru.update-script) or keep the existing plain eval to list
package names and perform the passtru.update-script check in the shell loop
(like the existing passtru.discovery check at line 124); update the command
building ALL_PACKAGES and the downstream loop to use whichever approach you
choose so that packages are actually filtered by passtru.update-script without
using a non‑builtin `filter`.
In @.woodpecker/ci-homes.yaml:
- Around line 49-50: The workflow's build step currently relies on a when.path
check against a marker file created by the decide-${HOME} step, but Woodpecker
evaluates path conditions from the SCM diff and won't see .do-build; change the
build step to always run and move the .do-build presence check into its
commands: at the start of the build step's commands section (the step that
previously used when.path) add a shell conditional that exits early if .do-build
does not exist (e.g., test -f .do-build || exit 0) so the step is skipped at
runtime when the marker is absent; ensure decide-${HOME} still creates .do-build
when needed.
In @.woodpecker/ci-hosts.yaml:
- Around line 56-57: The pipeline uses when.path: .do-build to gate
build-${HOST}, but .do-build is created at runtime by decide-${HOST} so the path
filter never matches; remove the when.path: .do-build from the build-${HOST}
step and instead rely on depends_on: ["decide-${HOST}"] (or pass an env
var/artifact from decide-${HOST} like SHOULD_BUILD) so the build step runs only
after the decision and can check the runtime flag; apply the same change for the
other matching step(s) that reference .do-build and when.path.
In @.woodpecker/ci-packages.yaml:
- Around line 73-74: The decision step currently creates a runtime marker file
`.do-build` which Woodpecker's when.path cannot see (it evaluates the git
changeset at trigger time), so the build step will still run; instead, change
the decision step to exit with a non-zero code when SHOULD_BUILD is false (or
exit 0 when true) and update the build step to use when.exit_status to gate
execution (e.g., run the decision step script that checks the env var and `exit
1` when not building, and set the build step to run only when the prior step
exit_status is 0); apply the same change for the other instance that touches
`.do-build` on lines 81–82 so both decision steps use process exit codes and
when.exit_status gating rather than creating `.do-build`.
In @.woodpecker/lix.yaml:
- Line 71: The publish-step image reference "image:
registry.racci.dev/lix-woodpecker" uses an implicit latest tag; update it to an
explicit tag or digest (e.g., registry.racci.dev/lix-woodpecker:<version> or
`@sha256`:...) to match the explicit tagging used elsewhere (see the other image
reference) so builds are reproducible and predictable.
- Line 15: Update the bare image reference under the image key in
.woodpecker/lix.yaml to include an explicit tag or immutable digest for
reproducibility; replace "image: registry.racci.dev/lix-woodpecker" with a
pinned form like "image: registry.racci.dev/lix-woodpecker:<tag>" or the digest
form "image: registry.racci.dev/lix-woodpecker@sha256:<digest>" so the CI uses a
fixed version instead of relying on the implicit :latest.
In @.woodpecker/update-packages.yaml:
- Around line 48-49: The current use of when.path: .push won't gate manual or
cron runs because path filters only apply to push/pull_request and on_empty:
true makes the condition always pass for manual/cron; replace the path-based
gate with an explicit event or input-based check (e.g., use when.event to
restrict to push events or add a manual input/environment variable like
INPUT_RUN and check it with an if/when condition) or split into a separate
workflow for cron/manual; update occurrences of when.path and references to
.push and remove reliance on on_empty for these runs.
- Around line 20-21: The workflow fails because io-guardian-client and
io-guardian-server are included in the matrix but lack passthru.updateScript
required by the --use-update-script flag; either add a passthru.updateScript to
both packages following the same pattern used by other packages (e.g., set
passthru.updateScript to the nix-update-script invocation used by
alvr-bin/terminal-manager) or remove io-guardian-client and io-guardian-server
from the matrix; update the package derivations (the io-guardian-client and
io-guardian-server derivations) to include passthru.updateScript or drop them
from the workflow so the --use-update-script flag no longer applies to packages
without that attribute.
- Around line 1-3: The CI branch variable currently uses a single shared branch
name (BRANCH -> update/packages) so parallel matrix jobs force-push and clobber
each other; change BRANCH to include a package-specific identifier (e.g., derive
from the matrix item or package name) so each job writes to its own branch
instead of the shared update/packages; also add passthru.updateScript to the
io-guardian packages (pkgs/io-guardian/default.nix for io-guardian-client and
io-guardian-server) so the update step that runs nix-update --use-update-script
can succeed.
In @.woodpecker/update.yaml:
- Line 18: The image reference in .woodpecker/update.yaml currently uses an
unpinned image name "registry.racci.dev/lix-woodpecker"; update that "image"
value to a pinned reference (either a specific tag like
"registry.racci.dev/lix-woodpecker:2026.03.18" or an immutable digest like
"registry.racci.dev/lix-woodpecker@sha256:<digest>") so builds are reproducible,
and commit the updated YAML; ensure the chosen tag/digest corresponds to the
exact container you want to lock to.
In `@flake/ci/scripts/default.nix`:
- Around line 34-36: The new attr detect-affected-outputs calls
writeNuApplicationWithLibs but omits the required name parameter; update the
detect-affected-outputs definition to pass a unique name argument to
writeNuApplicationWithLibs (e.g., name = "detect-affected-outputs") so that the
function receives the required identifier and evaluation of
.#detect-affected-outputs succeeds; modify the detect-affected-outputs block
that invokes writeNuApplicationWithLibs to include the name field.
In `@flake/ci/scripts/detect-affected-outputs.nu`:
- Around line 22-30: Function parameter $outputs is being reassigned (immutable)
— introduce a mutable local binding instead: create a mutable local variable
(e.g., let mut outputs = $outputs) at the top of the function and use that
mutable variable in the is-empty check and when assigning the result of
get_outputs $type; do the same replacement for the later reassignment on lines
32–33 so all updates target the mutable local (outputs) rather than the
immutable parameter.
In `@flake/ci/scripts/discover-packages.nu`:
- Line 21: The eval can fail when pkg.meta.broken is absent; update the --apply
expression so it supplies a default for meta.broken alongside the existing
passthru.discovery fallback. Locate the expression using pkg.passthru.discovery
or true and inherit (pkg.meta) broken and change it to provide a fallback for
broken (for example by inheriting from pkg.meta or a default object with
broken=false, or by explicitly setting broken = pkg.meta.broken or false) so
packages missing meta.broken do not cause evaluation errors.
- Around line 35-47: The script hardcodes
/persist/nix-config/flake/ci/scripts/eval.nix and /persist/nix-config and a
fixed "x86_64-linux" in the attribute_json construction; change eval_nix and the
importPath to use paths relative to the script (e.g., compute script directory
and join with "eval.nix" and the flake root) and replace the literal
"x86_64-linux" with a parameter (e.g., arch or system) so attribute_json becomes
["packages", arch, $package_name] and cmd uses that parameter; also update the
caller that invokes get_changed (and any function that builds cmd) to accept and
forward the arch parameter so the architecture is threaded through.
- Line 80: all_related_files currently uses a shallow listing (ls $pkg_folder |
get name) which misses nested files; update the assignment for all_related_files
to use a recursive glob/walk (e.g., ls $pkg_folder/** | where type == "File" |
get name or use the shell's recursive ls/walk) so that files inside
subdirectories (like patches/) are included; modify the expression that defines
all_related_files to use that recursive pattern instead of the current shallow
ls.
In `@flake/ci/scripts/lib`:
- Line 1: The symlink at flake/ci/scripts/lib currently points to the absolute
path "/persist/nix-config/flake/dev/scripts/lib", which is machine-specific;
change the symlink target to a relative path ("../../dev/scripts/lib") so it is
portable across environments, update the symlink creation step in any
install/script that creates flake/ci/scripts/lib to use the relative target, and
verify the new link resolves correctly in CI and local clones.
In `@flake/ci/scripts/setup-attic.nu`:
- Around line 20-21: The script currently writes the token to a predictable /tmp
file and passes it on the attic command line (the lines using save -f /tmp/netrc
and attic login raccidev ... $env.BINARY_CACHE_TOKEN); change this to a
protected, non-predictable flow: create a secure temp file with mktemp, chmod
600, write the "machine ..." entry there (or alternatively avoid a file entirely
and pipe the token to attic via stdin if attic supports it), then invoke attic
without the token on argv so it reads credentials from the secure netrc (or from
stdin), and finally shred/remove the temp file immediately; ensure you stop
using /tmp/netrc and stop passing $env.BINARY_CACHE_TOKEN as a command-line
argument.
In `@lib/nu-lib/flake.nu`:
- Around line 141-151: get_flake_input currently ignores its input_name
parameter by hardcoding .nodes[$r].inputs.nixpkgs; change the jq invocation to
accept and use the input_name variable: pass --arg input_name "$input_name" to
jq and replace (.nodes[$r].inputs.nixpkgs // "nixpkgs") with
(.nodes[$r].inputs[$input_name] // $input_name), and likewise ensure the
fallback that picks a string vs array uses $input_name instead of the hardcoded
"nixpkgs"; keep the rest of the pipeline (rev/narHash extraction and from json)
unchanged.
In `@lib/nu-lib/lib.nu`:
- Around line 25-27: The log statement leaks environment values; change the log
debug $"Receive value of [($value)] for variable [($var)]" to only log the
variable name (e.g., $"Receive value for variable [($var)]") and do not include
$value, and ensure the missing-vars failure path that currently exits 0 is
changed to exit non-zero (exit 1) so CI fails when required vars are missing;
update the same pattern for the other block referenced (the second occurrence
using $missing_vars | append $var) so both places avoid value logging and return
a non-zero exit on missing variables.
- Around line 4-6: Remove the implicit side-effect by deleting the call to
setup_logging from the export-env block so importing lib.nu no longer
auto-configures logging; keep the setup_logging function exported (or
documented) so callers can call setup_logging explicitly when they want it, and
update any tests/docs and the importers (e.g., setup-attic.nu) to call
setup_logging themselves where needed instead of relying on the import-time
call.
In `@result-lix-woodpecker`:
- Line 1: Remove the committed Nix build artifacts (the files named "result" and
"result-lix-woodpecker") from the repository and add a gitignore rule to prevent
re-committing ephemeral Nix store outputs: delete the files from the index (git
rm --cached or remove and commit), add a line like "result*" to .gitignore,
commit the updated .gitignore and the removal, and push; ensure you reference
the specific artifact names ("result" and "result-lix-woodpecker") when removing
them so only these ephemeral build outputs are excluded.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f63cfa1c-cd14-424b-96c1-65ad4c1dba2d
📒 Files selected for processing (35)
.github/actions/setup-nix/action.yaml.github/workflows/ci.yaml.github/workflows/docs.yaml.github/workflows/packages.yaml.github/workflows/update-packages.yaml.mergify.yml.opencode/agent/ci-failure.md.opencode/agent/test.md.opencode/skills/testing/SKILL.md.woodpecker/check-upstream-todos.yaml.woodpecker/check.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.woodpecker/ci-packages.yaml.woodpecker/flake-checker.yaml.woodpecker/lix.yaml.woodpecker/security.yaml.woodpecker/update-packages.yaml.woodpecker/update.yamlAGENTS.mdflake/ci/scripts/default.nixflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/discover-packages.nuflake/ci/scripts/eval.nixflake/ci/scripts/libflake/ci/scripts/setup-attic.nuflake/dev/scripts/default.nixflake/dev/scripts/libflake/dev/treefmt.nixlib/nu-lib/flake.nulib/nu-lib/lib.nulib/package.nixpkgs/lix-woodpecker/default.nixresult-lix-woodpecker
💤 Files with no reviewable changes (7)
- .github/workflows/packages.yaml
- .woodpecker/check.yaml
- .woodpecker/security.yaml
- .woodpecker/flake-checker.yaml
- .github/workflows/docs.yaml
- .woodpecker/check-upstream-todos.yaml
- .github/actions/setup-nix/action.yaml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
🧰 Additional context used
📓 Path-based instructions (5)
flake/ci/**
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
CI-specific flake definitions and scripts should be located in the
flake/ci/directory
Files:
flake/ci/scripts/setup-attic.nuflake/ci/scripts/discover-packages.nuflake/ci/scripts/libflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nixflake/ci/scripts/default.nix
**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/building/SKILL.md)
Use
nix fmtto format Nix code and check syntax
**/*.nix: Runnix fmt <paths...>after making any changes to ensure consistent formatting
Use 2 spaces for indentation in Nix files
Use kebab-case for Nix file and directory names
Use camelCase for Nix attributes (e.g.,myOption,enableFeature)
Use camelCase for Nix option paths (e.g.,services.myService.enable)
Prefer minimal comments; code should be self-explanatory, using comments to explain why, not what
Prefer relative imports over absolute imports (e.g.,./modules/foo.nix)
Group imports at the top of the Nix file and use list format for multiple imports
When generating JSON, YAML, or other structured formats, define as Nix attribute sets and convert using builtins functions (e.g.,builtins.toJSON), rather than using inline string literals
Follow the standard module structure pattern withconfig,lib,pkgsdestructuring,letbindings for module configuration, andoptions/configsections
Useletbindings withinheritfor importing functions from libraries (e.g.,inherit (lib) mkIf mkEnableOption)Run
nix fmtto format code before submitting changes
**/*.nix: Usebuiltins.traceto add trace statements for seeing values during Nix evaluation, withbuiltins.toJSONfor complex attribute sets
Check for circular dependencies in imports or option definitions as the root cause of infinite recursion errors in Nix
Verify attribute names, imports, and option paths to resolve 'attribute missing' errors in Nix configurationsRun
nix fmton changed Nix files after modifying modules
**/*.nix: Declare secrets in Nix usingsops.secretswith the secret path as the key
Specify custom permissions for secrets usingowner,group, andmodeattributes in sops.secrets declarations
Usesops.templatesto combine multiple secrets into configuration files with placeholders
AddrestartUnitsto secret declarations to automatically restart services when secrets change
Use empty `k...
Files:
pkgs/lix-woodpecker/default.nixlib/package.nixflake/dev/scripts/default.nixflake/ci/scripts/eval.nixflake/dev/treefmt.nixflake/ci/scripts/default.nix
pkgs/*/default.nix
📄 CodeRabbit inference engine (.opencode/skills/packages/SKILL.md)
pkgs/*/default.nix: Each package should have its own directory under pkgs/ with a default.nix file containing the package definition
Use stdenv.mkDerivation for standard binary packages with required fields: pname, version, src, and meta (description, license, platforms)
Use writeShellApplication for shell script wrappers, specifying name, text (via builtins.readFile), and runtimeInputs
Use autoPatchelfHook in nativeBuildInputs for binary packages to automatically patch ELF dependencies
Use python3Packages.buildPythonApplication for Python applications with pyproject = true, specifying build-system and dependencies
For multi-output packages, use a let binding to define multiple outputs and register them with inherit syntax in pkgs/default.nix
Include passthru.updateScript in package definitions using nix-update-script with extraArgs for automatic update support
Files:
pkgs/lix-woodpecker/default.nix
pkgs/**
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Custom packages and package sets should be located in the
pkgs/directory with each package having its owndefault.nix
Files:
pkgs/lix-woodpecker/default.nix
flake/dev/**
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Development shell, CI scripts, and formatting utilities should be organized in the
flake/dev/directory
Files:
flake/dev/scripts/default.nixflake/dev/scripts/libflake/dev/treefmt.nix
🧠 Learnings (86)
📓 Common learnings
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/ci/** : CI-specific flake definitions and scripts should be located in the `flake/ci/` directory
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to flake.nix : Use `./flake/ci/detect-affected-outputs.nu nixosConfigurations --json` and `./flake/ci/detect-affected-outputs.nu homeConfigurations --json` to identify which outputs are affected by dirty files in CI
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to {flake.nix,flake.lock} : Run `nix flake check` (with devenv-root override) before submitting changes
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Run `nix fmt <changed-files>` to fix Nix formatting failures in CI checks
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/ci/** : CI-specific flake definitions and scripts should be located in the `flake/ci/` directory
Applied to files:
flake/ci/scripts/setup-attic.nuflake/ci/scripts/discover-packages.nuflake/ci/scripts/libflake/dev/scripts/libflake/ci/scripts/eval.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:16.409Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/security.md:0-0
Timestamp: 2026-03-01T12:27:16.409Z
Learning: Applies to **/*.nix : Never pass secrets via command line arguments (visible in process list); use secretFile, environmentFile, or sops-managed files instead
Applied to files:
flake/ci/scripts/setup-attic.nuflake/ci/scripts/discover-packages.nuflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:16.409Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/security.md:0-0
Timestamp: 2026-03-01T12:27:16.409Z
Learning: Applies to **/*.nix : Never hardcode passwords, API keys, or tokens in plain text; ensure sensitive data is stored in secrets.yaml and referenced through sops declarations
Applied to files:
flake/ci/scripts/setup-attic.nuflake/ci/scripts/discover-packages.nuflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to pkgs/*/default.nix : Include passthru.updateScript in package definitions using nix-update-script with extraArgs for automatic update support
Applied to files:
pkgs/lix-woodpecker/default.nixflake/ci/scripts/discover-packages.nulib/package.nix.woodpecker/update-packages.yamlflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to home/**/*.nix : Test at least one affected home configuration before submitting changes
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yamlflake/ci/scripts/discover-packages.nu.opencode/agent/test.md.woodpecker/ci-hosts.yaml.opencode/agent/ci-failure.md.opencode/skills/testing/SKILL.md.github/workflows/ci.yamlAGENTS.md.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For flake.nix or flake.lock changes, run a full flake check in addition to building representative configs
Applied to files:
.woodpecker/ci-packages.yamlflake/ci/scripts/discover-packages.nu.opencode/agent/test.mdlib/nu-lib/flake.nu.opencode/agent/ci-failure.mdflake/dev/scripts/default.nixflake/ci/scripts/lib.github/workflows/ci.yamlAGENTS.mdflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nix.woodpecker/checks.yamlflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to {flake.nix,flake.lock} : Run `nix flake check` (with devenv-root override) before submitting changes
Applied to files:
.woodpecker/ci-packages.yamlflake/ci/scripts/discover-packages.nu.opencode/agent/test.mdlib/nu-lib/flake.nu.opencode/agent/ci-failure.mdflake/dev/scripts/default.nixflake/ci/scripts/lib.github/workflows/ci.yamlAGENTS.mdflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nix.woodpecker/checks.yamlflake/dev/treefmt.nix.woodpecker/update.yamlflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Run `nix fmt <changed-files>` to fix Nix formatting failures in CI checks
Applied to files:
.woodpecker/ci-packages.yamlflake/ci/scripts/discover-packages.nu.opencode/agent/test.md.woodpecker/ci-hosts.yaml.opencode/agent/ci-failure.md.github/workflows/ci.yamlflake/ci/scripts/detect-affected-outputs.nu.woodpecker/checks.yamlflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to flake.nix : Use `./flake/ci/detect-affected-outputs.nu nixosConfigurations --json` and `./flake/ci/detect-affected-outputs.nu homeConfigurations --json` to identify which outputs are affected by dirty files in CI
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yamlflake/ci/scripts/discover-packages.nu.opencode/agent/test.mdlib/nu-lib/flake.nu.woodpecker/ci-hosts.yaml.opencode/agent/ci-failure.mdflake/dev/scripts/default.nixflake/ci/scripts/lib.opencode/skills/testing/SKILL.md.github/workflows/ci.yamlAGENTS.mdflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel` to test a host configuration
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.opencode/skills/testing/SKILL.md
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting only homes, build at least one affected home configuration using 'nix build .#homeConfigurations.<user>@<host>.activationPackage'
Applied to files:
.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.github/workflows/ci.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For home-specific changes in home/<user>/, build that user's home config on one host; if shared home files changed, test on multiple hosts
Applied to files:
.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.github/workflows/ci.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting both hosts and homes, build one host AND one home configuration to ensure no regressions
Applied to files:
.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting only hosts, build at least one affected host configuration using 'nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel'
Applied to files:
.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yamlflake/dev/scripts/default.nix.opencode/skills/testing/SKILL.md.github/workflows/ci.yaml
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Build a Home-Manager activation using `nix build .#homeConfigurations.<user>@<host>.activationPackage`
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For module changes in modules/, identify all configurations using the module and pick one representative host and/or home to build
Applied to files:
.woodpecker/ci-homes.yaml.opencode/agent/test.md.woodpecker/ci-hosts.yaml.opencode/skills/testing/SKILL.md
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Applies to home/*/[!.]*@(hm-config|os-config|secrets).nix : Create host-specific configuration files named `<hostname>.nix` in the user directory (`home/<username>/<hostname>.nix`), containing Home-Manager configuration with user-specific git settings, imports of shared features, and host-specific customizations
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Test user configuration using `nix build .#homeConfigurations.<username>.activationPackage` or `home-manager build --flake .#<username>` before deployment
Applied to files:
.woodpecker/ci-homes.yaml.github/workflows/ci.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix build .#homeConfigurations."<user>@<host>".activationPackage` to test a home configuration
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake.nix : Top-level flake definitions and inputs/outputs configuration should be placed in `flake.nix`
Applied to files:
flake/ci/scripts/discover-packages.nulib/nu-lib/flake.nu.opencode/agent/ci-failure.mdflake/dev/scripts/default.nixflake/ci/scripts/libflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nixflake/dev/treefmt.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix flake show` to display the structure and available outputs in a Nix flake
Applied to files:
flake/ci/scripts/discover-packages.nulib/nu-lib/flake.nuflake/dev/scripts/default.nixflake/ci/scripts/libflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/dev/** : Development shell, CI scripts, and formatting utilities should be organized in the `flake/dev/` directory
Applied to files:
flake/ci/scripts/discover-packages.nuflake/ci/scripts/libflake/dev/scripts/lib
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Use the module-graph script (./flake/dev/scripts/module-graph.nu) to determine which hosts and homes are affected by your changes
Applied to files:
flake/ci/scripts/discover-packages.nu.opencode/agent/test.mdflake/dev/scripts/default.nix.opencode/skills/testing/SKILL.md.github/workflows/ci.yamlAGENTS.md
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Avoid hardcoded paths that should be configurable options
Applied to files:
flake/ci/scripts/discover-packages.nu.woodpecker/ci-hosts.yamllib/package.nix.opencode/agent/ci-failure.mdflake/dev/scripts/default.nixflake/ci/scripts/libflake/ci/scripts/eval.nixflake/dev/treefmt.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Prefer relative imports (e.g., `./modules/foo.nix`) over absolute paths
Applied to files:
flake/ci/scripts/discover-packages.nuflake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : Prefer relative imports over absolute imports (e.g., `./modules/foo.nix`)
Applied to files:
flake/ci/scripts/discover-packages.nuflake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Provide the `devenv-root` input override for `nix flake check` with path `file+file://$PWD/.devenv/root`
Applied to files:
flake/ci/scripts/discover-packages.nulib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Commit scope should be the common directory path (e.g., home/racci, hosts/server, modules/nixos, modules/home-manager, pkgs, lib)
Applied to files:
flake/ci/scripts/discover-packages.nu
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix flake check --override-input devenv-root "file+file://$PWD/.devenv/root"` to perform a full flake check
Applied to files:
flake/ci/scripts/discover-packages.nu.opencode/agent/test.mdlib/nu-lib/flake.nu.opencode/agent/ci-failure.mdflake/dev/scripts/default.nixflake/ci/scripts/libflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Provide the `devenv-root` input override for `nix develop` with path `file+file://$PWD/.devenv/root`
Applied to files:
flake/ci/scripts/discover-packages.nu
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Avoid inline JSON/YAML strings; use `builtins.toJSON` for structured data
Applied to files:
flake/ci/scripts/discover-packages.nuflake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to pkgs/*/default.nix : For multi-output packages, use a let binding to define multiple outputs and register them with inherit syntax in pkgs/default.nix
Applied to files:
flake/ci/scripts/discover-packages.nulib/package.nixflake/dev/scripts/default.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Always use `inherit` to bring functions and values into scope instead of manual assignment
Applied to files:
flake/ci/scripts/discover-packages.nu
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Ensure all used functions are properly inherited to avoid circular imports and hidden dependencies
Applied to files:
flake/ci/scripts/discover-packages.nulib/package.nixflake/dev/scripts/default.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : Use `let` bindings with `inherit` for importing functions from libraries (e.g., `inherit (lib) mkIf mkEnableOption`)
Applied to files:
flake/ci/scripts/discover-packages.nulib/package.nixflake/dev/scripts/default.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to pkgs/*/default.nix : Use stdenv.mkDerivation for standard binary packages with required fields: pname, version, src, and meta (description, license, platforms)
Applied to files:
flake/ci/scripts/discover-packages.nu
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to pkgs/default.nix : Custom packages should export their definitions through `pkgs/default.nix`
Applied to files:
flake/ci/scripts/discover-packages.nu
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Always use `mkIf` guards on config sections that are conditionally applied
Applied to files:
flake/ci/scripts/discover-packages.nuflake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Ensure all required options are defined before use in configuration blocks
Applied to files:
flake/ci/scripts/discover-packages.nu
📚 Learning: 2026-03-01T12:25:06.603Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/modules/SKILL.md:0-0
Timestamp: 2026-03-01T12:25:06.603Z
Learning: Applies to **/*.nix : Run `nix fmt` on changed Nix files after modifying modules
Applied to files:
flake/ci/scripts/discover-packages.nu.opencode/agent/test.mdflake/dev/scripts/default.nixAGENTS.mdflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: Applies to **/*.nix : Always ensure formatting is correct by running 'nix fmt' on changed files
Applied to files:
flake/ci/scripts/discover-packages.nu.opencode/agent/test.md.opencode/agent/ci-failure.mdflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:29.965Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-01T12:27:29.965Z
Learning: Applies to **/*.nix : All affected configurations MUST be tested before completing any task, using the test agent and testing skill to identify affected configurations
Applied to files:
.opencode/agent/test.md.woodpecker/ci-hosts.yaml.opencode/agent/ci-failure.md.opencode/skills/testing/SKILL.mdAGENTS.md
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to **/*.nix : Run `nix fmt` to format code before submitting changes
Applied to files:
.opencode/agent/test.mdlib/package.nixflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Code MUST pass `nix fmt` formatting validation
Applied to files:
.opencode/agent/test.mdlib/package.nixflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Applies to **/*.nix : Verify attribute names, imports, and option paths to resolve 'attribute missing' errors in Nix configurations
Applied to files:
.opencode/agent/test.mdflake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Use `nix flake check` to evaluate all configurations and run linters
Applied to files:
.opencode/agent/test.mdlib/nu-lib/flake.nu.opencode/agent/ci-failure.mdflake/ci/scripts/libflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Use `nix eval .#nixosConfigurations.<host>.config.system.build.toplevel --apply 'x: "ok"'` to check if Nix expressions evaluate correctly
Applied to files:
.opencode/agent/test.md.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to hosts/**/*.nix : Test at least one affected host configuration before submitting changes
Applied to files:
.opencode/agent/test.md.woodpecker/ci-hosts.yaml.opencode/skills/testing/SKILL.md.github/workflows/ci.yaml.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: Use the module-graph script to determine which hosts and homes are affected by changes
Applied to files:
.opencode/agent/test.md.opencode/skills/testing/SKILL.md
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Based on module-graph output, test at least one affected host AND one affected home configuration if the changed files affect both
Applied to files:
.opencode/agent/test.md.opencode/skills/testing/SKILL.md
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Based on module-graph output, test at least one affected home configuration if the changed files affect homes only
Applied to files:
.opencode/agent/test.md.opencode/skills/testing/SKILL.mdAGENTS.md
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Based on module-graph output, test at least one affected host configuration if the changed files affect hosts only
Applied to files:
.opencode/agent/test.md.opencode/skills/testing/SKILL.md
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: Report test results in the format: Changed Files, Affected Configurations, Tests Run, Results, Issues Found, and Recommendations
Applied to files:
.opencode/agent/test.md
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: When reporting CI failures, explain the root cause clearly, show the specific location (file and line), provide a concrete code fix with explanation, and suggest verification commands to test locally before pushing
Applied to files:
.opencode/agent/test.md
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to flake.{nix,lock} : Verify `flake.lock` conflicts by checking if inputs were updated and ensuring compatibility between updated inputs
Applied to files:
lib/nu-lib/flake.nu.opencode/agent/ci-failure.mdflake/dev/scripts/default.nixflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix flake check --no-build` to verify flake syntax validity without building
Applied to files:
lib/nu-lib/flake.nuflake/ci/scripts/libflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/nixos/** : NixOS flake modules should be organized in the `flake/nixos/` directory
Applied to files:
lib/nu-lib/flake.nuflake/ci/scripts/libAGENTS.md
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Check for infinite recursion by examining recent changes for circular imports between modules or option definitions that reference themselves
Applied to files:
lib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For host-specific changes in hosts/<type>/<hostname>/, build that specific host; if shared files changed, check other hosts of the same type
Applied to files:
.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to hosts/{desktop,laptop,server}/*/default.nix : Host system configurations should follow the pattern `hosts/<type>/<hostname>/default.nix`
Applied to files:
.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to hosts/{desktop,laptop,server}/** : Per-machine NixOS configurations should be organized in `hosts/<type>/<hostname>/` where type is desktop, laptop, or server
Applied to files:
.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Build a host's NixOS system using `nix build .#nixosConfigurations.<host>.config.system.build.toplevel`
Applied to files:
.woodpecker/ci-hosts.yaml.opencode/skills/testing/SKILL.md
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to pkgs/*/default.nix : Use writeShellApplication for shell script wrappers, specifying name, text (via builtins.readFile), and runtimeInputs
Applied to files:
lib/package.nixflake/dev/scripts/default.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : Follow the standard module structure pattern with `config`, `lib`, `pkgs` destructuring, `let` bindings for module configuration, and `options`/`config` sections
Applied to files:
lib/package.nixflake/dev/scripts/default.nixflake/ci/scripts/libAGENTS.mdflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:29.965Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-01T12:27:29.965Z
Learning: Applies to **/*.nix : Documentation in docs/ MUST be updated simultaneously with code changes to .nix files
Applied to files:
lib/package.nixAGENTS.md
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Follow the standard NixOS module structure pattern with config, lib, pkgs parameters and proper `let`/`in` blocks
Applied to files:
lib/package.nixflake/dev/scripts/default.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Use intermediate bindings instead of deeply nested attribute access for improved readability
Applied to files:
lib/package.nixflake/dev/scripts/default.nixflake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to overlays/default.nix : Expose custom packages via overlays/default.nix by importing the pkgs directory with inputs, lib, and pkgs parameters
Applied to files:
lib/package.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Remove unused let bindings
Applied to files:
flake/dev/scripts/default.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/home-manager/** : Home-Manager flake modules should be organized in the `flake/home-manager/` directory
Applied to files:
flake/ci/scripts/lib
📚 Learning: 2026-03-01T12:24:45.167Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/docs/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:45.167Z
Learning: Applies to docs/src/**/*.md : Create or update Markdown files in `docs/src` following the documentation workflow: analyze changes, identify impact on documentation files, draft content with underscore filenames, update `docs/src/SUMMARY.md`, and verify Nix code examples are valid
Applied to files:
.opencode/skills/testing/SKILL.mdAGENTS.md
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Pull request title should mirror the commit header following conventional commit format
Applied to files:
.mergify.yml
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Commit type should be one of: feat, fix, chore, refactor, build, ci, or style
Applied to files:
.mergify.yml
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Ensure CI passes before requesting review on a pull request
Applied to files:
.mergify.yml
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Applies to **/*.nix : Use `builtins.trace` to add trace statements for seeing values during Nix evaluation, with `builtins.toJSON` for complex attribute sets
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Use `nix eval .#nixosConfigurations.<host>.config.services --apply 'builtins.attrNames'` to diagnose 'attribute not found' errors by listing available attributes
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : When generating JSON, YAML, or other structured formats, define as Nix attribute sets and convert using builtins functions (e.g., `builtins.toJSON`), rather than using inline string literals
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : When generating JSON/YAML, define as Nix attribute sets and convert using `builtins.toJSON` instead of inline strings
Applied to files:
flake/ci/scripts/eval.nixflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : When assertion failures occur, read the assertion message carefully as it explains what configuration constraint is not being met or what required option is missing
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix eval .#...options --apply 'builtins.attrNames'` to list all available options in a Nix namespace
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : When a new module isn't being found, verify the imports list in the parent module, check that the file path is correct (use kebab-case), and ensure the module is syntactically valid
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Applies to **/*.nix : Use `nix fmt` to format Nix code and check syntax
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : Run `nix fmt <paths...>` after making any changes to ensure consistent formatting
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:29.965Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-01T12:27:29.965Z
Learning: Applies to **/*.nix : All code MUST be formatted with nix fmt before completing any task
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to pkgs/** : Custom packages and package sets should be located in the `pkgs/` directory with each package having its own `default.nix`
Applied to files:
flake/ci/scripts/default.nix
DaRacci
force-pushed
the
push-ssqumvutkzmu
branch
from
March 23, 2026 10:03
a0a3211 to
3ad0cae
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 17
♻️ Duplicate comments (3)
.woodpecker/ci-packages.yaml (1)
77-89:⚠️ Potential issue | 🔴 Critical
when.pathcannot gate a runtime marker file.
.do-buildis created during the pipeline, butwhen.pathis evaluated from SCM changes at trigger time. On push/PR runs this step never sees the marker; on manual runs it can still pass with an empty change-set. Move the guard intocommandsor gate on step status instead.Minimal fix
- name: build-${package} image: registry.racci.dev/lix-woodpecker pull: true depends_on: ["decide-${PACKAGE}"] - when: - path: .do-build environment: BINARY_CACHE_TOKEN: from_secret: BINARY_CACHE_TOKEN commands: |- + if [ ! -f .do-build ]; then + echo "Skipping build for ${PACKAGE} - not affected by changes" + exit 0 + fi nix run .#setup-attic nix run .#archive-flakes -- "." nix-fast-build --no-nom --no-link --attic-cache raccidev --skip-cached --flake ".#packages.x86_64-linux.${PACKAGE}"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.woodpecker/ci-packages.yaml around lines 77 - 89, The step definition for build-${package} uses when.path: .do-build which is evaluated at trigger time and cannot detect the runtime marker; update the build-${package} step to remove the when.path guard and instead check for the presence of the .do-build marker inside the commands block (or gate the step via a depends_on/status check from the step that creates .do-build), e.g. change the logic in the commands for the build-${package} step to test for .do-build at runtime and exit/skip if absent or rely on the producing step's status to control execution.lib/nu-lib/lib.nu (1)
26-29:⚠️ Potential issue | 🟠 MajorDon’t log required variable values, and fix the presence test.
This still prints the environment variable contents and checks
($var != null)instead of($value != null), so debug logs can leak secrets while always reporting the variable as present.Minimal fix
- log debug $"Checking required variable of [($value)] - present: \(($var != null)\)" + log debug $"Checking required variable [($var)] - present: (($value != null))"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@lib/nu-lib/lib.nu` around lines 26 - 29, The debug log is leaking env values and uses the wrong presence test; change the log debug in the block that reads let value = $env | get -o $var to not include $value (only the variable name) and use the correct presence expression ($value != null) instead of ($var != null), and ensure the presence check that appends to $missing_vars still triggers when $value == null (keep the existing append $var logic)..woodpecker/checks.yaml (1)
87-104:⚠️ Potential issue | 🔴 CriticalPlease verify the selector syntax handed to
update-matrix.If
update-matrixforwards these strings tonix eval --apply, the current values on Lines 92 and 104 are invalid:builtins.filterworks on lists,|>is not Nix syntax, and the update-packages selector also uses.#package/update-scriptinstead of.#packages/updateScript. That would leave both package matrix refresh steps empty or failing.Based on learnings: "Include passthru.updateScript in package definitions using nix-update-script with extraArgs for automatic update support."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.woodpecker/checks.yaml around lines 87 - 104, The selector strings passed to update-matrix are invalid Nix: remove the illegal |> and replace the list-based builtins.filter usage with attribute-set helpers (e.g. builtins.filterAttrs + builtins.attrNames) and point at the correct package set names and passthru key; specifically update the first selector to target .#packages.x86_64-linux and use builtins.attrNames over a builtins.filterAttrs predicate that checks p.passthru.discovery, and update the second selector to target .#packages.x86_64-linux and test p.passthru.updateScript (not update-script) so nix eval --apply receives valid Nix expressions; keep these changes localized to the strings passed to update-matrix.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.mergify.yml:
- Line 51: The PR title regex in the .mergify.yml rule ("title ~=
^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\\(.+\\))?:")
rejects Conventional Commit breaking-change headers that include `!`; update
that regex so an optional `!` is allowed either after the type or after the
scope (i.e., allow `feat!:` and `feat(scope)!:`) by modifying the pattern to
accept an optional `!` before the colon in the title validation rule.
In @.woodpecker/checks.yaml:
- Around line 36-42: The "Run flake checks" Woodpecker step currently has
failure: ignore which silences nix flake check failures; update the step named
"Run flake checks" to remove or set failure to false so that the commands: nix
flake check will fail the pipeline on errors, and if you still need matrix
refresh to continue create a separate non-blocking step/pipeline (e.g., a
distinct job without failure: false) to run any non-critical tasks.
- Around line 123-128: The check uses git diff --name-only HEAD~1 (assigned to
CHANGED_FILES) which compares against the previous commit and can include prior
changes; update the invocation to compare the working tree against HEAD instead
(use git diff --name-only HEAD) so CHANGED_FILES only reflects current
working-tree changes before creating the branch and committing the matrix files
(refer to CHANGED_FILES and the git diff call in the block that then runs git
checkout -b $BRANCH, git add, git commit).
- Around line 158-161: The environment block in the "Create/Update PR" step uses
a non-existent YAML anchor `<<: *env`, causing BASE_BRANCH and BRANCH to be
undefined; replace the merge key with explicit environment variables: define
BASE_BRANCH and BRANCH (and any other env vars the step expects) directly under
the environment mapping and keep GITHUB_TOKEN: from_secret: GITHUB_TOKEN so the
commands referencing BASE_BRANCH and BRANCH work correctly (locate the
`environment:` block in the step to update).
In @.woodpecker/ci-homes.yaml:
- Line 36: The invocation of the detect-affected-outputs tool in the AFFECTED
assignment is missing the required positional type argument; update the call to
include the output type (e.g., "homeConfigurations") immediately after the "--"
so the command becomes nix run .#detect-affected-outputs -- homeConfigurations
--json --range "$${RANGE}" --outputs ["$${HOME}"] (also adjust the flag name
from --output to --outputs and pass HOME as an array if your script expects
--outputs), leaving the rest of the variables (RANGE, HOME) unchanged and
ensuring the command uses detect-affected-outputs as shown.
- Around line 36-37: The detect-affected-outputs invocation is missing the
required first positional argument and uses the wrong flags and JSON handling;
update the call that sets AFFECTED (the line invoking "nix run
.#detect-affected-outputs") to pass the appropriate first arg
("homeConfigurations"), remove the invalid "--output" flag, change the fallback
from echo "[]" to echo "{}" so the fallback is an object, and change the jq
check on the next line from index($home) to has($home) to test object keys;
apply the analogous change in ci-hosts.yaml by using "nixosConfigurations" as
the first positional argument and the same JSON/fallback/jq fixes for that
file's AFFECTED and jq usage.
In @.woodpecker/ci-hosts.yaml:
- Around line 43-45: The jq test is wrong for the JSON emitted by
detect-affected-outputs (it emits an object keyed by output name), so change the
condition that currently uses "index($host)" to instead use "has($host)" and
ensure AFFECTED falls back to an empty object on errors (e.g., replace the
current capture logic so the command returns "{}" on failure); update the jq
invocation that checks the host to use has($host) against that object
(referencing the AFFECTED variable and the detect-affected-outputs invocation)
so affected hosts are detected correctly.
In @.woodpecker/ci-packages.yaml:
- Around line 60-61: The discover-packages invocation that sets AFFECTED must
include the --json flag so it emits a JSON array for jq to parse; update the
command that runs "nix run .#discover-packages -- \"$${RANGE}\" \"$${PACKAGE}\""
to pass the --json option (e.g. "nix run .#discover-packages -- --json
\"$${RANGE}\" \"$${PACKAGE}\"") so AFFECTED contains JSON and the subsequent jq
index check works correctly for changed-package detection.
In `@flake/ci/scripts/default.nix`:
- Around line 38-41: discover-packages fails at runtime because the Nu script
discover-packages.nu invokes the fd binary but writeNuApplicationWithLibs
currently only injects jq/nix/git/busybox; update the discover-packages
derivation that uses writeNuApplicationWithLibs to include fd in its runtime
inputs (add fd to the packages/lib list passed into writeNuApplicationWithLibs
or to an extraPackages/runtimeInputs argument) so the fd binary is present when
running nix run .#discover-packages.
In `@flake/ci/scripts/eval.nix`:
- Around line 77-81: The position resolution can fail when neither src nor
pkg.meta.position exist; update the logic in the position assignment to
defensively check both sources before calling sanitizePosition/positionFromMeta:
first use a safe check (e.g., builtins.hasAttr "src" pkg and confirm
builtins.unsafeGetAttrPos "src" pkg != null) and if that fails, verify pkg.meta
and pkg.meta.position exist (e.g., builtins.hasAttr "meta" pkg &&
builtins.hasAttr "position" pkg.meta) before calling positionFromMeta, and
provide a safe fallback (null or a default position) if neither is present;
adjust references to position, sanitizePosition, builtins.unsafeGetAttrPos "src"
pkg, and positionFromMeta accordingly.
- Around line 48-54: The current pkg assignment can become null if
tryGetAttrPath(attributePath, packages) and tryGetAttrPath(attributePath, flake)
both fail, causing later accesses (pkg.src, pkg.meta.position) to crash; modify
the logic around packagesResult/tryGetAttrPath to explicitly detect when neither
lookup succeeded and throw a clear error (including attributePath and system) or
return a non-null sentinel before using pkg, e.g. replace the final else branch
with a failure path that raises an informative error when both lookups fail so
subsequent code never observes a null pkg.
In `@flake/ci/scripts/update-matrix.nu`:
- Line 7: Rename the misspelled parameter eval_expresion to eval_expression
throughout the script: update the parameter declaration (where eval_expresion is
defined) and all usages/calls that reference it (e.g., the places later in the
file that currently reference eval_expresion on lines following the
declaration). Make sure function signatures, variable references, and any
documentation/comments use the corrected name eval_expression so the parameter
name is consistent everywhere.
- Line 46: The script uses a non-existent Nushell command `update-in` when
constructing `updated_yaml`; replace the call that pipes `$yaml` into
`update-in` with Nushell's standard `update` using a cell-path (i.e., call
`update` with the path composed of "matrix" and `$matrix_key`) and pass
`$new_matrix` as the new value so the pipeline becomes: pipe `$yaml` into
`update` with the cell-path ["matrix", $matrix_key] and `$new_matrix`, updating
the `updated_yaml` assignment accordingly.
In `@lib/nu-lib/flake.nu`:
- Around line 183-209: Remove unused locals and ensure temp files are cleaned up
in the check_file_changed logic: drop the unused head_commit and the redundant
has_changed variable (they're defined but never used), and when creating temp
files via mktemp (old_file) make sure to delete/unlink them after use (or use a
scoped/temp-file helper) so they don't leak; also simplify the loop over
git_file_diffs to directly compare nix hashes and append to changed_files when
different (refer to symbols git_file_diffs, changed_files, old_file, mktemp,
head_commit, has_changed, and the surrounding loop in check_file_changed).
- Around line 158-165: The variable head_commit defined in the flake.nu snippet
is unused—remove the let head_commit = $split_range | last line (or use it where
intended) and ensure the temporary file created as prev_lock_file is cleaned up
after use: when root_flake_changed is true and after git show writes to
$prev_lock_file and any subsequent processing, delete/unlink $prev_lock_file (or
use a safe temp-file pattern/trap) so the temp file is not left behind;
reference the symbols head_commit, prev_commit, prev_lock_file, and
root_flake_changed when applying the changes.
In `@lib/package.nix`:
- Around line 63-68: The checkPhase is being used to perform installation (mkdir
-p "$out/bin/lib" and copying files via find ${libStore} ... cp -t
"$out/bin/lib"), which violates the convention that checkPhase runs
tests/validation; move this logic into the proper install step (e.g. implement
an installPhase or use postInstallHook to create $out/bin/lib and copy files
from ${libStore}), or if this is inside a writeTextFile derivation use the
buildPhase/installPhase instead; if you intentionally must repurpose checkPhase,
add a clear comment above checkPhase explaining why and set checkPhase to a
no-op (:) when tests are absent to avoid confusion.
---
Duplicate comments:
In @.woodpecker/checks.yaml:
- Around line 87-104: The selector strings passed to update-matrix are invalid
Nix: remove the illegal |> and replace the list-based builtins.filter usage with
attribute-set helpers (e.g. builtins.filterAttrs + builtins.attrNames) and point
at the correct package set names and passthru key; specifically update the first
selector to target .#packages.x86_64-linux and use builtins.attrNames over a
builtins.filterAttrs predicate that checks p.passthru.discovery, and update the
second selector to target .#packages.x86_64-linux and test
p.passthru.updateScript (not update-script) so nix eval --apply receives valid
Nix expressions; keep these changes localized to the strings passed to
update-matrix.
In @.woodpecker/ci-packages.yaml:
- Around line 77-89: The step definition for build-${package} uses when.path:
.do-build which is evaluated at trigger time and cannot detect the runtime
marker; update the build-${package} step to remove the when.path guard and
instead check for the presence of the .do-build marker inside the commands block
(or gate the step via a depends_on/status check from the step that creates
.do-build), e.g. change the logic in the commands for the build-${package} step
to test for .do-build at runtime and exit/skip if absent or rely on the
producing step's status to control execution.
In `@lib/nu-lib/lib.nu`:
- Around line 26-29: The debug log is leaking env values and uses the wrong
presence test; change the log debug in the block that reads let value = $env |
get -o $var to not include $value (only the variable name) and use the correct
presence expression ($value != null) instead of ($var != null), and ensure the
presence check that appends to $missing_vars still triggers when $value == null
(keep the existing append $var logic).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 90c89d94-5c37-4a07-9a63-28698556baf1
📒 Files selected for processing (42)
.github/actions/setup-nix/action.yaml.github/workflows/ci.yaml.github/workflows/docs.yaml.github/workflows/packages.yaml.github/workflows/update-packages.yaml.gitignore.mergify.yml.opencode/agent/ci-failure.md.opencode/agent/test.md.opencode/skills/testing/SKILL.md.woodpecker/check-upstream-todos.yaml.woodpecker/check.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.woodpecker/ci-packages.yaml.woodpecker/flake-checker.yaml.woodpecker/lix.yaml.woodpecker/security.yaml.woodpecker/update-packages.yaml.woodpecker/update.yamlAGENTS.mddocs/search.nixdocs/serve.nixdocs/site.nixflake/ci/scripts/default.nixflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/discover-packages.nuflake/ci/scripts/eval.nixflake/ci/scripts/libflake/ci/scripts/setup-attic.nuflake/ci/scripts/update-matrix.nuflake/dev/scripts/default.nixflake/dev/scripts/libflake/dev/treefmt.nixlib/nu-lib/flake.nulib/nu-lib/lib.nulib/package.nixpkgs/drive-stats/default.nixpkgs/helpers/new-host.nixpkgs/list-ephemeral/default.nixpkgs/lix-woodpecker/default.nix
💤 Files with no reviewable changes (8)
- .github/workflows/docs.yaml
- .woodpecker/check-upstream-todos.yaml
- .github/actions/setup-nix/action.yaml
- .woodpecker/flake-checker.yaml
- .woodpecker/check.yaml
- .github/workflows/update-packages.yaml
- .github/workflows/packages.yaml
- .woodpecker/security.yaml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (2)
.woodpecker/ci-homes.yaml (1)
36-37:⚠️ Potential issue | 🔴 CriticalJSON output format mismatch: script returns object, not array.
Per the
detect-affected-outputs.nuimplementation (context snippet 3), the JSON output is an object with output names as keys, not an array. Two fixes needed:
- Line 36: Fallback should be
echo "{}"notecho "[]"- Line 37: Use
has($home)instead ofindex($home)to check object keys🐛 Proposed fix
- AFFECTED=$(nix run .#detect-affected-outputs -- homeConfigurations --json --range "$${RANGE}" "$${HOME}" 2>/dev/null || echo "[]") - if echo "$${AFFECTED}" | jq -e --arg home "$${HOME}" 'index($home)' > /dev/null 2>&1; then + AFFECTED=$(nix run .#detect-affected-outputs -- homeConfigurations --json --range "$${RANGE}" "$${HOME}" 2>/dev/null || echo "{}") + if echo "$${AFFECTED}" | jq -e --arg home "$${HOME}" 'has($home)' > /dev/null 2>&1; then🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.woodpecker/ci-homes.yaml around lines 36 - 37, The script assigns AFFECTED from the detect-affected-outputs run but treats it as an array; change the fallback from echo "[]" to echo "{}" so AFFECTED is an empty JSON object, and update the jq test that currently uses index($home) to has($home) so it checks object keys correctly (i.e., adjust the AFFECTED assignment and replace the jq expression 'index($home)' with 'has($home)').lib/nu-lib/lib.nu (1)
12-15:⚠️ Potential issue | 🔴 CriticalRemove invalid
log set-levelcommand — use$env.NU_LOG_LEVELenvironment variable instead.The
log set-levelcommand does not exist in Nushell's std/log module. Log levels are controlled by setting the$env.NU_LOG_LEVELenvironment variable. Valid values are DEBUG, INFO, WARN, ERROR, or CRITICAL (or their numeric equivalents: 0, 20, 30, 40, 50).Also, line 14 references
$env.NU_LOG_LEVELbefore it's set, so it will show an undefined or stale value.Suggested fix
export def --env setup_logging [] { - log set-level (if $env.DEBUG? == true { 10 } else { 20 }) - log info $"Logging initialized. Level: ($env.NU_LOG_LEVEL)" + $env.NU_LOG_LEVEL = (if $env.DEBUG? == true { "DEBUG" } else { "INFO" }) + log info $"Logging initialized. Level: ($env.NU_LOG_LEVEL)" $env.NU_LOG_FORMAT = "%ANSI_START%%LEVEL%|%MSG%%ANSI_STOP%" }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@lib/nu-lib/lib.nu` around lines 12 - 15, In setup_logging, remove the invalid call to "log set-level" and instead set the $env.NU_LOG_LEVEL environment variable based on $env.DEBUG? (map true -> "DEBUG" or numeric if you prefer, otherwise "INFO") before calling log info; update the code that references $env.NU_LOG_LEVEL so it reads the value after you assign it, and keep the $env.NU_LOG_FORMAT assignment as-is (or set it after NU_LOG_LEVEL) so logging uses the correct format. Ensure you update the export def --env setup_logging block and the references to $env.DEBUG?, $env.NU_LOG_LEVEL, and the log info call accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.woodpecker/checks.yaml:
- Line 28: The "Build flake checks" pipeline step currently uses the setting
`failure: ignore`, which suppresses failures; update the pipeline step (the
"Build flake checks" entry) to not ignore failures—either remove the `failure:
ignore` line or change it to a failing behavior (e.g., `failure: fail`) so that
flake check failures will fail the build and surface real issues.
- Line 122: The YAML currently creates a new anchor with "branch: &branch"
instead of referencing the existing anchor; change that token to reference the
previously defined anchor by replacing "&branch" with "*branch" so the "branch"
key uses the existing anchor named "branch" (i.e., make "branch: *branch" where
"branch: &branch" currently appears).
In @.woodpecker/ci-packages.yaml:
- Line 77: The step name currently uses the wrong variable case
("build-${package}") which won't be interpolated because the matrix defines
"PACKAGE" (uppercase); change the step name to use the correct variable case
"build-${PACKAGE}" so it matches the matrix key and the substitution works as
intended.
In `@flake/ci/scripts/update-matrix.nu`:
- Line 46: The update call is passing a string as the path
(`$"matrix.($matrix_key)"`) which fails because nushell's update expects a
cell-path; instead construct a cell-path from that string and pass it to update.
Build the path by creating the string $"matrix.($matrix_key)", pipe it through
split row '.' and convert to a cell-path, then call update with $yaml, the
resulting cell-path, and $new_matrix (use the variables updated_yaml, $yaml,
$matrix_key, and $new_matrix to locate and replace the current line).
---
Duplicate comments:
In @.woodpecker/ci-homes.yaml:
- Around line 36-37: The script assigns AFFECTED from the
detect-affected-outputs run but treats it as an array; change the fallback from
echo "[]" to echo "{}" so AFFECTED is an empty JSON object, and update the jq
test that currently uses index($home) to has($home) so it checks object keys
correctly (i.e., adjust the AFFECTED assignment and replace the jq expression
'index($home)' with 'has($home)').
In `@lib/nu-lib/lib.nu`:
- Around line 12-15: In setup_logging, remove the invalid call to "log
set-level" and instead set the $env.NU_LOG_LEVEL environment variable based on
$env.DEBUG? (map true -> "DEBUG" or numeric if you prefer, otherwise "INFO")
before calling log info; update the code that references $env.NU_LOG_LEVEL so it
reads the value after you assign it, and keep the $env.NU_LOG_FORMAT assignment
as-is (or set it after NU_LOG_LEVEL) so logging uses the correct format. Ensure
you update the export def --env setup_logging block and the references to
$env.DEBUG?, $env.NU_LOG_LEVEL, and the log info call accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8891e0c1-d766-4600-88f7-0b83cc9dd038
📒 Files selected for processing (8)
.woodpecker/checks.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-packages.yamlflake/ci/scripts/default.nixflake/ci/scripts/update-matrix.nulib/nu-lib/flake.nulib/nu-lib/lib.nulib/package.nix
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
🧰 Additional context used
📓 Path-based instructions (2)
flake/ci/**
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
CI-specific flake definitions and scripts should be located in the
flake/ci/directory
Files:
flake/ci/scripts/update-matrix.nuflake/ci/scripts/default.nix
**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/building/SKILL.md)
Use
nix fmtto format Nix code and check syntax
**/*.nix: Runnix fmt <paths...>after making any changes to ensure consistent formatting
Use 2 spaces for indentation in Nix files
Use kebab-case for Nix file and directory names
Use camelCase for Nix attributes (e.g.,myOption,enableFeature)
Use camelCase for Nix option paths (e.g.,services.myService.enable)
Prefer minimal comments; code should be self-explanatory, using comments to explain why, not what
Prefer relative imports over absolute imports (e.g.,./modules/foo.nix)
Group imports at the top of the Nix file and use list format for multiple imports
When generating JSON, YAML, or other structured formats, define as Nix attribute sets and convert using builtins functions (e.g.,builtins.toJSON), rather than using inline string literals
Follow the standard module structure pattern withconfig,lib,pkgsdestructuring,letbindings for module configuration, andoptions/configsections
Useletbindings withinheritfor importing functions from libraries (e.g.,inherit (lib) mkIf mkEnableOption)Run
nix fmtto format code before submitting changes
**/*.nix: Usebuiltins.traceto add trace statements for seeing values during Nix evaluation, withbuiltins.toJSONfor complex attribute sets
Check for circular dependencies in imports or option definitions as the root cause of infinite recursion errors in Nix
Verify attribute names, imports, and option paths to resolve 'attribute missing' errors in Nix configurationsRun
nix fmton changed Nix files after modifying modules
**/*.nix: Declare secrets in Nix usingsops.secretswith the secret path as the key
Specify custom permissions for secrets usingowner,group, andmodeattributes in sops.secrets declarations
Usesops.templatesto combine multiple secrets into configuration files with placeholders
AddrestartUnitsto secret declarations to automatically restart services when secrets change
Use empty `k...
Files:
lib/package.nixflake/ci/scripts/default.nix
🧠 Learnings (64)
📓 Common learnings
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Run `nix fmt <changed-files>` to fix Nix formatting failures in CI checks
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to home/**/*.nix : Test at least one affected home configuration before submitting changes
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to {flake.nix,flake.lock} : Run `nix flake check` (with devenv-root override) before submitting changes
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to **/*.nix : Run `nix fmt` to format code before submitting changes
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to {flake.nix,flake.lock} : Run `nix flake check` (with devenv-root override) before submitting changes
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/ci-packages.yaml.woodpecker/checks.yamllib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to flake.nix : Use `./flake/ci/detect-affected-outputs.nu nixosConfigurations --json` and `./flake/ci/detect-affected-outputs.nu homeConfigurations --json` to identify which outputs are affected by dirty files in CI
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/ci-packages.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yamllib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Use `nix flake check` to evaluate all configurations and run linters
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/checks.yamllib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For flake.nix or flake.lock changes, run a full flake check in addition to building representative configs
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/ci-packages.yaml.woodpecker/checks.yamllib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix flake check --override-input devenv-root "file+file://$PWD/.devenv/root"` to perform a full flake check
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/checks.yamllib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Run `nix fmt <changed-files>` to fix Nix formatting failures in CI checks
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/ci-packages.yaml.woodpecker/checks.yamllib/package.nix.woodpecker/ci-homes.yamllib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to flake.{nix,lock} : Verify `flake.lock` conflicts by checking if inputs were updated and ensuring compatibility between updated inputs
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/checks.yamllib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:25:06.603Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/modules/SKILL.md:0-0
Timestamp: 2026-03-01T12:25:06.603Z
Learning: Applies to **/*.nix : Run `nix fmt` on changed Nix files after modifying modules
Applied to files:
flake/ci/scripts/update-matrix.nu
📚 Learning: 2026-03-01T12:24:45.167Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/docs/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:45.167Z
Learning: Applies to docs/src/**/*.md : Create or update Markdown files in `docs/src` following the documentation workflow: analyze changes, identify impact on documentation files, draft content with underscore filenames, update `docs/src/SUMMARY.md`, and verify Nix code examples are valid
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Use `nix eval .#nixosConfigurations.<host>.config.system.build.toplevel --apply 'x: "ok"'` to check if Nix expressions evaluate correctly
Applied to files:
flake/ci/scripts/update-matrix.nu.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to home/**/*.nix : Test at least one affected home configuration before submitting changes
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yamllib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting only homes, build at least one affected home configuration using 'nix build .#homeConfigurations.<user>@<host>.activationPackage'
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:29.965Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-01T12:27:29.965Z
Learning: Applies to **/*.nix : All affected configurations MUST be tested before completing any task, using the test agent and testing skill to identify affected configurations
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/checks.yamllib/package.nix.woodpecker/ci-homes.yamllib/nu-lib/lib.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Avoid hardcoded paths that should be configurable options
Applied to files:
.woodpecker/ci-packages.yamllib/package.nix.woodpecker/ci-homes.yamllib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-18T23:46:49.905Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: .woodpecker/lix.yaml:15-15
Timestamp: 2026-03-18T23:46:49.905Z
Learning: In nix-config repository (.woodpecker/*.yaml), image references intentionally omit explicit tags or digests (e.g., registry.racci.dev/lix-woodpecker without :tag). Do not flag or suggest adding explicit tags or digests to these image references; treat such omissions as intentional and maintain consistency across the CI config.
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Always use `mkIf` guards on config sections that are conditionally applied
Applied to files:
.woodpecker/ci-packages.yaml
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Avoid inline JSON/YAML strings; use `builtins.toJSON` for structured data
Applied to files:
.woodpecker/ci-packages.yaml
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Code MUST pass `nix fmt` formatting validation
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/checks.yamllib/package.nix.woodpecker/ci-homes.yamllib/nu-lib/lib.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to hosts/**/*.nix : Test at least one affected host configuration before submitting changes
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: Applies to **/*.nix : Always ensure formatting is correct by running 'nix fmt' on changed files
Applied to files:
.woodpecker/ci-packages.yamllib/package.nixlib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : When generating JSON/YAML, define as Nix attribute sets and convert using `builtins.toJSON` instead of inline strings
Applied to files:
.woodpecker/ci-packages.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel` to test a host configuration
Applied to files:
.woodpecker/ci-packages.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/ci/** : CI-specific flake definitions and scripts should be located in the `flake/ci/` directory
Applied to files:
.woodpecker/checks.yamlflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake.nix : Top-level flake definitions and inputs/outputs configuration should be placed in `flake.nix`
Applied to files:
.woodpecker/checks.yamllib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to pkgs/*/default.nix : Include passthru.updateScript in package definitions using nix-update-script with extraArgs for automatic update support
Applied to files:
.woodpecker/checks.yamlflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Ensure all used functions are properly inherited to avoid circular imports and hidden dependencies
Applied to files:
.woodpecker/checks.yamllib/package.nixlib/nu-lib/lib.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix flake check --no-build` to verify flake syntax validity without building
Applied to files:
.woodpecker/checks.yamllib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : Use `let` bindings with `inherit` for importing functions from libraries (e.g., `inherit (lib) mkIf mkEnableOption`)
Applied to files:
lib/package.nixlib/nu-lib/lib.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to pkgs/*/default.nix : Use writeShellApplication for shell script wrappers, specifying name, text (via builtins.readFile), and runtimeInputs
Applied to files:
lib/package.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : Follow the standard module structure pattern with `config`, `lib`, `pkgs` destructuring, `let` bindings for module configuration, and `options`/`config` sections
Applied to files:
lib/package.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Follow the standard NixOS module structure pattern with config, lib, pkgs parameters and proper `let`/`in` blocks
Applied to files:
lib/package.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Use intermediate bindings instead of deeply nested attribute access for improved readability
Applied to files:
lib/package.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Verify option type definitions match their usage and configuration values
Applied to files:
lib/package.nix.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Applies to **/*.nix : Use `nix fmt` to format Nix code and check syntax
Applied to files:
lib/package.nix
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to **/*.nix : Run `nix fmt` to format code before submitting changes
Applied to files:
lib/package.nixlib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:27:29.965Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-01T12:27:29.965Z
Learning: Applies to **/*.nix : All code MUST be formatted with nix fmt before completing any task
Applied to files:
lib/package.nix
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to overlays/default.nix : Expose custom packages via overlays/default.nix by importing the pkgs directory with inputs, lib, and pkgs parameters
Applied to files:
lib/package.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to pkgs/*/default.nix : For multi-output packages, use a let binding to define multiple outputs and register them with inherit syntax in pkgs/default.nix
Applied to files:
lib/package.nixflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting both hosts and homes, build one host AND one home configuration to ensure no regressions
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Build a Home-Manager activation using `nix build .#homeConfigurations.<user>@<host>.activationPackage`
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For home-specific changes in home/<user>/, build that user's home config on one host; if shared home files changed, test on multiple hosts
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting only hosts, build at least one affected host configuration using 'nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel'
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Verify type mismatches by checking option type definitions and the value being provided in NixOS options
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Based on module-graph output, test at least one affected home configuration if the changed files affect homes only
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Based on module-graph output, test at least one affected host AND one affected home configuration if the changed files affect both
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Test user configuration using `nix build .#homeConfigurations.<username>.activationPackage` or `home-manager build --flake .#<username>` before deployment
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix build .#homeConfigurations."<user>@<host>".activationPackage` to test a home configuration
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Build a host's NixOS system using `nix build .#nixosConfigurations.<host>.config.system.build.toplevel`
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix flake show` to display the structure and available outputs in a Nix flake
Applied to files:
lib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Provide the `devenv-root` input override for `nix flake check` with path `file+file://$PWD/.devenv/root`
Applied to files:
lib/nu-lib/flake.nu
📚 Learning: 2026-03-23T09:37:43.263Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: flake/ci/scripts/setup-attic.nu:20-21
Timestamp: 2026-03-23T09:37:43.263Z
Learning: In `flake/ci/scripts/setup-attic.nu`, the netrc file path (e.g. `/tmp/netrc`) must always be explicitly defined in code on both the write and read sides, so using a predictable location is intentional and unavoidable. Flagging this as a security issue is not applicable in this context.
Applied to files:
lib/nu-lib/flake.nulib/nu-lib/lib.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake.lock : The `flake.lock` file must be committed to version control to maintain reproducible builds
Applied to files:
lib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Remove unused let bindings
Applied to files:
lib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: Use git status and git diff commands to identify changed files before testing
Applied to files:
lib/nu-lib/flake.nu
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Check for infinite recursion by examining recent changes for circular imports between modules or option definitions that reference themselves
Applied to files:
lib/nu-lib/flake.nulib/nu-lib/lib.nu
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/nixos/** : NixOS flake modules should be organized in the `flake/nixos/` directory
Applied to files:
lib/nu-lib/flake.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Avoid using `with` at module level as it pollutes scope and hides dependencies
Applied to files:
lib/nu-lib/lib.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : When a new module isn't being found, verify the imports list in the parent module, check that the file path is correct (use kebab-case), and ensure the module is syntactically valid
Applied to files:
lib/nu-lib/lib.nuflake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Always use `inherit` to bring functions and values into scope instead of manual assignment
Applied to files:
lib/nu-lib/lib.nu
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix log` command to view build logs for failed derivations to diagnose build errors
Applied to files:
lib/nu-lib/lib.nu
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Use `nix log <drv>` to view build logs when troubleshooting failed builds
Applied to files:
lib/nu-lib/lib.nu
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Applies to **/*.nix : Verify attribute names, imports, and option paths to resolve 'attribute missing' errors in Nix configurations
Applied to files:
flake/ci/scripts/default.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Applies to **/*.nix : Check for circular dependencies in imports or option definitions as the root cause of infinite recursion errors in Nix
Applied to files:
flake/ci/scripts/default.nix
🔇 Additional comments (17)
.woodpecker/checks.yaml (3)
39-45:nix flake checkfailures are silently ignored.With
failure: ignoreon the "Run flake checks" step (line 42), a broken flake will result in a green CI. This was previously flagged. Consider removing this once the pipeline is stable.
135-138: YAML anchor*envis now properly defined.The
&envanchor at lines 2-4 definesBASE_BRANCHandBRANCH, so the<<: *envmerge at line 136 will work correctly. This addresses the previous critical issue.
90-95: Experimental pipe operator feature is already enabled in the CI image.The
lix-woodpeckerimage used in.woodpecker/checks.yamlincludespipe-operatorsin itsextra-experimental-featuresconfiguration, so no additional setup is required. The code at lines 95 and 107 will evaluate correctly.> Likely an incorrect or invalid review comment.flake/ci/scripts/update-matrix.nu (1)
1-51: LGTM with the fixes from previous reviews.The script correctly implements matrix updating logic:
- Parameter typo fixed (
eval_expression)- Uses standard
updateinstead of non-existentupdate-in- Proper validation for workflow file existence and YAML structure
- Handles deduplication and sorting of matrix entries
lib/package.nix (2)
64-70: Clarifying comment addresses the checkPhase usage concern.The comment at line 64 explains that
checkPhaseis repurposed becausewriteTextFiledoesn't supportbuildPhase. This is an acceptable workaround given the constraints of the derivation builder being used.
24-36: Good refactor to support shared library sources.The new
libSourceparameter and computedlibStore/sourceStorepaths enable cleaner sharing of Nu library code across CI and dev scripts. The fallback tosourceStore + "/lib"whenlibSourceis null maintains backwards compatibility.lib/nu-lib/lib.nu (1)
19-40: Security and correctness fixes from previous reviews applied.The
check_required_varsfunction now:
- Logs only variable presence, not values (line 26) — addresses token leakage concern
- Exits with code 1 when required vars are missing (line 36) — ensures CI fails correctly
lib/nu-lib/flake.nu (3)
141-152:get_flake_inputnow correctly uses theinput_nameparameter.The jq invocation properly passes
--arg input_name $input_nameand uses$input_namethroughout the query instead of hardcodingnixpkgs. This addresses the previous review concern.
154-177: Temp file cleanup and unused variable removal applied.
- Unused
head_commitvariable removedrm -f $prev_lock_fileadded at line 166 for proper cleanup
179-212:check_file_changedimprovements applied.
- Unused
head_commitandhas_changedvariables removed- Temp file cleanup via
rm -f $old_fileat line 203flake/ci/scripts/default.nix (3)
33-36: Missingnameparameter now provided.The
detect-affected-outputsdefinition now correctly includesname = "detect-affected-outputs", addressing the previous critical issue.
38-44:fdruntime dependency now included.The
discover-packagesoutput now correctly specifiesruntimeInputs = [ pkgs.fd ]to support thefd --type finvocation in the Nushell script.
8-9: Good refactoring with sharedlibSourceandsourceRoot.Centralising these bindings and using
inheritacross all script definitions reduces duplication and ensures consistency..woodpecker/ci-packages.yaml (2)
60-60:--jsonflag now included fordiscover-packages.This addresses the previous critical issue where jq parsing would fail without JSON output.
84-88: Correct approach: file-based gating in commands instead ofwhen.path.The
.do-buildmarker check is correctly placed in thecommandssection rather than usingwhen.path, which only evaluates git changesets at trigger time..woodpecker/ci-homes.yaml (2)
61-64: Correct approach: file-based gating in commands.The
.do-buildcheck is correctly implemented in the commands section rather than usingwhen.path, which wouldn't detect runtime-created files.
66-68: LGTM: Build steps use correct flake output path.The build commands correctly invoke
setup-attic,archive-flakes, and build the home configuration using the proper flake output path.#homeConfigurations.${HOME}.activationPackage.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (2)
.woodpecker/ci-hosts.yaml (1)
40-48:⚠️ Potential issue | 🔴 CriticalMissing required
nixosConfigurationsargument and incorrect flag name.The
detect-affected-outputsscript requires a positionaltypeargument as the first parameter (seeflake/ci/scripts/detect-affected-outputs.nuline 8:type: string). Additionally:
- Uses
--output(singular) but the script expects--outputs(plural)jq 'index($host)'expects an array but the script returns an object keyed by output name🐛 Proposed fix
RANGE="$${CI_PREV_COMMIT_SHA}..$${CI_COMMIT_SHA}" - AFFECTED=$(nix run .#detect-affected-outputs -- --json --range "$${RANGE}" --output "$${HOST}" 2>/dev/null || echo "[]") - if echo "$${AFFECTED}" | jq -e --arg host "$${HOST}" 'index($host)' > /dev/null 2>&1; then + AFFECTED=$(nix run .#detect-affected-outputs -- nixosConfigurations --json --range "$${RANGE}" --outputs "$${HOST}" 2>/dev/null || echo "{}") + if echo "$${AFFECTED}" | jq -e --arg host "$${HOST}" 'has($host)' > /dev/null 2>&1; then🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.woodpecker/ci-hosts.yaml around lines 40 - 48, The detect-affected-outputs invocation is missing its required positional "type" argument and uses the wrong flag/JSON test: pass the required type as the first argument to the script invocation, replace the singular --output with --outputs, and change the jq test that currently uses index($host) to test for object keys (e.g. has($host)) so it works with the object keyed by output name; update the call that sets AFFECTED and the conditional that checks it (references: detect-affected-outputs script, variables RANGE, HOST, AFFECTED, and SHOULD_BUILD)..woodpecker/ci-homes.yaml (1)
42-50:⚠️ Potential issue | 🔴 CriticalJSON output mismatch:
detect-affected-outputsreturns an object, not an array.From
flake/ci/scripts/detect-affected-outputs.nulines 209-228, the--jsonoutput is an object keyed by output name (e.g.,{"racci": ["file1.nix", ...]}), not an array. Thejq 'index($home)'function only works on arrays.Additionally,
$${HOME}is passed as a positional argument which becomes a file path filter, not an output filter. Use--outputsto filter specific outputs.🐛 Proposed fix
RANGE="$${CI_PREV_COMMIT_SHA}..$${CI_COMMIT_SHA}" - AFFECTED=$(nix run .#detect-affected-outputs -- homeConfigurations --json --range "$${RANGE}" "$${HOME}" 2>/dev/null || echo "[]") - if echo "$${AFFECTED}" | jq -e --arg home "$${HOME}" 'index($home)' > /dev/null 2>&1; then + AFFECTED=$(nix run .#detect-affected-outputs -- homeConfigurations --json --range "$${RANGE}" --outputs "$${HOME}" 2>/dev/null || echo "{}") + if echo "$${AFFECTED}" | jq -e --arg home "$${HOME}" 'has($home)' > /dev/null 2>&1; then🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.woodpecker/ci-homes.yaml around lines 42 - 50, The script assumes detect-affected-outputs --json returns an array; instead treat it as an object: call the tool with --outputs "$HOME" (not as a positional arg) so it filters by output name, set AFFECTED to "{}" on failure, and change the jq test to check for an object key (e.g., use jq -e --arg home "$HOME" 'has($home)') to decide whether to set SHOULD_BUILD; update references to RANGE, AFFECTED, HOME, detect-affected-outputs, and SHOULD_BUILD accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.woodpecker/checks.yaml:
- Around line 134-139: The echo uses an undefined ${PACKAGE} in the commands
block (the git rev-parse HEAD ... grep check), causing an empty/invalid
substitution; fix by either exporting/setting PACKAGE earlier in the pipeline or
by removing/rewriting the variable from the message (e.g., change the echo to a
generic message like "No changes detected, skipping PR creation.") and ensure
any chosen name matches the environment variable you actually set (reference the
commands block and the PACKAGE symbol when making the change).
- Around line 86-101: The current Nix expressions call builtins.filter on
.#packages.x86_64-linux (an attrset), causing a type error; replace the pattern
with builtins.filterAttrs and then extract names with builtins.attrNames. For
example, change uses of builtins.filter (...) |> builtins.attrNames to
builtins.attrNames (builtins.filterAttrs .#packages.x86_64-linux (name: pkg:
<predicate using pkg>)), and apply this to both occurrences (the discovery
predicate and the p.passthru ? update-script predicate) so you filter the
attrset correctly before converting to a list of package names.
In `@flake/ci/scripts/eval.nix`:
- Around line 67-75: The pattern match in positionFromMeta can return null
causing builtins.elemAt to fail; update positionFromMeta to check whether parts
is null before indexing: after computing parts = builtins.match "(.*):([0-9]+)"
pkg.meta.position, set file to a safe fallback (e.g., pkg.meta.position or "" )
when parts == null and set line to null or a safe default when parts == null,
and only call builtins.elemAt/builtins.fromJSON when parts is non-null;
reference positionFromMeta, pkg.meta.position, and the parts binding when
applying this guard.
In `@flake/dev/treefmt.nix`:
- Line 22: prettier.enable = true currently enables Prettier broadly and
conflicts with Biome and markdown formatters; update the Prettier block to set
explicit includes so it only formats YAML (e.g., add an includes = ["*.yaml"]
entry), leaving Biome (refer to biome.includes) to handle CSS/JS/JSON and
mdformat/mdsh to handle markdown; locate the prettier configuration in the same
Nix attribute that contains prettier.enable and add the includes array limited
to the YAML pattern to avoid overlap.
---
Duplicate comments:
In @.woodpecker/ci-homes.yaml:
- Around line 42-50: The script assumes detect-affected-outputs --json returns
an array; instead treat it as an object: call the tool with --outputs "$HOME"
(not as a positional arg) so it filters by output name, set AFFECTED to "{}" on
failure, and change the jq test to check for an object key (e.g., use jq -e
--arg home "$HOME" 'has($home)') to decide whether to set SHOULD_BUILD; update
references to RANGE, AFFECTED, HOME, detect-affected-outputs, and SHOULD_BUILD
accordingly.
In @.woodpecker/ci-hosts.yaml:
- Around line 40-48: The detect-affected-outputs invocation is missing its
required positional "type" argument and uses the wrong flag/JSON test: pass the
required type as the first argument to the script invocation, replace the
singular --output with --outputs, and change the jq test that currently uses
index($host) to test for object keys (e.g. has($host)) so it works with the
object keyed by output name; update the call that sets AFFECTED and the
conditional that checks it (references: detect-affected-outputs script,
variables RANGE, HOST, AFFECTED, and SHOULD_BUILD).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 294e2d84-4765-4204-b338-147c2aeada33
📒 Files selected for processing (15)
.github/actions/setup-nix/action.yaml.github/workflows/ci.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.woodpecker/ci-packages.yamlAGENTS.mddocs/src/SUMMARY.mddocs/src/components/io_guardian.mddocs/src/components/server_monitoring.mddocs/src/development/declarative_gnome_dconf.mddocs/src/modules/flake/allocations.mddocs/src/modules/nixos/services.mdflake/ci/scripts/eval.nixflake/dev/treefmt.nix
💤 Files with no reviewable changes (2)
- .github/actions/setup-nix/action.yaml
- .github/workflows/ci.yaml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
🧰 Additional context used
📓 Path-based instructions (6)
docs/src/**/*.md
📄 CodeRabbit inference engine (.opencode/skills/docs/SKILL.md)
docs/src/**/*.md: Create or update Markdown files indocs/srcfollowing the documentation workflow: analyze changes, identify impact on documentation files, draft content with underscore filenames, updatedocs/src/SUMMARY.md, and verify Nix code examples are valid
Keep documentation explanations concise and focus on why something is configured a certain way rather than just what the code does
Files:
docs/src/development/declarative_gnome_dconf.mddocs/src/modules/nixos/services.mddocs/src/modules/flake/allocations.mddocs/src/SUMMARY.mddocs/src/components/io_guardian.mddocs/src/components/server_monitoring.md
docs/**
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Project documentation should be maintained in the
docs/directory
Files:
docs/src/development/declarative_gnome_dconf.mddocs/src/modules/nixos/services.mddocs/src/modules/flake/allocations.mddocs/src/SUMMARY.mddocs/src/components/io_guardian.mddocs/src/components/server_monitoring.md
docs/src/SUMMARY.md
📄 CodeRabbit inference engine (.opencode/skills/docs/SKILL.md)
Ensure new documentation files are registered in
docs/src/SUMMARY.mdto maintain the book structure
Files:
docs/src/SUMMARY.md
**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/building/SKILL.md)
Use
nix fmtto format Nix code and check syntax
**/*.nix: Runnix fmt <paths...>after making any changes to ensure consistent formatting
Use 2 spaces for indentation in Nix files
Use kebab-case for Nix file and directory names
Use camelCase for Nix attributes (e.g.,myOption,enableFeature)
Use camelCase for Nix option paths (e.g.,services.myService.enable)
Prefer minimal comments; code should be self-explanatory, using comments to explain why, not what
Prefer relative imports over absolute imports (e.g.,./modules/foo.nix)
Group imports at the top of the Nix file and use list format for multiple imports
When generating JSON, YAML, or other structured formats, define as Nix attribute sets and convert using builtins functions (e.g.,builtins.toJSON), rather than using inline string literals
Follow the standard module structure pattern withconfig,lib,pkgsdestructuring,letbindings for module configuration, andoptions/configsections
Useletbindings withinheritfor importing functions from libraries (e.g.,inherit (lib) mkIf mkEnableOption)Run
nix fmtto format code before submitting changes
**/*.nix: Usebuiltins.traceto add trace statements for seeing values during Nix evaluation, withbuiltins.toJSONfor complex attribute sets
Check for circular dependencies in imports or option definitions as the root cause of infinite recursion errors in Nix
Verify attribute names, imports, and option paths to resolve 'attribute missing' errors in Nix configurationsRun
nix fmton changed Nix files after modifying modules
**/*.nix: Declare secrets in Nix usingsops.secretswith the secret path as the key
Specify custom permissions for secrets usingowner,group, andmodeattributes in sops.secrets declarations
Usesops.templatesto combine multiple secrets into configuration files with placeholders
AddrestartUnitsto secret declarations to automatically restart services when secrets change
Use empty `k...
Files:
flake/dev/treefmt.nixflake/ci/scripts/eval.nix
flake/dev/**
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Development shell, CI scripts, and formatting utilities should be organized in the
flake/dev/directory
Files:
flake/dev/treefmt.nix
flake/ci/**
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
CI-specific flake definitions and scripts should be located in the
flake/ci/directory
Files:
flake/ci/scripts/eval.nix
🧠 Learnings (101)
📓 Common learnings
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Run `nix fmt <changed-files>` to fix Nix formatting failures in CI checks
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to home/*/hm-config.nix : User-specific Home-Manager configurations should be placed in `home/<username>/` with `hm-config.nix` as the entry point
Applied to files:
docs/src/development/declarative_gnome_dconf.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to home/*/*.nix : Machine-specific user configuration overrides should be placed in `home/<username>/<hostname>.nix`
Applied to files:
docs/src/development/declarative_gnome_dconf.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to home/shared/desktop/** : Shared desktop environment configurations should be in `home/shared/desktop/`
Applied to files:
docs/src/development/declarative_gnome_dconf.md
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Applies to home/*/[!.]*@(hm-config|os-config|secrets).nix : Create host-specific configuration files named `<hostname>.nix` in the user directory (`home/<username>/<hostname>.nix`), containing Home-Manager configuration with user-specific git settings, imports of shared features, and host-specific customizations
Applied to files:
docs/src/development/declarative_gnome_dconf.mddocs/src/components/server_monitoring.md.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Applies to home/*/os-config.nix : Create `os-config.nix` in `home/<username>/` for optional NixOS settings that should apply to all hosts where the user exists, using NixOS config syntax rather than Home-Manager
Applied to files:
docs/src/development/declarative_gnome_dconf.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to home/*/os-config.nix : User OS configuration applied to all machines should be defined in `home/<username>/os-config.nix`
Applied to files:
docs/src/development/declarative_gnome_dconf.md
📚 Learning: 2026-03-01T12:24:57.319Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/hosts/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:57.319Z
Learning: Applies to home/*/**.nix : Create `home/<username>/<hostname>.nix` files to assign users to hosts, which enables auto-detection and inclusion of the user's home-manager configuration
Applied to files:
docs/src/development/declarative_gnome_dconf.md.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Applies to home/*/hm-config.nix : Create `hm-config.nix` in `home/<username>/` as the main Home-Manager entry point containing shared configuration across all hosts for that user
Applied to files:
docs/src/development/declarative_gnome_dconf.md
📚 Learning: 2026-03-01T12:25:06.603Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/modules/SKILL.md:0-0
Timestamp: 2026-03-01T12:25:06.603Z
Learning: Applies to modules/home-manager/**/*.nix : Use `user.<name>` namespace for user-specific options in Home-Manager modules
Applied to files:
docs/src/development/declarative_gnome_dconf.md
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Applies to home/*/features/**/*.nix : User's feature modules should be organized in a `features/` directory within the user directory (`home/<username>/features/`)
Applied to files:
docs/src/development/declarative_gnome_dconf.md
📚 Learning: 2026-03-01T12:24:45.167Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/docs/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:45.167Z
Learning: Applies to docs/src/**/*.md : Create or update Markdown files in `docs/src` following the documentation workflow: analyze changes, identify impact on documentation files, draft content with underscore filenames, update `docs/src/SUMMARY.md`, and verify Nix code examples are valid
Applied to files:
docs/src/modules/nixos/services.mdAGENTS.md.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:27:29.965Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-01T12:27:29.965Z
Learning: Applies to **/*.nix : Documentation in docs/ MUST be updated simultaneously with code changes to .nix files
Applied to files:
docs/src/modules/nixos/services.md
📚 Learning: 2026-03-01T12:27:29.965Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-01T12:27:29.965Z
Learning: Applies to **/*.nix : All affected configurations MUST be tested before completing any task, using the test agent and testing skill to identify affected configurations
Applied to files:
AGENTS.md.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to flake.nix : Use `./flake/ci/detect-affected-outputs.nu nixosConfigurations --json` and `./flake/ci/detect-affected-outputs.nu homeConfigurations --json` to identify which outputs are affected by dirty files in CI
Applied to files:
AGENTS.mddocs/src/modules/flake/allocations.mdflake/dev/treefmt.nixflake/ci/scripts/eval.nix.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting only hosts, build at least one affected host configuration using 'nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel'
Applied to files:
AGENTS.md.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Use the module-graph script (./flake/dev/scripts/module-graph.nu) to determine which hosts and homes are affected by your changes
Applied to files:
AGENTS.md.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For flake.nix or flake.lock changes, run a full flake check in addition to building representative configs
Applied to files:
AGENTS.md.woodpecker/checks.yaml.woodpecker/ci-packages.yaml
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Run `nix fmt <changed-files>` to fix Nix formatting failures in CI checks
Applied to files:
AGENTS.mdflake/dev/treefmt.nix.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:25:06.603Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/modules/SKILL.md:0-0
Timestamp: 2026-03-01T12:25:06.603Z
Learning: Applies to **/*.nix : Run `nix fmt` on changed Nix files after modifying modules
Applied to files:
AGENTS.mdflake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake.nix : Top-level flake definitions and inputs/outputs configuration should be placed in `flake.nix`
Applied to files:
AGENTS.mddocs/src/modules/flake/allocations.mdflake/dev/treefmt.nixflake/ci/scripts/eval.nix.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to home/**/*.nix : Test at least one affected home configuration before submitting changes
Applied to files:
AGENTS.md.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Build a host's NixOS system using `nix build .#nixosConfigurations.<host>.config.system.build.toplevel`
Applied to files:
AGENTS.md.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel` to test a host configuration
Applied to files:
AGENTS.md.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix flake check --override-input devenv-root "file+file://$PWD/.devenv/root"` to perform a full flake check
Applied to files:
AGENTS.mdflake/ci/scripts/eval.nix.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Test user configuration using `nix build .#homeConfigurations.<username>.activationPackage` or `home-manager build --flake .#<username>` before deployment
Applied to files:
AGENTS.md.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Build a Home-Manager activation using `nix build .#homeConfigurations.<user>@<host>.activationPackage`
Applied to files:
AGENTS.md.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Run `nix build .#homeConfigurations."<user>@<host>".activationPackage` to test a home configuration
Applied to files:
AGENTS.md.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Use `nix eval .#nixosConfigurations.<host>.config.system.build.toplevel --apply 'x: "ok"'` to check if Nix expressions evaluate correctly
Applied to files:
AGENTS.mdflake/ci/scripts/eval.nix.woodpecker/checks.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to {flake.nix,flake.lock} : Run `nix flake check` (with devenv-root override) before submitting changes
Applied to files:
AGENTS.mdflake/dev/treefmt.nixflake/ci/scripts/eval.nix.woodpecker/checks.yaml.woodpecker/ci-packages.yaml
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix build -L` for verbose build output and `nix develop` to enter build environments for debugging
Applied to files:
AGENTS.md
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Based on module-graph output, test at least one affected home configuration if the changed files affect homes only
Applied to files:
AGENTS.md.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/nixos/** : NixOS flake modules should be organized in the `flake/nixos/` directory
Applied to files:
AGENTS.mddocs/src/modules/flake/allocations.md
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : Follow the standard module structure pattern with `config`, `lib`, `pkgs` destructuring, `let` bindings for module configuration, and `options`/`config` sections
Applied to files:
AGENTS.mddocs/src/modules/flake/allocations.md
📚 Learning: 2026-03-01T12:24:45.167Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/docs/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:45.167Z
Learning: Applies to docs/src/SUMMARY.md : Ensure new documentation files are registered in `docs/src/SUMMARY.md` to maintain the book structure
Applied to files:
docs/src/modules/flake/allocations.md
📚 Learning: 2026-03-01T12:25:06.603Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/modules/SKILL.md:0-0
Timestamp: 2026-03-01T12:25:06.603Z
Learning: Applies to modules/nixos/**/*.nix : Create NixOS modules at `modules/nixos/<category>/<name>.nix` with standard pattern including options definition, lib imports (mkEnableOption, mkOption, mkIf, types), config variable binding, and conditional config application using mkIf
Applied to files:
docs/src/modules/flake/allocations.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to modules/nixos/** : Reusable NixOS module fragments should be placed in `modules/nixos/` directory
Applied to files:
docs/src/modules/flake/allocations.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to lib/builders/** : Custom system and home builders should be implemented in `lib/builders/` directory with `mkSystem.nix` and `mkHome.nix` as entry points
Applied to files:
docs/src/modules/flake/allocations.md
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Follow the standard NixOS module structure pattern with config, lib, pkgs parameters and proper `let`/`in` blocks
Applied to files:
docs/src/modules/flake/allocations.md
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Avoid hardcoded paths that should be configurable options
Applied to files:
docs/src/modules/flake/allocations.mdflake/dev/treefmt.nixflake/ci/scripts/eval.nix.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to modules/home-manager/default.nix : Home-Manager modules should be exported through `modules/home-manager/default.nix`
Applied to files:
docs/src/modules/flake/allocations.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to home/*/secrets.yaml : User-specific secrets should be placed in `home/<user>/secrets.yaml`
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:26:25.327Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/secrets/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:25.327Z
Learning: Applies to home/*/secrets.yaml : Store user-specific secrets in `home/<username>/secrets.yaml` for single users
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:24:57.319Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/hosts/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:57.319Z
Learning: Applies to hosts/{server,desktop,laptop}/*/secrets.yaml : Each host requires a `secrets.yaml` file containing SOPS-encrypted secrets (SSH key, passwords)
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:26:25.327Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/secrets/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:25.327Z
Learning: Applies to **/secrets.yaml : Store secrets in YAML format with optional hierarchical nesting for organized key access
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:26:25.327Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/secrets/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:25.327Z
Learning: Applies to hosts/secrets.yaml : Store global secrets in `hosts/secrets.yaml` that all hosts need to access
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Applies to home/*/secrets.yaml : Create `secrets.yaml` in `home/<username>/` for user-specific secrets in YAML format and update `.sops.yaml` to include the user's age key for their secrets path
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:26:25.327Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/secrets/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:25.327Z
Learning: Applies to hosts/server/secrets.yaml : Store server-scoped secrets in `hosts/server/secrets.yaml` for all server hosts
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to hosts/{desktop,laptop,server}/*/secrets.yaml : Host-specific secrets should be placed in `hosts/<type>/<hostname>/secrets.yaml`
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:25:06.603Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/modules/SKILL.md:0-0
Timestamp: 2026-03-01T12:25:06.603Z
Learning: Applies to modules/nixos/host/**/*.nix : Use `host.<name>` namespace for host-specific options in NixOS modules
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to hosts/{desktop,laptop,server}/** : Per-machine NixOS configurations should be organized in `hosts/<type>/<hostname>/` where type is desktop, laptop, or server
Applied to files:
docs/src/components/server_monitoring.md.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:25:06.603Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/modules/SKILL.md:0-0
Timestamp: 2026-03-01T12:25:06.603Z
Learning: Applies to modules/nixos/server/**/*.nix : Use `server.<name>` namespace for server cluster options in NixOS modules
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:24:57.319Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/hosts/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:57.319Z
Learning: Applies to hosts/{server,desktop,laptop}/*/default.nix : Each host requires a `default.nix` file as the main configuration entry point
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to hosts/{desktop,laptop,server}/*/default.nix : Host system configurations should follow the pattern `hosts/<type>/<hostname>/default.nix`
Applied to files:
docs/src/components/server_monitoring.md.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:24:57.319Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/hosts/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:57.319Z
Learning: Host auto-discovery scans `hosts/` for subdirectories, filters out `shared/` and `secrets.yaml`, and automatically registers each as a nixosConfiguration
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:24:57.319Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/hosts/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:57.319Z
Learning: Applies to hosts/{server,desktop,laptop}/*/default.nix : Host `default.nix` files must import `${modulesPath}/virtualisation/proxmox-lxc.nix` for LXC containers or `./hardware.nix` for physical machines
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:24:57.319Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/hosts/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:57.319Z
Learning: Applies to hosts/server/*/default.nix : Server hosts must set `host.device.isHeadless = true` in their configuration
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:25:06.603Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/modules/SKILL.md:0-0
Timestamp: 2026-03-01T12:25:06.603Z
Learning: Applies to modules/nixos/services/**/*.nix : Use `services.<name>` namespace for system services in NixOS modules
Applied to files:
docs/src/components/server_monitoring.md
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to **/*.nix : Run `nix fmt` to format code before submitting changes
Applied to files:
flake/dev/treefmt.nix.woodpecker/checks.yaml.woodpecker/ci-packages.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: Applies to **/*.nix : Always ensure formatting is correct by running 'nix fmt' on changed files
Applied to files:
flake/dev/treefmt.nix.woodpecker/ci-packages.yaml
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Applies to **/*.nix : Use `nix fmt` to format Nix code and check syntax
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : Run `nix fmt <paths...>` after making any changes to ensure consistent formatting
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Code MUST pass `nix fmt` formatting validation
Applied to files:
flake/dev/treefmt.nix.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:16.409Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/security.md:0-0
Timestamp: 2026-03-01T12:27:16.409Z
Learning: Applies to **/*.nix : Never pass secrets via command line arguments (visible in process list); use secretFile, environmentFile, or sops-managed files instead
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:16.409Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/security.md:0-0
Timestamp: 2026-03-01T12:27:16.409Z
Learning: Applies to **/*.nix : Never hardcode passwords, API keys, or tokens in plain text; ensure sensitive data is stored in secrets.yaml and referenced through sops declarations
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:29.965Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-01T12:27:29.965Z
Learning: Applies to **/*.nix : All code MUST be formatted with nix fmt before completing any task
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:27:16.409Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/security.md:0-0
Timestamp: 2026-03-01T12:27:16.409Z
Learning: Applies to **/*.nix : Store secrets using sops-nix with age encryption in secrets.yaml files at appropriate scopes (global at hosts/secrets.yaml, server-level at hosts/server/secrets.yaml, host-specific at hosts/<type>/<hostname>/secrets.yaml, and user-specific at home/<username>/secrets.yaml)
Applied to files:
flake/dev/treefmt.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix eval` command to test expressions without building, including checking option evaluation and tracing output
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:15.388Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/building/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:15.388Z
Learning: Use `nix flake check` to evaluate all configurations and run linters
Applied to files:
flake/ci/scripts/eval.nix.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Applies to **/*.nix : Use `builtins.trace` to add trace statements for seeing values during Nix evaluation, with `builtins.toJSON` for complex attribute sets
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: Use 'nix eval .#... --apply "x: \"ok\""' for quick evaluation checks without building
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Applies to **/*.nix : Verify attribute names, imports, and option paths to resolve 'attribute missing' errors in Nix configurations
Applied to files:
flake/ci/scripts/eval.nix.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Use intermediate bindings instead of deeply nested attribute access for improved readability
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Use `nix eval .#nixosConfigurations.<host>.config.services --apply 'builtins.attrNames'` to diagnose 'attribute not found' errors by listing available attributes
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:22.881Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/code-style/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:22.881Z
Learning: Applies to **/*.nix : When generating JSON, YAML, or other structured formats, define as Nix attribute sets and convert using builtins functions (e.g., `builtins.toJSON`), rather than using inline string literals
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Avoid inline JSON/YAML strings; use `builtins.toJSON` for structured data
Applied to files:
flake/ci/scripts/eval.nix.woodpecker/ci-packages.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : When generating JSON/YAML, define as Nix attribute sets and convert using `builtins.toJSON` instead of inline strings
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Always use `mkIf` guards on config sections that are conditionally applied
Applied to files:
flake/ci/scripts/eval.nix.woodpecker/ci-packages.yaml
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : When assertion failures occur, read the assertion message carefully as it explains what configuration constraint is not being met or what required option is missing
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix eval .#...options --apply 'builtins.attrNames'` to list all available options in a Nix namespace
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : When a new module isn't being found, verify the imports list in the parent module, check that the file path is correct (use kebab-case), and ensure the module is syntactically valid
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Applies to **/*.nix : Check for circular dependencies in imports or option definitions as the root cause of infinite recursion errors in Nix
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Ensure all used functions are properly inherited to avoid circular imports and hidden dependencies
Applied to files:
flake/ci/scripts/eval.nix.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Prefer relative imports (e.g., `./modules/foo.nix`) over absolute paths
Applied to files:
flake/ci/scripts/eval.nix
📚 Learning: 2026-03-01T12:24:29.910Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/contributing/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:29.910Z
Learning: Applies to hosts/**/*.nix : Test at least one affected host configuration before submitting changes
Applied to files:
.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:26:14.740Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/project-structure/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:14.740Z
Learning: Applies to flake/ci/** : CI-specific flake definitions and scripts should be located in the `flake/ci/` directory
Applied to files:
.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to flake.{nix,lock} : Verify `flake.lock` conflicts by checking if inputs were updated and ensuring compatibility between updated inputs
Applied to files:
.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:26:01.611Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/packages/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:01.611Z
Learning: Applies to pkgs/*/default.nix : Include passthru.updateScript in package definitions using nix-update-script with extraArgs for automatic update support
Applied to files:
.woodpecker/checks.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Based on module-graph output, test at least one affected host AND one affected home configuration if the changed files affect both
Applied to files:
.woodpecker/checks.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:24:38.213Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/debugging/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:38.213Z
Learning: Use `nix flake check --no-build` to verify flake syntax validity without building
Applied to files:
.woodpecker/checks.yaml
📚 Learning: 2026-03-18T23:46:49.905Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: .woodpecker/lix.yaml:15-15
Timestamp: 2026-03-18T23:46:49.905Z
Learning: In nix-config repository (.woodpecker/*.yaml), image references intentionally omit explicit tags or digests (e.g., registry.racci.dev/lix-woodpecker without :tag). Do not flag or suggest adding explicit tags or digests to these image references; treat such omissions as intentional and maintain consistency across the CI config.
Applied to files:
.woodpecker/checks.yaml.woodpecker/ci-packages.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting only homes, build at least one affected home configuration using 'nix build .#homeConfigurations.<user>@<host>.activationPackage'
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:02.914Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/nix-review.md:0-0
Timestamp: 2026-03-01T12:27:02.914Z
Learning: Applies to **/*.nix : Verify option type definitions match their usage and configuration values
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:51.425Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/ci-failure.md:0-0
Timestamp: 2026-03-01T12:26:51.425Z
Learning: Applies to **/*.nix : Verify type mismatches by checking option type definitions and the value being provided in NixOS options
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For home-specific changes in home/<user>/, build that user's home config on one host; if shared home files changed, test on multiple hosts
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:26:41.504Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/users/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:41.504Z
Learning: Applies to home/*/ : User directory structure must follow the pattern `home/<username>/` with required files: `hm-config.nix` (main Home-Manager entry point) and `id_ed25519.pub` (SSH public key), plus optional files: `os-config.nix`, `secrets.yaml`, host-specific `<hostname>.nix`, and `features/` directory
Applied to files:
.woodpecker/ci-homes.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For host-specific changes in hosts/<type>/<hostname>/, build that specific host; if shared files changed, check other hosts of the same type
Applied to files:
.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:27:25.837Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/agent/test.md:0-0
Timestamp: 2026-03-01T12:27:25.837Z
Learning: For changes affecting both hosts and homes, build one host AND one home configuration to ensure no regressions
Applied to files:
.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:24:57.319Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/hosts/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:57.319Z
Learning: Applies to hosts/{desktop,laptop}/*/hardware.nix : Physical host machines (desktops/laptops) must include a `hardware.nix` file with hardware-specific configuration
Applied to files:
.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:24:57.319Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/hosts/SKILL.md:0-0
Timestamp: 2026-03-01T12:24:57.319Z
Learning: Use the `new-host.sh` helper script to create new hosts rather than manual creation, which automates directory creation, SSH key generation, default.nix setup, and secrets configuration
Applied to files:
.woodpecker/ci-hosts.yaml
📚 Learning: 2026-03-01T12:26:31.937Z
Learnt from: CR
Repo: DaRacci/nix-config PR: 0
File: .opencode/skills/testing/SKILL.md:0-0
Timestamp: 2026-03-01T12:26:31.937Z
Learning: Based on module-graph output, test at least one affected host configuration if the changed files affect hosts only
Applied to files:
.woodpecker/ci-hosts.yaml
DaRacci
force-pushed
the
push-ssqumvutkzmu
branch
from
March 28, 2026 08:36
d1b33a0 to
cceb2bd
Compare
DaRacci
force-pushed
the
push-ssqumvutkzmu
branch
from
April 1, 2026 12:36
43299aa to
1d9ffb0
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 13
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
docs/site.nix (2)
12-12:⚠️ Potential issue | 🟡 MinorTypo:
builtInputsshould bebuildInputs.This typo means
mdbookwon't be available as a build input. The derivation likely works becausemdbookis accessed via${lib.getExe pkgs.mdbook}directly, but the intended declaration is broken.🐛 Proposed fix
- builtInputs = [ pkgs.mdbook ]; + buildInputs = [ pkgs.mdbook ];🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/site.nix` at line 12, Change the misspelled attribute builtInputs to buildInputs in the Nix derivation so mdbook is correctly declared as a build-time dependency; locate the derivation that currently uses builtInputs = [ pkgs.mdbook ] and replace it with buildInputs = [ pkgs.mdbook ] (ensure any references to lib.getExe pkgs.mdbook remain unchanged).
35-35:⚠️ Potential issue | 🟡 MinorOrphaned command with no effect.
The
${pkgs.fd}/bin/fdline executesfdwithout arguments or capturing output, producing no visible effect. This appears to be leftover or incomplete code.🗑️ Proposed fix — remove or complete the command
- ${pkgs.fd}/bin/fd substituteInPlace ./src/index.md \🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/site.nix` at line 35, The line containing ${pkgs.fd}/bin/fd in docs/site.nix is an orphaned invocation with no effect; either remove that line entirely or replace it with a meaningful usage (for example add fd to buildInputs, reference its path in a command that uses its output, or document its path as a tool requirement). Locate the literal string "${pkgs.fd}/bin/fd" and either delete it or modify surrounding Nix code so fd is properly consumed (e.g., included in buildInputs or invoked with arguments/redirected output)..woodpecker/update.yaml (1)
52-57: 🧹 Nitpick | 🔵 TrivialConsider adding
--labelsand--reviewersfor consistency with other workflows.The
create-prinvocation correctly passes the required--branchand--basearguments. However, comparing with.woodpecker/checks.yaml(lines 142-145), that workflow also passes--labels "automated,merge-queue"and--reviewers "DaRacci". Consider adding these for consistent PR metadata across automated workflows.♻️ Suggested enhancement
nix run .#create-pr -- \ --title "chore(deps): Update flake inputs" \ --body "This PR updates the flake inputs to their latest versions, see individual commits for changes." \ --branch "update/flake-inputs-all" \ - --base "master" + --base "master" \ + --labels "automated,merge-queue" \ + --reviewers "DaRacci"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.woodpecker/update.yaml around lines 52 - 57, Update the `nix run .#create-pr --` invocation to include the same PR metadata flags used in other workflows by adding `--labels "automated,merge-queue"` and `--reviewers "DaRacci"` to the command so the created PRs have consistent labels and reviewers with the `.woodpecker/checks.yaml` behavior.
♻️ Duplicate comments (4)
.woodpecker/ci-homes.yaml (1)
42-45:⚠️ Potential issue | 🔴 CriticalThis gate currently skips affected homes on incremental runs.
detect-affected-outputs --jsonreturns an object keyed by output name, not an array. Withecho "[]"andjq 'index($home)', Lines 44-45 will never recognise an affected home, and detector failures are silently downgraded to "unaffected". Use{}+has($home), and fail closed or build conservatively on detector errors..woodpecker/checks.yaml (1)
97-101:⚠️ Potential issue | 🔴 CriticalThe update-package matrix filter is checking the wrong attribute and can blow up on packages without
passthru.Repo packages expose
passthru.updateScript, but Line 101 checksupdate-scriptand dereferencespassthrubefore the existence test. As written, this can either exclude every valid updateable package or fail evaluation on packages without apassthruattrset.Minimal fix
- "pkgs: builtins.attrNames pkgs |> builtins.filter (name: (pkgs.${name}.passthru ? update-script))" + "pkgs: builtins.attrNames pkgs |> builtins.filter (name: ((pkgs.${name}.passthru or {}) ? updateScript))"Based on learnings: Applies to
pkgs/*/default.nix: Includepassthru.updateScriptin package definitions using nix-update-script with extraArgs for automatic update support.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.woodpecker/checks.yaml around lines 97 - 101, The nix filter is checking the wrong attribute and dereferencing passthru, causing failures for packages without it; update the filter expression used in the matrix command to test for the passtru attribute existence without dereferencing and use the correct camelCase name (updateScript) — e.g. replace the current filter (pkgs.${name}.passthru ? update-script) with a safe existence check like (pkgs.${name}.passthru ? updateScript) inside the builtins.filter lambda so packages without passthru don't cause evaluation errors and valid updateable packages are included.flake/ci/scripts/update-matrix.nu (1)
46-46:⚠️ Potential issue | 🔴 CriticalConvert the dynamic matrix path into a cell-path before calling
update.Line 46 passes a string (
$"matrix.($matrix_key)") toupdate, not a cell-path. That means the rewrite path is wrong as soon as a matrix entry actually needs updating.Minimal fix
- let updated_yaml = $yaml | update $"matrix.($matrix_key)" $new_matrix + let matrix_path = ["matrix", $matrix_key] | into cell-path + let updated_yaml = $yaml | update $matrix_path $new_matrix🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@flake/ci/scripts/update-matrix.nu` at line 46, The update call currently passes a string $"matrix.($matrix_key)" instead of a cell-path; create a cell-path value from that dynamic path and pass the cell-path to update. Concretely, compute a variable (e.g., matrix_path) from the dynamic expression combining "matrix" and $matrix_key, convert that string into a cell-path value, then call update with $yaml, the cell-path variable, and $new_matrix (replacing the current update $"matrix.($matrix_key)" usage). Ensure the symbols referenced are updated_yaml, $yaml, $matrix_key, $new_matrix and the update invocation so the rewrite path is a proper cell-path..woodpecker/ci-hosts.yaml (1)
42-43:⚠️ Potential issue | 🔴 CriticalReplace the jq filter with
has()to check for output existence in the object.The
detect-affected-outputsscript outputs a JSON object keyed by output name (e.g.,{"hostA": [...], "hostB": [...]}), not an array. The current filter'index($host)'searches for an array element and will never match. Use'has($host)'instead to check if the output key exists in the returned object.Current code
AFFECTED=$(nix run .#detect-affected-outputs -- nixosConfigurations --json --range "$${RANGE}" --outputs "$${HOST}" 2>/dev/null || echo "[]") if echo "$${AFFECTED}" | jq -e --arg host "$${HOST}" 'index($host)' > /dev/null 2>&1; thenThe fallback
echo "[]"also doesn't match the actual output structure and should be changed to an empty objectecho "{}".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.woodpecker/ci-hosts.yaml around lines 42 - 43, The AFFECTED capture and jq check are using the wrong JSON shape: change the fallback from echo "[]" to echo "{}" when running detect-affected-outputs, and replace the jq filter 'index($host)' with 'has($host)' so the existence check matches an object keyed by output name; update the invocation that sets AFFECTED (the nix run .#detect-affected-outputs call) and the subsequent if that pipes AFFECTED into jq --arg host to use has($host) instead of index($host).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.gitignore:
- Line 1: The .gitignore entry "result*" is too broad and may ignore files
anywhere; update the ignore rule in .gitignore to scope it to the repo root by
replacing the pattern "result*" with "/result*" so only top-level result
artifacts (e.g., Nix build symlinks) are ignored; locate the "result*" pattern
in .gitignore and change it to "/result*".
In @.woodpecker/checks.yaml:
- Around line 41-46: The run-flake-checks job currently runs plain `nix flake
check`; update the job (identified as run-flake-checks) to invoke the repo's
standard override by replacing the command with `nix flake check
--override-input devenv-root "file+file://$PWD/.devenv/root"` so CI uses the
same devenv-root override as local full-checks and prevents mismatches between
local and CI validation.
- Around line 103-123: Add a pre-push gate job that detects whether the matrix
generation actually produced changes and make push-matrix-updates depend on it;
specifically, create a short step (e.g., "matrix-changes-check") that runs in
the same repo context and exits non-zero unless there are local commits or a
dirty working tree (use git status --porcelain or compare HEAD to the base
branch via git rev-parse/origin/BASE_BRANCH or git diff --quiet), then change
push-matrix-updates to depend_on "matrix-changes-check" (or require its success)
so the appleboy/drone-git-push step only runs when the check proves a
commit/diff exists, preventing force-push when nothing changed.
- Around line 60-67: The GitGuardian job "run-gitguardian" uses
CI_PREV_COMMIT_SHA in the command `ggshield secret scan commit-range` but manual
pipelines set CI_PREV_COMMIT_SHA empty, producing an invalid range; update the
job to either limit execution (change `when: *when_ci`) to only
push/pull_request events, or add a runtime fallback: detect if
CI_PREV_COMMIT_SHA is empty and then run a safe alternative (e.g., `ggshield
secret scan repo` or `ggshield secret scan commit-range HEAD` / full-repo scan)
instead of `ggshield secret scan commit-range $${CI_PREV_COMMIT_SHA}..` so the
step succeeds for manual runs.
In @.woodpecker/ci-packages.yaml:
- Around line 58-66: The current snippet masks discover-packages failures by
piping errors to /dev/null and defaulting AFFECTED to "[]", making eval errors
appear as "not affected"; change the logic so that the discover-packages
invocation (symbol: discover-packages) is not silenced and non-zero exits are
handled explicitly: run nix run .#discover-packages to set AFFECTED and if it
fails (check its exit status) either abort the step (exit with non-zero) or set
SHOULD_BUILD=true and log the error; ensure you keep references to RANGE and
PACKAGE and only fall back to "[]" when you have a valid successful JSON parse,
never on command failure.
In @.woodpecker/lix.yaml:
- Around line 71-73: The publish step's when: evaluate condition references
BUILD_PUBLISH but the earlier step writes SHOULD_PUBLISH to the env file, so the
publish step will never run; fix by making the variable name consistent—either
change the when: evaluate expression to 'SHOULD_PUBLISH == "true"' or update the
earlier "Check for input changes" writes to set BUILD_PUBLISH instead of
SHOULD_PUBLISH (ensure all occurrences of SHOULD_PUBLISH/BUILD_PUBLISH in the
.woodpecker/lix.yaml are updated so they match).
In @.woodpecker/update-packages.yaml:
- Around line 44-52: The "Push to Branch" step is running even when nix-update
made no commit; gate this step so it only runs when an update commit exists by
checking HEAD != BASE_BRANCH (or a marker set by the update step). Modify the
pipeline so the job "Push to Branch" (image appleboy/drone-git-push, branch:
*branch) either has a conditional that checks an env var like UPDATED_COMMIT or
runs a lightweight pre-check (compare git rev-parse HEAD vs git rev-parse
origin/${BASE_BRANCH}) and exits/skips if they are equal; alternatively have the
update step write a marker file/ENV (e.g. UPDATED=true) and require that marker
before executing the push/PR path. Ensure the push only executes when that check
indicates an actual update commit.
In `@flake/ci/scripts/eval.nix`:
- Line 21: The binding flakeOrImportPath redundantly aliases importPath; to
simplify, remove the flakeOrImportPath binding and replace its usages with
importPath (or, if you prefer to keep the alias for future flake URL handling,
add a clarifying comment above flakeOrImportPath explaining its intent); locate
the symbol flakeOrImportPath in the file and either eliminate it and update
references to importPath, or add the explanatory comment next to the
flakeOrImportPath declaration.
In `@flake/ci/scripts/setup-attic.nu`:
- Around line 24-26: The --watch code path invokes bash via the line bash -c
"attic watch-store raccidev:global & disown" but bash isn't in the package
runtime closure; add pkgs.bash to the package's runtimeInputs (the runtimeInputs
attribute in flake/ci/scripts/default.nix for the setup-attic package) so bash
is available at runtime, or alternatively change the nu script's
background-launch to use a shell already provided (e.g., use nohup/sh with &
instead of disown) if you prefer not to add pkgs.bash.
In `@flake/ci/scripts/update-matrix.nu`:
- Around line 47-49: The script incorrectly references Nushell variables without
the `$` prefix; change the lines using updated_yaml and yaml_string to use
`$updated_yaml` and `$yaml_string` so the pipe operations work (e.g., use
`$updated_yaml | to yaml` and `$yaml_string | save --force $workflow_file`),
ensuring variable lookups for the `to yaml` and `save` operations succeed and
match the rest of the file's `$` usage.
In `@flake/dev/treefmt.nix`:
- Line 42: The prettier.includes glob currently uses a redundant brace expansion
("prettier.includes = [ \"*.{yaml}\" ]"); update the pattern to either the
simplified single-extension form "*.yaml" or, if you want to cover both YAML
extensions, change it to a multi-extension brace form "*.{yaml,yml}" so .yaml
(and optionally .yml) files are matched; modify the prettier.includes entry
accordingly (search for the prettier.includes setting in treefmt.nix).
In `@lib/nu-lib/lib.nu`:
- Around line 10-20: Update the mismatched docs to reflect the actual behavior:
in the comment for the module and the setup_logging function replace references
to VERBOSE with DEBUG (or vice-versa if you prefer to change the code instead)
and update the --exit flag comment on export def check_required_vars to state it
exits with code 1; specifically, adjust the doc strings surrounding the export
def setup_logging and the comment on the --exit flag in check_required_vars so
they match the implementation that reads $env.DEBUG and returns exit code 1.
In `@lib/package.nix`:
- Line 21: The parameter libSource is advertised optional but the code
unconditionally computes libStore and runs find ${libStore}, making libSource
effectively required; update the logic around libSource/libStore so the find
invocation is only executed when a lib source was actually provided or exists:
conditionalize the creation/use of libStore (and the find ${libStore} call)
behind a check for libSource != null or a filesystem existence test of
${sourceRoot}/lib, ensuring callers who omit libSource keep the previous
fallback behavior without failing.
---
Outside diff comments:
In @.woodpecker/update.yaml:
- Around line 52-57: Update the `nix run .#create-pr --` invocation to include
the same PR metadata flags used in other workflows by adding `--labels
"automated,merge-queue"` and `--reviewers "DaRacci"` to the command so the
created PRs have consistent labels and reviewers with the
`.woodpecker/checks.yaml` behavior.
In `@docs/site.nix`:
- Line 12: Change the misspelled attribute builtInputs to buildInputs in the Nix
derivation so mdbook is correctly declared as a build-time dependency; locate
the derivation that currently uses builtInputs = [ pkgs.mdbook ] and replace it
with buildInputs = [ pkgs.mdbook ] (ensure any references to lib.getExe
pkgs.mdbook remain unchanged).
- Line 35: The line containing ${pkgs.fd}/bin/fd in docs/site.nix is an orphaned
invocation with no effect; either remove that line entirely or replace it with a
meaningful usage (for example add fd to buildInputs, reference its path in a
command that uses its output, or document its path as a tool requirement).
Locate the literal string "${pkgs.fd}/bin/fd" and either delete it or modify
surrounding Nix code so fd is properly consumed (e.g., included in buildInputs
or invoked with arguments/redirected output).
---
Duplicate comments:
In @.woodpecker/checks.yaml:
- Around line 97-101: The nix filter is checking the wrong attribute and
dereferencing passthru, causing failures for packages without it; update the
filter expression used in the matrix command to test for the passtru attribute
existence without dereferencing and use the correct camelCase name
(updateScript) — e.g. replace the current filter (pkgs.${name}.passthru ?
update-script) with a safe existence check like (pkgs.${name}.passthru ?
updateScript) inside the builtins.filter lambda so packages without passthru
don't cause evaluation errors and valid updateable packages are included.
In @.woodpecker/ci-hosts.yaml:
- Around line 42-43: The AFFECTED capture and jq check are using the wrong JSON
shape: change the fallback from echo "[]" to echo "{}" when running
detect-affected-outputs, and replace the jq filter 'index($host)' with
'has($host)' so the existence check matches an object keyed by output name;
update the invocation that sets AFFECTED (the nix run .#detect-affected-outputs
call) and the subsequent if that pipes AFFECTED into jq --arg host to use
has($host) instead of index($host).
In `@flake/ci/scripts/update-matrix.nu`:
- Line 46: The update call currently passes a string $"matrix.($matrix_key)"
instead of a cell-path; create a cell-path value from that dynamic path and pass
the cell-path to update. Concretely, compute a variable (e.g., matrix_path) from
the dynamic expression combining "matrix" and $matrix_key, convert that string
into a cell-path value, then call update with $yaml, the cell-path variable, and
$new_matrix (replacing the current update $"matrix.($matrix_key)" usage). Ensure
the symbols referenced are updated_yaml, $yaml, $matrix_key, $new_matrix and the
update invocation so the rewrite path is a proper cell-path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: e37f4a9d-1651-48c2-b1f6-801dd024f153
📒 Files selected for processing (48)
.github/actions/setup-nix/action.yaml.github/workflows/ci.yaml.github/workflows/docs.yaml.github/workflows/packages.yaml.github/workflows/update-packages.yaml.gitignore.mergify.yml.opencode/skills/testing/SKILL.md.woodpecker/check-upstream-todos.yaml.woodpecker/check.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.woodpecker/ci-packages.yaml.woodpecker/flake-checker.yaml.woodpecker/lix.yaml.woodpecker/security.yaml.woodpecker/update-packages.yaml.woodpecker/update.yamlAGENTS.mddocs/search.nixdocs/serve.nixdocs/site.nixdocs/src/SUMMARY.mddocs/src/components/io_guardian.mddocs/src/components/server_monitoring.mddocs/src/development/declarative_gnome_dconf.mddocs/src/hosts/overview.mddocs/src/modules/flake/allocations.mddocs/src/modules/home-manager/diy.mddocs/src/modules/nixos/services.mdflake/ci/scripts/default.nixflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/discover-packages.nuflake/ci/scripts/eval.nixflake/ci/scripts/libflake/ci/scripts/setup-attic.nuflake/ci/scripts/update-matrix.nuflake/dev/scripts/default.nixflake/dev/scripts/libflake/dev/treefmt.nixlib/nu-lib/flake.nulib/nu-lib/lib.nulib/package.nixpkgs/drive-stats/default.nixpkgs/helpers/new-host.nixpkgs/list-ephemeral/default.nixpkgs/lix-woodpecker/default.nix
💤 Files with no reviewable changes (9)
- .github/workflows/docs.yaml
- .woodpecker/security.yaml
- .woodpecker/flake-checker.yaml
- .woodpecker/check.yaml
- .woodpecker/check-upstream-todos.yaml
- .github/workflows/update-packages.yaml
- .github/actions/setup-nix/action.yaml
- .github/workflows/packages.yaml
- .github/workflows/ci.yaml
DaRacci
force-pushed
the
push-ssqumvutkzmu
branch
from
April 13, 2026 10:41
1d9ffb0 to
be35d0d
Compare
Contributor
|
Note Unit test generation is a public access feature. Expect some limitations and changes as we gather feedback and continue to improve it. Generating unit tests... This may take up to 20 minutes. |
1 similar comment
Contributor
|
Note Unit test generation is a public access feature. Expect some limitations and changes as we gather feedback and continue to improve it. Generating unit tests... This may take up to 20 minutes. |
Contributor
|
✅ Created PR with unit tests: #564 |
Owner
Author
|
@coderabbitai review |
Contributor
✅ Actions performedReview triggered.
|
Contributor
|
✅ Unit tests committed locally. Commit: |
Owner
Author
|
@coderabbitai help |
Contributor
ChatThere are 3 ways to chat with CodeRabbit:
CodeRabbit commands
Other keywords and placeholders
CodeRabbit configuration file (
|
Owner
Author
|
@coderabbitai configuration |
Contributor
|
Configuration used: Organization UI CodeRabbit configurationlanguage: en-AU
tone_instructions: ''
early_access: true
enable_free_tier: true
inheritance: false
reviews:
profile: assertive
request_changes_workflow: true
high_level_summary: true
high_level_summary_instructions: ''
high_level_summary_placeholder: '@coderabbitai summary'
high_level_summary_in_walkthrough: true
auto_title_placeholder: '@coderabbitai'
auto_title_instructions: ''
review_status: true
review_details: true
commit_status: true
fail_commit_status: false
collapse_walkthrough: true
changed_files_summary: true
sequence_diagrams: true
estimate_code_review_effort: true
assess_linked_issues: true
related_issues: true
related_prs: true
suggested_labels: true
labeling_instructions: []
auto_apply_labels: true
suggested_reviewers: true
auto_assign_reviewers: true
in_progress_fortune: true
poem: true
enable_prompt_for_ai_agents: true
path_filters:
- '!openspec/**'
path_instructions: []
abort_on_close: true
disable_cache: false
slop_detection:
enabled: true
auto_review:
enabled: true
description_keyword: ''
auto_incremental_review: true
auto_pause_after_reviewed_commits: 5
ignore_title_keywords:
- 'chore(deps): Update flake inputs'
labels:
- '!automated'
- '!dependencies'
drafts: false
base_branches: []
ignore_usernames: []
finishing_touches:
docstrings:
enabled: true
unit_tests:
enabled: true
simplify:
enabled: false
custom: []
pre_merge_checks:
override_requested_reviewers_only: false
docstrings:
mode: warning
threshold: 80
title:
mode: warning
requirements: ''
description:
mode: warning
issue_assessment:
mode: warning
custom_checks: []
tools:
ast-grep:
rule_dirs: []
util_dirs: []
essential_rules: true
packages: []
shellcheck:
enabled: true
ruff:
enabled: true
markdownlint:
enabled: true
github-checks:
enabled: true
timeout_ms: 90000
languagetool:
enabled: true
enabled_rules: []
disabled_rules: []
enabled_categories: []
disabled_categories: []
enabled_only: false
level: default
biome:
enabled: true
hadolint:
enabled: false
swiftlint:
enabled: false
phpstan:
enabled: false
level: default
phpmd:
enabled: false
phpcs:
enabled: false
golangci-lint:
enabled: false
yamllint:
enabled: true
gitleaks:
enabled: true
trufflehog:
enabled: true
checkov:
enabled: true
tflint:
enabled: true
detekt:
enabled: false
eslint:
enabled: false
flake8:
enabled: true
fortitudeLint:
enabled: false
rubocop:
enabled: false
buf:
enabled: false
regal:
enabled: false
actionlint:
enabled: true
pmd:
enabled: false
clang:
enabled: false
cppcheck:
enabled: false
opengrep:
enabled: true
semgrep:
enabled: true
circleci:
enabled: false
clippy:
enabled: true
sqlfluff:
enabled: false
trivy:
enabled: true
prismaLint:
enabled: false
pylint:
enabled: true
oxc:
enabled: false
shopifyThemeCheck:
enabled: false
luacheck:
enabled: false
brakeman:
enabled: false
dotenvLint:
enabled: true
htmlhint:
enabled: false
stylelint:
enabled: false
checkmake:
enabled: false
osvScanner:
enabled: true
blinter:
enabled: true
smartyLint:
enabled: true
emberTemplateLint:
enabled: true
psscriptanalyzer:
enabled: true
chat:
art: true
allow_non_org_members: true
auto_reply: true
integrations:
jira:
usage: disabled
linear:
usage: disabled
knowledge_base:
opt_out: false
web_search:
enabled: true
code_guidelines:
enabled: true
filePatterns:
- .opencode/skills/**
- .opencode/agent/**
learnings:
scope: auto
issues:
scope: auto
jira:
usage: disabled
project_keys: []
linear:
usage: disabled
team_keys: []
pull_requests:
scope: auto
mcp:
usage: auto
disabled_servers: []
linked_repositories: []
code_generation:
docstrings:
language: en-AU
path_instructions: []
unit_tests:
path_instructions: []
issue_enrichment:
auto_enrich:
enabled: true
planning:
enabled: true
auto_planning:
enabled: true
labels: []
labeling:
labeling_instructions: []
auto_apply_labels: true
|
Kind of breaks stuff aparantly only one forge can be provisioned via envs style: nix fmt
feat(scripts/module-graph): refine affected hosts by enable options feat(scripts/module-graph): add summary report flag
docs(ai): recommend SILENT=true to reduce LLM token usage for module-graph
… + directory structure
fix(ci): package and host affected detection
makes it so the push trigger only happens for the master branch
…le unprivileged containers
DaRacci
force-pushed
the
push-ssqumvutkzmu
branch
from
July 11, 2026 07:12
1a89def to
630e960
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 10
♻️ Duplicate comments (1)
.opencode/skills/testing/SKILL.md (1)
20-24: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winEmpty fenced code block still unfixed.
The fenced code block at line 22 is still empty and lacks a language tag (markdownlint MD040). This was previously flagged and remains unaddressed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.opencode/skills/testing/SKILL.md around lines 20 - 24, Replace the empty fenced code block in the testing skill documentation with the intended example output and add an explicit language tag, such as text, to satisfy markdownlint MD040; ensure the surrounding description accurately matches the included report.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.woodpecker/checks.yaml:
- Around line 60-67: Update the run-gitguardian command to avoid constructing
the empty HEAD..HEAD range when CI_PREV_COMMIT_SHA is unset; use the
previous-commit range when available, otherwise invoke ggshield secret scan repo
. or ggshield secret scan ci.
In @.woodpecker/ci-homes.yaml:
- Around line 42-45: Update the CI_PREV_PIPELINE_STATUS comparison in the home
build condition to check for "failure" instead of "error", ensuring SHOULD_BUILD
is enabled when the previous pipeline failed.
In @.woodpecker/ci-hosts.yaml:
- Around line 51-54: Update the status comparison in the CI host retry logic to
check for "failure" instead of "error", so the SHOULD_BUILD=true branch is
reached when CI_PREV_PIPELINE_STATUS indicates a failed previous pipeline.
In `@flake/dev/scripts/module-graph.nu`:
- Around line 208-217: Target filtering currently drops targets when
enable-option evaluation fails because errors are treated as false. Update the
evaluation logic used to build refined_hosts and refined_homes so failures
conservatively evaluate as true, or propagate an explicit error state that
causes the corresponding original target list to be retained; apply the same fix
to both target-processing blocks.
In `@flake/dev/treefmt.nix`:
- Line 56: The treefmt exclusion list currently omits the Nix source file
pkgs/lix-woodpecker/v2.nix; remove that entry from the relevant treefmt
configuration and run nix fmt . to format all Nix code.
In `@lib/nu-lib/flake.nu`:
- Around line 205-220: Replace both `nix hash file` calls used to compute
`old_hash` and `cur_hash` with `nix hash path`, preserving the existing
comparison logic so executable-bit-only changes are detected.
In `@modules/nixos/services/woodpecker-nix.nix`:
- Around line 1152-1166: Add "UPPER_DIR=${upperDir}" to the Environment list for
the woodpecker-nix-gc service, alongside the existing store and GC variables, so
the GC logic using "$UPPER_DIR" in the size calculation records the actual
overlay upper-layer size.
- Around line 539-567: Add AmbientCapabilities for CAP_CHOWN, CAP_DAC_OVERRIDE,
and CAP_FOWNER alongside CapabilityBoundingSet in the woodpecker-nix-init
serviceConfig, matching the configuration used by woodpecker-nix-mount,
woodpecker-nix-compact, and woodpecker-nix-healthcheck.
- Around line 1385-1389: Update the narinfo parsing in the relevant store-path
handling block to read a standard .narinfo size field instead of servedb-size.
Use NarSize for the uncompressed NAR size or FileSize for the compressed narinfo
payload, matching the intended journal metric, and retain the existing fallback
and logging behavior.
- Around line 71-84: Remove the nixBuildUsersGroup declaration and the resulting
build-users-group entry from nixConf in the unprivileged daemon configuration,
keeping the remaining Nix settings aligned with the user-namespace execution
model. Do not add privileged capabilities; ensure no stale references to
nixBuildUsersGroup remain.
---
Duplicate comments:
In @.opencode/skills/testing/SKILL.md:
- Around line 20-24: Replace the empty fenced code block in the testing skill
documentation with the intended example output and add an explicit language tag,
such as text, to satisfy markdownlint MD040; ensure the surrounding description
accurately matches the included report.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2bdc9631-b2ff-44b4-b6da-7b29ed6175fa
📒 Files selected for processing (49)
.github/actions/setup-nix/action.yaml.github/workflows/ci.yaml.github/workflows/docs.yaml.github/workflows/packages.yaml.github/workflows/update-packages.yaml.gitignore.mergify.yml.opencode/skills/testing/SKILL.md.woodpecker/check-upstream-todos.yaml.woodpecker/check.yaml.woodpecker/checks.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.woodpecker/ci-packages.yaml.woodpecker/flake-checker.yaml.woodpecker/lix.yaml.woodpecker/security.yaml.woodpecker/update-packages.yaml.woodpecker/update.yamlAGENTS.mddocs/src/SUMMARY.mddocs/src/modules/nixos/services/woodpecker_nix.mddocs/src/modules/overview.mdflake/ci/scripts/default.nixflake/ci/scripts/detect-affected-outputs.nuflake/ci/scripts/discover-packages.nuflake/ci/scripts/eval.nixflake/ci/scripts/libflake/ci/scripts/setup-attic.nuflake/ci/scripts/update-matrix.nuflake/dev/devenv.nixflake/dev/scripts/default.nixflake/dev/scripts/libflake/dev/scripts/lib/flake.nuflake/dev/scripts/module-graph.nuflake/dev/treefmt.nixflake/packages.nixhosts/server/nixdev/default.nixhosts/server/nixdev/woodpecker.nixlib/nu-lib/flake.nulib/nu-lib/lib.nulib/package.nixlib/strings.nixmodules/home-manager/purpose/development/editors/ai/skills/jujutsu/SKILL.mdmodules/nixos/services/default.nixmodules/nixos/services/woodpecker-nix.nixpkgs/lix-woodpecker/default.nixpkgs/lix-woodpecker/v2.nixresult.json
💤 Files with no reviewable changes (11)
- .github/actions/setup-nix/action.yaml
- .woodpecker/security.yaml
- .github/workflows/update-packages.yaml
- .woodpecker/check.yaml
- .github/workflows/docs.yaml
- .github/workflows/packages.yaml
- .github/workflows/ci.yaml
- .woodpecker/flake-checker.yaml
- result.json
- .woodpecker/check-upstream-todos.yaml
- flake/dev/scripts/lib/flake.nu
📜 Review details
🧰 Additional context used
📓 Path-based instructions (18)
docs/**/*
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Project documentation should be placed in the
docs/directory
Files:
docs/src/SUMMARY.mddocs/src/modules/overview.mddocs/src/modules/nixos/services/woodpecker_nix.md
docs/src/**/*.md
📄 CodeRabbit inference engine (.opencode/skills/docs/SKILL.md)
docs/src/**/*.md: Use underscore filenames (e.g.,my_new_feature.md) instead of hyphens for documentation files
Keep documentation prose focused on behavior, architecture, usage examples, and operational notes; let generated fragments provide exhaustive option reference
Files:
docs/src/SUMMARY.mddocs/src/modules/overview.mddocs/src/modules/nixos/services/woodpecker_nix.md
**/*.{nix,md}
📄 CodeRabbit inference engine (AGENTS.md)
Use the module graph command with
SILENT=true nix run .#module-graph -- --since <COMMIT_HASH> --refine --reportto identify affected configurations before testing; prefer--since, use--refinefor relevant NixOS/Home Manager modules, and use--reportfor grouped summaries.
Files:
docs/src/SUMMARY.mdflake/dev/devenv.nixdocs/src/modules/overview.mdmodules/home-manager/purpose/development/editors/ai/skills/jujutsu/SKILL.mdmodules/nixos/services/default.nixhosts/server/nixdev/default.nixpkgs/lix-woodpecker/default.nixflake/packages.nixlib/strings.nixflake/dev/scripts/default.nixhosts/server/nixdev/woodpecker.nixflake/dev/treefmt.nixlib/package.nixAGENTS.mdflake/ci/scripts/eval.nixdocs/src/modules/nixos/services/woodpecker_nix.mdpkgs/lix-woodpecker/v2.nixflake/ci/scripts/default.nixmodules/nixos/services/woodpecker-nix.nix
**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/code-style-nix)
**/*.nix: Follow Nix code style conventions and best practices
Use consistent indentation and formatting in Nix configuration files
Follow established patterns for module organization in home-manager configurations
**/*.nix: Format code and check syntax usingnix fmt
Evaluate Nix expressions without building usingnix evalwith the target configuration path
Format specific Nix files or directories usingnix fmtfollowed by the file or directory path
Use--show-traceflag withnix buildornix evalcommands to diagnose evaluation errors
For infinite recursion errors in Nix builds, check for circular imports or conflicting option definitions
**/*.nix: Usebuiltins.traceto add trace statements and inspect values during Nix evaluation (format:builtins.trace "message: ${toString var}" var)
Usebuiltins.toJSONto convert complex Nix attribute sets to JSON for easier inspection during evaluation
Check for circular imports between modules and option definitions that depend on themselves to resolve infinite recursion errors
Verify attribute names are correct and imports are complete when debugging 'attribute not found' errors in Nix
Check option type definitions and ensure provided values match the expected type to resolve type mismatch errors
Read assertion messages and provide required configuration values when assertion failures occur in NixOS modules
**/*.nix: Store sensitive data insecrets.yamlencrypted with sops instead of hardcoding passwords, API keys, or tokens in plain text
Declare sops secrets with properowner,group, andmodeattributes; use restrictive modes like0400for secrets files
SetrestartUnitsorreloadUnitsfor sops secrets declarations so services that depend on secrets are restarted when secrets change
Useconfig.sops.placeholderin sops templates instead of directly interpolating secret paths in multi-secret templates
Do not pass secrets as environment variables in plain Nix; useenvironmentFileor...
Files:
flake/dev/devenv.nixmodules/nixos/services/default.nixhosts/server/nixdev/default.nixpkgs/lix-woodpecker/default.nixflake/packages.nixlib/strings.nixflake/dev/scripts/default.nixhosts/server/nixdev/woodpecker.nixflake/dev/treefmt.nixlib/package.nixflake/ci/scripts/eval.nixpkgs/lix-woodpecker/v2.nixflake/ci/scripts/default.nixmodules/nixos/services/woodpecker-nix.nix
flake/dev/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Dev shell, CI scripts, and formatting tools should be organized in
flake/dev/
Files:
flake/dev/devenv.nixflake/dev/scripts/default.nixflake/dev/treefmt.nix
docs/src/modules/**/*.md
📄 CodeRabbit inference engine (.opencode/skills/docs/SKILL.md)
For documented modules, prefer build-time generated option fragments via
{{#include}}fromdocs/src/generated/*.mdinstead of hand-maintained option tables
Files:
docs/src/modules/overview.mddocs/src/modules/nixos/services/woodpecker_nix.md
modules/nixos/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Reusable NixOS module fragments should be placed in
modules/nixos/Create NixOS modules under
modules/nixos/<category>/<name>.nix, defining options and conditional configuration with the standard module pattern.
Files:
modules/nixos/services/default.nixmodules/nixos/services/woodpecker-nix.nix
modules/**/default.nix
📄 CodeRabbit inference engine (.opencode/skills/modules/SKILL.md)
Register modules in the appropriate parent
default.nix, using imports for subdirectories and attribute-set exports for top-level module directories.
Files:
modules/nixos/services/default.nix
modules/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/modules/SKILL.md)
modules/**/*.nix: When modifying an existing module, understand its options, extend the configuration, test affected configurations, and runnix fmton changed files.
To extend a submodule declared elsewhere, redeclare the sameoptions.path with a compatible identical outer wrapper, such asattrsOf (submodule ...); inner options are merged additively.
Do not readconfiginside dynamic submoduleimports; this creates infinite recursion. Use direct option merging or static imports instead.
Options added through submodule option merging are always declared; usemkIfinconfigto conditionally control their behavior rather than gating their declarations.
For server-only configuration in modules loaded on all device types, acceptdeviceTypeas a special argument and gate device-specific submodules withimports = lib.optionals (deviceType == "server") ....
Do not useconfigto determine a module'simports; this causes circular dependency and infinite recursion. Use a plaindeviceTypespecial argument instead.
Use device-gated imports when configuration references namespaces unavailable on other device types, such asserver.*or device-specific options.
For small device-gated configurations, a stub option may be declared in an always-loaded core module, but prefer gated imports for non-trivial configurations.
Files:
modules/nixos/services/default.nixmodules/nixos/services/woodpecker-nix.nix
.opencode/skills/**
⚙️ CodeRabbit configuration file
../../modules/home-manager/purpose/development/editors/ai/skills/code-style-nix
../../modules/home-manager/purpose/development/editors/ai/skills/conventional-commits
../../modules/home-manager/purpose/development/editors/ai/skills/jujutsu
../../modules/home-manager/purpose/development/editors/ai/skills/nushell
../../modules/home-manager/purpose/development/editors/ai/skills/systemd-hardening
../../modules/home-manager/purpose/development/editors/ai/skills/tmux
../../modules/home-manager/purpose/development/editors/ai/skills/vhs
Files:
.opencode/skills/testing/SKILL.md
.opencode/skills/testing/**
⚙️ CodeRabbit configuration file
.opencode/skills/testing/**: ---
name: testing
description: Test changes using module-graph and build commandsTesting
Critical Requirement
After making changes you must always evaluate and test them.
Finding Affected Configurations
Use module-graph script to find which hosts and homes are affected by changed files:
./flake/dev/scripts/module-graph.nuThis outputs JSON showing which configs use each file:
{ "file": "modules/nixos/services/tailscale.nix", "hosts": ["nixdev", "nixmi", "nixcloud"], "homes": [] }Minimum Test Requirements
Based on module-graph output, test at least one of each affected type:
Changed File Affects Minimum Test Hosts only Build one affected host Homes only Build one affected home Both hosts and homes Build one host and one home Test Commands
Test host configuration
nix build .#nixosConfigurations.<hostname>.config.system.build.toplevelTest home configuration
nix build .#homeConfigurations."<user>@<host>".activationPackageRun full flake check
nix flake check --override-input devenv-root "file+file://$PWD/.devenv/root"Testing Workflow Example
Make changes to
modules/nixos/services/tailscale.nixRun module-graph to find affected configs:
./flake/dev/scripts/module-graph.nu | jq '.[] | select(.file | contains("tailscale"))'Pick one affected host and build it:
nix build .#nixosConfigurations.nixdev.config.system.build.toplevelIf change also affects homes, build one:
nix build .#homeConfigurations."racci@nixmi".activationPackage
Files:
.opencode/skills/testing/SKILL.md
hosts/*/*/default.nix
📄 CodeRabbit inference engine (.opencode/skills/hosts/SKILL.md)
Each host must have a
default.nixfile inhosts/<type>/<hostname>/as the main config entry pointPer-machine NixOS configurations should be placed in
hosts/<type>/<hostname>/default.nix
Files:
hosts/server/nixdev/default.nix
hosts/server/*/default.nix
📄 CodeRabbit inference engine (.opencode/skills/hosts/SKILL.md)
Server hosts in
default.nixshould sethost.device.isHeadless = trueto indicate they are headless systems
Files:
hosts/server/nixdev/default.nix
hosts/server/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Server machine-specific NixOS configs should be placed in
hosts/server/<machine>/
Files:
hosts/server/nixdev/default.nixhosts/server/nixdev/woodpecker.nix
hosts/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/modules/SKILL.md)
Enable NixOS modules in host configuration using the module's declared option, such as
services.myService.enable = true.
Files:
hosts/server/nixdev/default.nixhosts/server/nixdev/woodpecker.nix
pkgs/*/default.nix
📄 CodeRabbit inference engine (.opencode/skills/packages/SKILL.md)
pkgs/*/default.nix: Each package must be defined in its own directory underpkgs/with adefault.nixfile containing the package definition
Usestdenv.mkDerivationwith required fields:pname,version,src, andmeta(including description, license, and platforms)
UsewriteShellApplicationbuilder for shell script packages, providingname,text(from readFile), andruntimeInputs
UseautoPatchelfHookinnativeBuildInputsfor binary packages and include aninstallPhaseto place binaries in$out/bin/
For Python applications, usepython3Packages.buildPythonApplicationwithpyproject = true,build-system, anddependenciesfields
Multi-output packages must be defined as a set of derivations in a singledefault.nixand registered by inheriting individual outputs inpkgs/default.nix
Includepassthru.updateScriptin package definitions usingnix-update-scriptwith--flakeflag to support automatic version updates
Files:
pkgs/lix-woodpecker/default.nix
pkgs/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Custom packages and package sets should be organized in
pkgs/
Files:
pkgs/lix-woodpecker/default.nixpkgs/lix-woodpecker/v2.nix
flake/ci/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
CI-specific flake configurations and scripts should be placed in
flake/ci/
Files:
flake/ci/scripts/eval.nixflake/ci/scripts/default.nix
🧠 Learnings (13)
📓 Common learnings
Learnt from: CR
Repo: DaRacci/nix-config
Timestamp: 2026-07-11T07:12:28.589Z
Learning: Based on module-graph results, build at least one affected host for host-only changes, one affected home for home-only changes, or one of each when both are affected.
Learnt from: CR
Repo: DaRacci/nix-config
Timestamp: 2026-07-11T07:12:28.589Z
Learning: Test a host configuration with `nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel`.
Learnt from: CR
Repo: DaRacci/nix-config
Timestamp: 2026-07-11T07:12:28.589Z
Learning: Test a home configuration with `nix build .#homeConfigurations."<user>@<host>".activationPackage`.
Learnt from: CR
Repo: DaRacci/nix-config
Timestamp: 2026-07-11T07:12:28.589Z
Learning: Run the full flake check with `nix flake check --override-input devenv-root "file+file://$PWD/.devenv/root"`.
📚 Learning: 2026-03-23T09:37:43.262Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: flake/ci/scripts/setup-attic.nu:20-21
Timestamp: 2026-03-23T09:37:43.262Z
Learning: In flake/ci/scripts/setup-attic.nu, when invoking `attic login`, pass the auth token as a command-line argument. Do not refactor to supply the token via stdin or pipes, since the attic CLI itself does not support token intake through stdin/piped input; treating stdin usage as a security issue in this case should be avoided.
Applied to files:
.gitignore.mergify.yml
📚 Learning: 2026-03-18T23:46:49.905Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: .woodpecker/lix.yaml:15-15
Timestamp: 2026-03-18T23:46:49.905Z
Learning: In nix-config repository (.woodpecker/*.yaml), image references intentionally omit explicit tags or digests (e.g., registry.racci.dev/lix-woodpecker without :tag). Do not flag or suggest adding explicit tags or digests to these image references; treat such omissions as intentional and maintain consistency across the CI config.
Applied to files:
.woodpecker/update.yaml.woodpecker/update-packages.yaml.woodpecker/lix.yaml.woodpecker/ci-hosts.yaml.woodpecker/ci-homes.yaml.woodpecker/checks.yaml.woodpecker/ci-packages.yaml
📚 Learning: 2026-04-13T14:02:32.760Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: hosts/server/nixdev/default.nix:18-18
Timestamp: 2026-04-13T14:02:32.760Z
Learning: When configuring NixOS Docker via `virtualisation.docker.daemon.settings`, it is valid to set `storage-driver = "overlayfs"` (do not flag it as an invalid Docker storage-driver). Use `overlayfs` specifically for Docker Engine 29+ and/or when the containerd snapshotter integration is enabled (`virtualisation.docker.features.containerd-snapshotter = true`). Treat this as the containerd snapshotter name for OverlayFS, distinct from the legacy `overlay2` classic Docker storage driver.
Applied to files:
flake/dev/devenv.nixmodules/nixos/services/default.nixhosts/server/nixdev/default.nixpkgs/lix-woodpecker/default.nixflake/packages.nixlib/strings.nixflake/dev/scripts/default.nixhosts/server/nixdev/woodpecker.nixflake/dev/treefmt.nixlib/package.nixflake/ci/scripts/eval.nixpkgs/lix-woodpecker/v2.nixflake/ci/scripts/default.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T10:02:55.261Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/core/sops.nix:49-53
Timestamp: 2026-05-01T10:02:55.261Z
Learning: In this nix-config repo, when declaring `sops.secrets` in Nix files, avoid explicitly setting `owner = "root"` and/or `group = "root"` if the intended ownership is root. `sops-nix` defaults `sops.secrets` to `root:root`, so adding these fields explicitly is redundant boilerplate.
Applied to files:
flake/dev/devenv.nixmodules/nixos/services/default.nixhosts/server/nixdev/default.nixpkgs/lix-woodpecker/default.nixflake/packages.nixlib/strings.nixflake/dev/scripts/default.nixhosts/server/nixdev/woodpecker.nixflake/dev/treefmt.nixlib/package.nixflake/ci/scripts/eval.nixpkgs/lix-woodpecker/v2.nixflake/ci/scripts/default.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T14:14:49.691Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/core/gaming.nix:119-119
Timestamp: 2026-05-01T14:14:49.691Z
Learning: When configuring the NixOS `wivrn` module option `services.wivrn.config.json.application`, pass the raw package/derivation (e.g., `pkgs.wayvr`) rather than converting it to a string executable path (e.g., `lib.getExe pkgs.wayvr`). The upstream module expects a list of derivations/packages (it internally `toList`s the value, asserts the first element is a derivation, and then resolves the executable internally). Code review should not recommend changing `pkgs.wayvr` to `lib.getExe pkgs.wayvr` for this option.
Applied to files:
flake/dev/devenv.nixmodules/nixos/services/default.nixhosts/server/nixdev/default.nixpkgs/lix-woodpecker/default.nixflake/packages.nixlib/strings.nixflake/dev/scripts/default.nixhosts/server/nixdev/woodpecker.nixflake/dev/treefmt.nixlib/package.nixflake/ci/scripts/eval.nixpkgs/lix-woodpecker/v2.nixflake/ci/scripts/default.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-20T13:12:46.610Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: docs/site.nix:127-127
Timestamp: 2026-05-20T13:12:46.610Z
Learning: In DaRacci/nix-config, treating `passthru.discovery = false` as a known repo-wide convention to exclude a derivation from automated flake discovery/package CI. Do not require or flag an inline explanatory comment specifically for the absence of a comment when `passthru.discovery = false` is set.
Applied to files:
flake/dev/devenv.nixmodules/nixos/services/default.nixhosts/server/nixdev/default.nixpkgs/lix-woodpecker/default.nixflake/packages.nixlib/strings.nixflake/dev/scripts/default.nixhosts/server/nixdev/woodpecker.nixflake/dev/treefmt.nixlib/package.nixflake/ci/scripts/eval.nixpkgs/lix-woodpecker/v2.nixflake/ci/scripts/default.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T09:11:22.009Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/core/gaming.nix:65-65
Timestamp: 2026-05-01T09:11:22.009Z
Learning: In Nix code, do not flag shell-variable literals like "$XDG_RUNTIME_DIR" used inside Steam’s `extraEnv` (e.g., `pkgs.steam.override { extraEnv = { ... }; }`, including `modules/nixos/core/gaming.nix`). The Steam wrapper script expands these shell variables at runtime, so they should be treated as intended unexpanded literals rather than an interpolation/quoting mistake.
Applied to files:
modules/nixos/services/default.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T14:35:32.037Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/core/remote.nix:153-179
Timestamp: 2026-05-01T14:35:32.037Z
Learning: In this repo’s NixOS module code (e.g., shell scripts produced via `writeShellApplication` inside `modules/nixos/**`), do not treat missing `XDG_STATE_HOME` fallbacks (like `${XDG_STATE_HOME:-$HOME/.local/state}`) as an error in the embedded shell script. On NixOS user sessions, `XDG_STATE_HOME` is reliably set via PAM/systemd, so flagging its absence as potentially unset is overly defensive for these generated scripts.
Applied to files:
modules/nixos/services/default.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-06-20T14:33:25.328Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 590
File: modules/nixos/server/monitoring/collector/tempo.nix:71-72
Timestamp: 2026-06-20T14:33:25.328Z
Learning: When reviewing DaRacci/nix-config NixOS modules that use sops-nix, do not flag `sops.secrets` entries as missing `owner`, `group`, `mode`, or `restartUnits` if the secret declarations are only placeholder sources for `sops.templates`:
- The secret value is referenced exclusively via `config.sops.placeholder.<NAME>` inside a `sops.templates` definition (i.e., no other code reads the decrypted secret from the raw secret path).
- The rendered `sops.templates` output is what is used by systemd via a `systemd.services.*.serviceConfig.EnvironmentFile` (the template is the effective boundary).
In this pattern, the template’s own `restartUnits` are the relevant access-control/restart boundary; the raw `sops.secrets` files are only decrypted in-memory by sops-nix (run as root) to render the template. Therefore, empty-attrset `sops.secrets.<NAME> = { };` declarations should not be treated as missing permissions/restart hooks when they are only feeding a `sops.templates` placeholder.
Applied to files:
modules/nixos/services/default.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T09:57:09.578Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/services/ai-agent.nix:15-15
Timestamp: 2026-05-01T09:57:09.578Z
Learning: In this repo’s Nix modules, `inputs.services-zeroclaw` is a flake input that resolves to an attrset containing a `_file` attribute, and Nix coerces that attrset to a file path via `_file`. When importing/using it as a path in `imports` (e.g., `modules/nixos/services/ai-agent.nix`), use the string interpolation form "${inputs.services-zeroclaw}". Do not change it to `inputs.services-zeroclaw` (raw attrset form) in `imports`, because it will not work correctly.
Applied to files:
modules/nixos/services/default.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-06-28T05:00:06.970Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 599
File: hosts/server/nixai/mnemosyne.nix:6-11
Timestamp: 2026-06-28T05:00:06.970Z
Learning: In this repo’s Nix host configuration, for `sops.secrets.<name>` declarations managed by `sops-nix`, avoid explicitly setting `mode = "0400"` when you are not overriding `sops-nix`’s default secret permissions. `sops-nix` already defaults decrypted secret files to root ownership with mode `0400`, so an explicit `mode = "0400"` is typically redundant. Only set `mode` when you truly need non-default permissions (or you have config that changes the module defaults).
Applied to files:
hosts/server/nixdev/default.nixhosts/server/nixdev/woodpecker.nix
📚 Learning: 2026-04-14T11:31:11.950Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: pkgs/lix-woodpecker/v2.nix:408-409
Timestamp: 2026-04-14T11:31:11.950Z
Learning: In the nix-config repository, pkgs/lix-woodpecker/v2.nix is intentionally copied from the upstream Lix/Woodpecker project with only local modifications. During code review, do not treat or require fixes for issues that are clearly pre-existing from upstream (e.g., path-related problems such as the hydra-build-products issue after gzip) unless the problem is caused by the local changes. Review should focus on verifying and maintaining correctness of the local modifications only, not patching upstream bugs in this tracked file.
Applied to files:
pkgs/lix-woodpecker/default.nixpkgs/lix-woodpecker/v2.nix
🪛 LanguageTool
docs/src/modules/nixos/services/woodpecker_nix.md
[grammar] ~69-~69: It appears that a pronoun is missing.
Context: ...h the overlayfs-backed store at /nix. Depends on woodpecker-nix-mount.service. Poll...
(SENT_START_DEPENDS)
[uncategorized] ~90-~90: Possible missing comma found.
Context: ..."(default) or"promote"`. In promote mode it copies stable paths from the upper l...
(AI_HYDRA_LEO_MISSING_COMMA)
[uncategorized] ~129-~129: The hyphen in statically-linked is redundant.
Context: ...ecker` image includes a layer with a statically-linked BusyBox binary ...
(ADVERB_LY_HYPHEN_FIX)
[uncategorized] ~155-~155: Although a hyphen is possible, it is not necessary in a compound modifier in which the first word is an adverb that ends in ‘ly’.
Context: ...en the bootstrap hash changes), so even manually-deleted symlinks are repaired automatically....
(HYPHENATED_LY_ADVERB_ADJECTIVE)
[uncategorized] ~156-~156: Use a comma before ‘so’ if it connects two independent clauses (unless they are closely connected and short).
Context: ...omatically. A GC root is also registered so the runtime environment survives gar...
(COMMA_COMPOUND_SENTENCE_2)
[misspelling] ~161-~161: Use “an” instead of ‘a’ if the following word starts with a vowel sound, e.g. ‘an article’, ‘an hour’.
Context: ...re bootstrap The init service computes a SHA-256 hash of the store paths of the ...
(EN_A_VS_AN)
[uncategorized] ~163-~163: Possible missing comma found.
Context: ...Dir>/.bootstrap-hash`. On every service start it compares the recorded hash against t...
(AI_HYDRA_LEO_MISSING_COMMA)
[uncategorized] ~363-~363: Possible missing article found.
Context: ...h is read-only inside service sandbox. Module now points HOME, XDG_CACHE_HOME, `X...
(AI_HYDRA_LEO_MISSING_THE)
[style] ~366-~366: Consider an alternative verb to strengthen your wording.
Context: ...the parent ${stateDir}. If you still see this error after deploy, verify generat...
(IF_YOU_HAVE_THIS_PROBLEM)
[uncategorized] ~366-~366: Possible missing article found.
Context: ...ill see this error after deploy, verify generated unit contains those environment variabl...
(AI_HYDRA_LEO_MISSING_THE)
🪛 markdownlint-cli2 (0.22.1)
.opencode/skills/testing/SKILL.md
[warning] 22-22: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
docs/src/modules/nixos/services/woodpecker_nix.md
[warning] 203-203: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (42)
.gitignore (1)
1-1: LGTM!.mergify.yml (1)
50-50: LGTM!.opencode/skills/testing/SKILL.md (2)
14-18: Module-graph usage matches upstream contract.The documented
SILENT=true nix run .#module-graph -- --since <COMMIT_HASH> --refine --reportinvocation aligns with the CLI flags defined inflake/dev/scripts/module-graph.nuand theSILENTenv var handling inlib/nu-lib/lib.nu.
60-63: Workflow example correctly omits--reportfor JSON piping.Using
nix run .#module-graph -- --since origin/main --refine | jq ...without--reportis correct —--reportswitches to summary-table output, which would break thejqfilter expecting JSON.flake/packages.nix (1)
16-45: Clean extraction ofdocsPackagesbinding.The refactor moves the inline docs import into a
let-bounddocsPackageswith identical parameters (self,system,pkgs,lib,inputs = config.partitions.docs.extraInputs) and inherits only the three needed outputs. This improves readability without changing behaviour.modules/home-manager/purpose/development/editors/ai/skills/jujutsu/SKILL.md (1)
93-97: LGTM!docs/src/modules/nixos/services/woodpecker_nix.md (2)
203-206: Duplicate: specify the fenced block language.The error-output block still opens with bare backticks, so markdownlint MD040 remains unresolved. Add a language such as
text.
430-430: 🎯 Functional Correctness
whichis already included here
The example already listswhichin the package set, sowhich shwon’t fail in this setup.> Likely an incorrect or invalid review comment.AGENTS.md (1)
52-56: LGTM!Also applies to: 69-75
docs/src/SUMMARY.md (1)
33-33: LGTM!Also applies to: 62-63
docs/src/modules/overview.md (1)
28-28: LGTM!pkgs/lix-woodpecker/default.nix (1)
10-10: LGTM!Also applies to: 20-20, 32-35
pkgs/lix-woodpecker/v2.nix (1)
16-16: LGTM!Also applies to: 71-71, 293-303, 345-345
modules/nixos/services/default.nix (1)
8-8: LGTM!modules/nixos/services/woodpecker-nix.nix (2)
87-386: LGTM! The previously flagged mkIf/list-concatenation bugs, null-handling ongc.maxFreed, overlay-init idempotency, missingrestartTriggers, and undefined$ELAPSEDall appear correctly fixed in this revision.Also applies to: 529-756, 820-1032, 1033-1139, 1270-1465
449-453: 🔒 Security & Privacy
/nixis intentionally mounted as the merged overlay view; the docs already describe<stateDir>/nix→/nixasrw, so the earlier:rorestriction no longer applies.> Likely an incorrect or invalid review comment.hosts/server/nixdev/default.nix (1)
19-19: LGTM! Per prior discussion and the recorded learning,storage-driver = "overlayfs"is valid for Docker Engine 29+/containerd-snapshotter setups.Based on learnings, "it is valid to set
storage-driver = \"overlayfs\"(do not flag it as an invalid Docker storage-driver)".hosts/server/nixdev/woodpecker.nix (1)
61-100: LGTM! The previously flagged hardcodedstateDirpath inextraVolumesis now correctly derived fromconfig.services.woodpeckerNix.stateDir.lib/nu-lib/lib.nu (2)
29-34: Blank required variables still pass validation.The check only detects an absent key; empty or whitespace-only credentials remain accepted. This previously raised issue is still unresolved.
1-28: LGTM!Also applies to: 35-75
flake/dev/scripts/default.nix (2)
18-21: Recheck the Git runtime dependency forget-symbol-value.A previous review found that this script invokes
git, while its wrapper still has nopkgs.git. Confirm the current implementation and add the runtime input if that call remains.#!/bin/bash set -euo pipefail rg -nP -C2 '^\s*git(?:\s|$)' flake/dev/scripts/get-symbol-value.nu
8-17: LGTM!Also applies to: 23-44
lib/nu-lib/flake.nu (1)
1-204: LGTM!Also applies to: 221-228
lib/package.nix (1)
12-12: LGTM!Also applies to: 49-50, 60-76, 85-92
lib/strings.nix (1)
6-10: LGTM!Also applies to: 22-35, 50-53, 80-94
flake/dev/scripts/lib (1)
1-1: LGTM!flake/dev/scripts/module-graph.nu (1)
1-207: LGTM!Also applies to: 218-273, 292-341
flake/dev/devenv.nix (1)
38-39: LGTM!flake/ci/scripts/default.nix (1)
8-10: LGTM!Also applies to: 12-16, 17-21, 23-31, 33-36, 38-45, 47-54, 56-63, 65-68, 70-72
flake/ci/scripts/detect-affected-outputs.nu (1)
4-5: LGTM!Also applies to: 7-12, 22-31
flake/ci/scripts/discover-packages.nu (1)
1-113: LGTM!.woodpecker/ci-packages.yaml (1)
1-97: LGTM!.woodpecker/update-packages.yaml (1)
1-83: LGTM!.woodpecker/lix.yaml (1)
15-15: LGTM!Also applies to: 71-84
.woodpecker/update.yaml (1)
18-18: LGTM!Also applies to: 52-52
flake/dev/treefmt.nix (2)
27-27: Avoid YAML formatter overlap.
prettierandyamlfmtboth target YAML here; this is already tracked in the existing review.Also applies to: 44-46
27-56: 📐 Maintainability & Code QualityConfirm required Nix validation and documentation.
Please provide the module-graph result, affected configuration build(s),
nix fmt ., and full flake-check evidence; confirm the corresponding documentation update. As per coding guidelines, Nix changes must be evaluated, tested, and documented.Sources: Coding guidelines, Learnings
.woodpecker/ci-hosts.yaml (1)
57-60: Build defensively if affected-output detection fails.This remains the same unguarded detection failure path already tracked in the existing review.
flake/ci/scripts/eval.nix (1)
1-99: 📐 Maintainability & Code QualityProvide the required Nix validation evidence.
Please confirm this evaluator was formatted, evaluated with
--show-trace, tested through affected outputs, and documented if its behaviour changed. As per coding guidelines, “After making changes you must always evaluate and test them” and “Update the corresponding documentation indocs/immediately whenever modifying a.nixfile.”Source: Coding guidelines
flake/ci/scripts/lib (1)
1-1: LGTM!flake/ci/scripts/setup-attic.nu (1)
1-28: LGTM!flake/ci/scripts/update-matrix.nu (1)
1-51: LGTM!
Comment on lines
+71
to
+84
| nixBuildUsersGroup = "nixbld"; | ||
| nixConf = '' | ||
| build-users-group = ${nixBuildUsersGroup} | ||
| allowed-users = * | ||
| substituters = ${concatStringsSep " " cfg.isolatedStore.substituters} | ||
| trusted-public-keys = ${concatStringsSep " " cfg.isolatedStore.trustedPublicKeys} | ||
| require-sigs = true | ||
| sandbox = true | ||
| keep-outputs = true | ||
| keep-derivations = true | ||
| max-jobs = ${toString cfg.isolatedStore.maxJobs} | ||
| experimental-features = nix-command flakes | ||
| ${cfg.isolatedStore.extraConfig} | ||
| ''; |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check whether the nixbld group/build users are created anywhere in the repo,
# and search Lix/Nix docs references for unprivileged multi-user daemon behaviour.
rg -n "nixbld" --type nix
rg -n "build-users-group" --type nixRepository: DaRacci/nix-config
Length of output: 156
🌐 Web query:
Does the Nix or Lix daemon require build-users-group accounts to exist when running unprivileged without CAP_SETUID?
💡 Result:
The Nix daemon generally requires build-users-group accounts if it is configured to perform builds using those users, regardless of whether it possesses the CAP_SETUID capability [1][2][3]. The build-users mechanism is a security feature designed to isolate build processes by executing them under distinct, low-privilege user accounts [1][4][3]. The Nix daemon uses these accounts to drop root privileges before executing build scripts [2]. When the daemon is run without CAP_SETUID (or other necessary privileges), it cannot perform the setuid/setgid operations required to switch to those build-user accounts [2]. Historically, the Nix daemon has been designed to run as the root user specifically to have the necessary privileges (such as CAP_SETUID) to change UIDs and GIDs during the build process [1][4][5][6]. While recent developments have introduced support for running the Nix daemon as a non-root user (often leveraging user namespaces, subuids, and subgids) [5], the core requirement for isolated build accounts remains part of Nix's architecture to ensure security and prevent unauthorized store modification [1][3]. If you attempt to use the build-users-group feature without the necessary privileges to switch to those users, the daemon will fail to initialize or perform builds, as it cannot securely transition to the assigned build user [2].
Citations:
- 1: https://nix.dev/manual/nix/2.34/installation/multi-user
- 2: https://github.com/NixOS/nix/blob/cbbc07c6/src/libstore/unix/build/derivation-builder.cc
- 3: https://manual.determinate.systems/installation/nix-security
- 4: https://github.com/NixOS/nix/blob/master/doc/manual/source/installation/multi-user.md
- 5: NixOS/nixpkgs@e80f56a
- 6: Make it possible to run the Nix daemon as a non-root user NixOS/nix#5208
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the service block around the daemon settings.
file="modules/nixos/services/woodpecker-nix.nix"
wc -l "$file"
sed -n '760,820p' "$file" | cat -nRepository: DaRacci/nix-config
Length of output: 2956
Remove build-users-group = nixbld from the unprivileged daemon config.
This service runs as woodpecker-nix with no capabilities, so it can’t switch into nixbld* build users. Either make the daemon privileged enough for multi-user builds, or drop the build-user setting and keep this aligned with the user-namespace model.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@modules/nixos/services/woodpecker-nix.nix` around lines 71 - 84, Remove the
nixBuildUsersGroup declaration and the resulting build-users-group entry from
nixConf in the unprivileged daemon configuration, keeping the remaining Nix
settings aligned with the user-namespace execution model. Do not add privileged
capabilities; ensure no stale references to nixBuildUsersGroup remain.
- ci(checks): guard ggshield commit-range behind CI_PREV_COMMIT_SHA check, fallback to repo scan - ci(homes): fix previous pipeline status check from "error" to "failure" - ci(hosts): fix previous pipeline status check from "error" to "failure" - fix(module-graph): treat eval failures as conservative true so targets are retained - chore(treefmt): remove pkgs/lix-woodpecker/v2.nix from global excludes - fix(flake.nu): replace deprecated nix hash file with nix hash path - fix(woodpecker-nix): remove stale nixBuildUsersGroup from unprivileged daemon config - fix(woodpecker-nix): add AmbientCapabilities to init service matching other services - fix(woodpecker-nix): add UPPER_DIR env to GC service for overlay size tracking - fix(woodpecker-nix): read NarSize instead of servedb-size from .narinfo files - docs(testing): fill example report output in skill docs with text language tag
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
flake/dev/scripts/module-graph.nu (2)
286-292: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winFailure path now conservative, but silently masks real errors.
Returning
trueon eval failure correctly retains targets instead of dropping them (fixes the previously-flagged major issue). However, the error is now swallowed entirely — ifattr_pathconstruction ornix evalis systematically broken (e.g. a quoting bug), every target will silently evaluate to "enabled" and refinement will appear to work while doing nothing useful, with no trace to diagnose it.🔧 Suggested fix to restore visibility
try { let result = (nix eval --json $attr_path | from json) $result == true - } catch { - true + } catch { |err| + log warning $"Failed to evaluate enable option '($option_path)' for target '($target)': ($err)" + true }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@flake/dev/scripts/module-graph.nu` around lines 286 - 292, Update the eval failure handler in the surrounding module-graph function to retain the conservative true result while reporting the caught error with the script’s existing diagnostic mechanism. Ensure failures from attr_path construction or nix eval include enough context, such as attr_path, to identify the affected evaluation.
113-147: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
get_hostsandget_homesare near-identical; consider deduplicating.Both functions differ only by domain name (
host/home) and output-kind string. Extracting a shared helper (parameterised byoutput_kindand label) would reduce drift risk when one is updated but not the other.♻️ Suggested consolidation
def get_targets [ names: list<string> output_kind: string flake_source: string ] { $names | reduce -f {} { |name, acc| log debug $"Getting imports for ($output_kind): ($name)" try { let imports = flake get_output_graph_files $"($output_kind).($name)" $flake_source $acc | insert $name $imports } catch { |err| log warning $"Failed to get imports for ($output_kind): ($name) - ($err)" $acc | insert $name [] } } }Then call
get_targets $host_names "nixosConfigurations" $flake_source/get_targets $home_names "homeConfigurations" $flake_source.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@flake/dev/scripts/module-graph.nu` around lines 113 - 147, Deduplicate the near-identical get_hosts and get_homes functions by introducing a shared get_targets helper parameterized by names, output_kind, and flake_source. Preserve the existing reduce, logging, flake get_output_graph_files calls, error fallback, and result mapping, then update both callers to pass their respective output-kind strings.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/src/modules/nixos/services/woodpecker_nix.md`:
- Line 69: Update the woodpecker-nix-daemon table description to change “Depends
on” to “It depends on,” preserving the rest of the entry unchanged.
---
Outside diff comments:
In `@flake/dev/scripts/module-graph.nu`:
- Around line 286-292: Update the eval failure handler in the surrounding
module-graph function to retain the conservative true result while reporting the
caught error with the script’s existing diagnostic mechanism. Ensure failures
from attr_path construction or nix eval include enough context, such as
attr_path, to identify the affected evaluation.
- Around line 113-147: Deduplicate the near-identical get_hosts and get_homes
functions by introducing a shared get_targets helper parameterized by names,
output_kind, and flake_source. Preserve the existing reduce, logging, flake
get_output_graph_files calls, error fallback, and result mapping, then update
both callers to pass their respective output-kind strings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3c1a2609-1937-4271-9d62-1df9ad8f6b2e
📒 Files selected for processing (9)
.opencode/skills/testing/SKILL.md.woodpecker/checks.yaml.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yamldocs/src/modules/nixos/services/woodpecker_nix.mdflake/dev/scripts/module-graph.nulib/nu-lib/flake.numodules/nixos/services/woodpecker-nix.nixpkgs/lix-woodpecker/v2.nix
📜 Review details
🧰 Additional context used
📓 Path-based instructions (11)
.opencode/skills/**
⚙️ CodeRabbit configuration file
../../modules/home-manager/purpose/development/editors/ai/skills/code-style-nix
../../modules/home-manager/purpose/development/editors/ai/skills/conventional-commits
../../modules/home-manager/purpose/development/editors/ai/skills/jujutsu
../../modules/home-manager/purpose/development/editors/ai/skills/nushell
../../modules/home-manager/purpose/development/editors/ai/skills/systemd-hardening
../../modules/home-manager/purpose/development/editors/ai/skills/tmux
../../modules/home-manager/purpose/development/editors/ai/skills/vhs
Files:
.opencode/skills/testing/SKILL.md
.opencode/skills/testing/**
⚙️ CodeRabbit configuration file
.opencode/skills/testing/**: ---
name: testing
description: Test changes using module-graph and build commandsTesting
Critical Requirement
After making changes you must always evaluate and test them.
Finding Affected Configurations
Use module-graph script to find which hosts and homes are affected by changed files:
./flake/dev/scripts/module-graph.nuThis outputs JSON showing which configs use each file:
{ "file": "modules/nixos/services/tailscale.nix", "hosts": ["nixdev", "nixmi", "nixcloud"], "homes": [] }Minimum Test Requirements
Based on module-graph output, test at least one of each affected type:
Changed File Affects Minimum Test Hosts only Build one affected host Homes only Build one affected home Both hosts and homes Build one host and one home Test Commands
Test host configuration
nix build .#nixosConfigurations.<hostname>.config.system.build.toplevelTest home configuration
nix build .#homeConfigurations."<user>@<host>".activationPackageRun full flake check
nix flake check --override-input devenv-root "file+file://$PWD/.devenv/root"Testing Workflow Example
Make changes to
modules/nixos/services/tailscale.nixRun module-graph to find affected configs:
./flake/dev/scripts/module-graph.nu | jq '.[] | select(.file | contains("tailscale"))'Pick one affected host and build it:
nix build .#nixosConfigurations.nixdev.config.system.build.toplevelIf change also affects homes, build one:
nix build .#homeConfigurations."racci@nixmi".activationPackage
Files:
.opencode/skills/testing/SKILL.md
**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/code-style-nix)
**/*.nix: Follow Nix code style conventions and best practices
Use consistent indentation and formatting in Nix configuration files
Follow established patterns for module organization in home-manager configurations
**/*.nix: Format code and check syntax usingnix fmt
Evaluate Nix expressions without building usingnix evalwith the target configuration path
Format specific Nix files or directories usingnix fmtfollowed by the file or directory path
Use--show-traceflag withnix buildornix evalcommands to diagnose evaluation errors
For infinite recursion errors in Nix builds, check for circular imports or conflicting option definitions
**/*.nix: Usebuiltins.traceto add trace statements and inspect values during Nix evaluation (format:builtins.trace "message: ${toString var}" var)
Usebuiltins.toJSONto convert complex Nix attribute sets to JSON for easier inspection during evaluation
Check for circular imports between modules and option definitions that depend on themselves to resolve infinite recursion errors
Verify attribute names are correct and imports are complete when debugging 'attribute not found' errors in Nix
Check option type definitions and ensure provided values match the expected type to resolve type mismatch errors
Read assertion messages and provide required configuration values when assertion failures occur in NixOS modules
**/*.nix: Store sensitive data insecrets.yamlencrypted with sops instead of hardcoding passwords, API keys, or tokens in plain text
Declare sops secrets with properowner,group, andmodeattributes; use restrictive modes like0400for secrets files
SetrestartUnitsorreloadUnitsfor sops secrets declarations so services that depend on secrets are restarted when secrets change
Useconfig.sops.placeholderin sops templates instead of directly interpolating secret paths in multi-secret templates
Do not pass secrets as environment variables in plain Nix; useenvironmentFileor...
Files:
pkgs/lix-woodpecker/v2.nixmodules/nixos/services/woodpecker-nix.nix
pkgs/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Custom packages and package sets should be organized in
pkgs/
Files:
pkgs/lix-woodpecker/v2.nix
**/*
📄 CodeRabbit inference engine (.opencode/skills/testing/SKILL.md)
**/*: After making changes, always evaluate and test them.
UseSILENT=true nix run .#module-graph -- --since <COMMIT_HASH> --refine --reportto identify affected NixOS hosts and Home Manager configurations; use--refinefor changes undermodules/nixos/ormodules/home-manager/when enable options are exposed.
If changes affect hosts, build at least one affected host withnix build .#nixosConfigurations.<hostname>.config.system.build.toplevel.
If changes affect homes, build at least one affected home withnix build .#homeConfigurations."<user>@<host>".activationPackage.
If changes affect both hosts and homes, build at least one affected host and one affected home.Set
SILENT=truewhen sending module-graph output to LLMs or remote analysis tools to reduce logging verbosity and token usage.
Files:
pkgs/lix-woodpecker/v2.nixdocs/src/modules/nixos/services/woodpecker_nix.mdlib/nu-lib/flake.nuflake/dev/scripts/module-graph.numodules/nixos/services/woodpecker-nix.nix
docs/**/*
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Project documentation should be placed in the
docs/directory
Files:
docs/src/modules/nixos/services/woodpecker_nix.md
docs/src/**/*.md
📄 CodeRabbit inference engine (.opencode/skills/docs/SKILL.md)
docs/src/**/*.md: Use underscore filenames (e.g.,my_new_feature.md) instead of hyphens for documentation files
Keep documentation prose focused on behavior, architecture, usage examples, and operational notes; let generated fragments provide exhaustive option reference
Files:
docs/src/modules/nixos/services/woodpecker_nix.md
docs/src/modules/**/*.md
📄 CodeRabbit inference engine (.opencode/skills/docs/SKILL.md)
For documented modules, prefer build-time generated option fragments via
{{#include}}fromdocs/src/generated/*.mdinstead of hand-maintained option tables
Files:
docs/src/modules/nixos/services/woodpecker_nix.md
modules/nixos/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/project-structure/SKILL.md)
Reusable NixOS module fragments should be placed in
modules/nixos/Create NixOS modules under
modules/nixos/<category>/<name>.nix, defining options and conditional configuration with the standard module pattern.
Files:
modules/nixos/services/woodpecker-nix.nix
modules/**/*.nix
📄 CodeRabbit inference engine (.opencode/skills/modules/SKILL.md)
modules/**/*.nix: When modifying an existing module, understand its options, extend the configuration, test affected configurations, and runnix fmton changed files.
To extend a submodule declared elsewhere, redeclare the sameoptions.path with a compatible identical outer wrapper, such asattrsOf (submodule ...); inner options are merged additively.
Do not readconfiginside dynamic submoduleimports; this creates infinite recursion. Use direct option merging or static imports instead.
Options added through submodule option merging are always declared; usemkIfinconfigto conditionally control their behavior rather than gating their declarations.
For server-only configuration in modules loaded on all device types, acceptdeviceTypeas a special argument and gate device-specific submodules withimports = lib.optionals (deviceType == "server") ....
Do not useconfigto determine a module'simports; this causes circular dependency and infinite recursion. Use a plaindeviceTypespecial argument instead.
Use device-gated imports when configuration references namespaces unavailable on other device types, such asserver.*or device-specific options.
For small device-gated configurations, a stub option may be declared in an always-loaded core module, but prefer gated imports for non-trivial configurations.
Files:
modules/nixos/services/woodpecker-nix.nix
**/{modules/nixos,modules/home-manager}/**/*.nix
📄 CodeRabbit inference engine (AGENTS.md)
When determining affected configurations, prefer
--since; use--refinefor module changes when the module exposesoptions.<path>.enable, and use--reportto summarize affected hosts and homes by priority.
Files:
modules/nixos/services/woodpecker-nix.nix
🧠 Learnings (11)
📓 Common learnings
Learnt from: CR
Repo: DaRacci/nix-config
Timestamp: 2026-07-12T04:17:46.760Z
Learning: Before completing any task, always check `docs/` to ensure required documentation synchronization has been performed.
📚 Learning: 2026-03-18T23:46:49.905Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: .woodpecker/lix.yaml:15-15
Timestamp: 2026-03-18T23:46:49.905Z
Learning: In nix-config repository (.woodpecker/*.yaml), image references intentionally omit explicit tags or digests (e.g., registry.racci.dev/lix-woodpecker without :tag). Do not flag or suggest adding explicit tags or digests to these image references; treat such omissions as intentional and maintain consistency across the CI config.
Applied to files:
.woodpecker/ci-homes.yaml.woodpecker/ci-hosts.yaml.woodpecker/checks.yaml
📚 Learning: 2026-04-13T14:02:32.760Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: hosts/server/nixdev/default.nix:18-18
Timestamp: 2026-04-13T14:02:32.760Z
Learning: When configuring NixOS Docker via `virtualisation.docker.daemon.settings`, it is valid to set `storage-driver = "overlayfs"` (do not flag it as an invalid Docker storage-driver). Use `overlayfs` specifically for Docker Engine 29+ and/or when the containerd snapshotter integration is enabled (`virtualisation.docker.features.containerd-snapshotter = true`). Treat this as the containerd snapshotter name for OverlayFS, distinct from the legacy `overlay2` classic Docker storage driver.
Applied to files:
pkgs/lix-woodpecker/v2.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T10:02:55.261Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/core/sops.nix:49-53
Timestamp: 2026-05-01T10:02:55.261Z
Learning: In this nix-config repo, when declaring `sops.secrets` in Nix files, avoid explicitly setting `owner = "root"` and/or `group = "root"` if the intended ownership is root. `sops-nix` defaults `sops.secrets` to `root:root`, so adding these fields explicitly is redundant boilerplate.
Applied to files:
pkgs/lix-woodpecker/v2.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T14:14:49.691Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/core/gaming.nix:119-119
Timestamp: 2026-05-01T14:14:49.691Z
Learning: When configuring the NixOS `wivrn` module option `services.wivrn.config.json.application`, pass the raw package/derivation (e.g., `pkgs.wayvr`) rather than converting it to a string executable path (e.g., `lib.getExe pkgs.wayvr`). The upstream module expects a list of derivations/packages (it internally `toList`s the value, asserts the first element is a derivation, and then resolves the executable internally). Code review should not recommend changing `pkgs.wayvr` to `lib.getExe pkgs.wayvr` for this option.
Applied to files:
pkgs/lix-woodpecker/v2.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-20T13:12:46.610Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: docs/site.nix:127-127
Timestamp: 2026-05-20T13:12:46.610Z
Learning: In DaRacci/nix-config, treating `passthru.discovery = false` as a known repo-wide convention to exclude a derivation from automated flake discovery/package CI. Do not require or flag an inline explanatory comment specifically for the absence of a comment when `passthru.discovery = false` is set.
Applied to files:
pkgs/lix-woodpecker/v2.nixmodules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-04-14T11:31:11.950Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 546
File: pkgs/lix-woodpecker/v2.nix:408-409
Timestamp: 2026-04-14T11:31:11.950Z
Learning: In the nix-config repository, pkgs/lix-woodpecker/v2.nix is intentionally copied from the upstream Lix/Woodpecker project with only local modifications. During code review, do not treat or require fixes for issues that are clearly pre-existing from upstream (e.g., path-related problems such as the hydra-build-products issue after gzip) unless the problem is caused by the local changes. Review should focus on verifying and maintaining correctness of the local modifications only, not patching upstream bugs in this tracked file.
Applied to files:
pkgs/lix-woodpecker/v2.nix
📚 Learning: 2026-05-01T09:11:22.009Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/core/gaming.nix:65-65
Timestamp: 2026-05-01T09:11:22.009Z
Learning: In Nix code, do not flag shell-variable literals like "$XDG_RUNTIME_DIR" used inside Steam’s `extraEnv` (e.g., `pkgs.steam.override { extraEnv = { ... }; }`, including `modules/nixos/core/gaming.nix`). The Steam wrapper script expands these shell variables at runtime, so they should be treated as intended unexpanded literals rather than an interpolation/quoting mistake.
Applied to files:
modules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T14:35:32.037Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/core/remote.nix:153-179
Timestamp: 2026-05-01T14:35:32.037Z
Learning: In this repo’s NixOS module code (e.g., shell scripts produced via `writeShellApplication` inside `modules/nixos/**`), do not treat missing `XDG_STATE_HOME` fallbacks (like `${XDG_STATE_HOME:-$HOME/.local/state}`) as an error in the embedded shell script. On NixOS user sessions, `XDG_STATE_HOME` is reliably set via PAM/systemd, so flagging its absence as potentially unset is overly defensive for these generated scripts.
Applied to files:
modules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-06-20T14:33:25.328Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 590
File: modules/nixos/server/monitoring/collector/tempo.nix:71-72
Timestamp: 2026-06-20T14:33:25.328Z
Learning: When reviewing DaRacci/nix-config NixOS modules that use sops-nix, do not flag `sops.secrets` entries as missing `owner`, `group`, `mode`, or `restartUnits` if the secret declarations are only placeholder sources for `sops.templates`:
- The secret value is referenced exclusively via `config.sops.placeholder.<NAME>` inside a `sops.templates` definition (i.e., no other code reads the decrypted secret from the raw secret path).
- The rendered `sops.templates` output is what is used by systemd via a `systemd.services.*.serviceConfig.EnvironmentFile` (the template is the effective boundary).
In this pattern, the template’s own `restartUnits` are the relevant access-control/restart boundary; the raw `sops.secrets` files are only decrypted in-memory by sops-nix (run as root) to render the template. Therefore, empty-attrset `sops.secrets.<NAME> = { };` declarations should not be treated as missing permissions/restart hooks when they are only feeding a `sops.templates` placeholder.
Applied to files:
modules/nixos/services/woodpecker-nix.nix
📚 Learning: 2026-05-01T09:57:09.578Z
Learnt from: DaRacci
Repo: DaRacci/nix-config PR: 544
File: modules/nixos/services/ai-agent.nix:15-15
Timestamp: 2026-05-01T09:57:09.578Z
Learning: In this repo’s Nix modules, `inputs.services-zeroclaw` is a flake input that resolves to an attrset containing a `_file` attribute, and Nix coerces that attrset to a file path via `_file`. When importing/using it as a path in `imports` (e.g., `modules/nixos/services/ai-agent.nix`), use the string interpolation form "${inputs.services-zeroclaw}". Do not change it to `inputs.services-zeroclaw` (raw attrset form) in `imports`, because it will not work correctly.
Applied to files:
modules/nixos/services/woodpecker-nix.nix
🪛 LanguageTool
docs/src/modules/nixos/services/woodpecker_nix.md
[grammar] ~69-~69: It appears that a pronoun is missing.
Context: ...h the overlayfs-backed store at /nix. Depends on woodpecker-nix-mount.service. Poll...
(SENT_START_DEPENDS)
🔇 Additional comments (10)
.woodpecker/checks.yaml (1)
67-72: LGTM!.woodpecker/ci-homes.yaml (1)
43-43: LGTM!.woodpecker/ci-hosts.yaml (1)
52-52: LGTM!modules/nixos/services/woodpecker-nix.nix (1)
566-570: LGTM!Also applies to: 1169-1170, 1390-1390
.opencode/skills/testing/SKILL.md (1)
22-42: LGTM!docs/src/modules/nixos/services/woodpecker_nix.md (1)
82-82: 🎯 Functional CorrectnessNo branch pin to change here
This section doesn’t contain thenix run .#module-graph -- --since ...example, so theorigin/mainvsorigin/masterconcern doesn’t apply to this line.> Likely an incorrect or invalid review comment.pkgs/lix-woodpecker/v2.nix (2)
133-135: 🎯 Functional CorrectnessPrecedence here is correct — no parenthesisation needed.
Contrary to the earlier flag on this fold,
acc.${v.group} or [ ] ++ [ v.user ]appends correctly. In Nix, attribute selection with anordefault is the highest-precedence operation (precedence 1), binding tighter than++(precedence 5), so this parses as(acc.${v.group} or [ ]) ++ [ v.user ]. Each subsequent member for a group is appended, not dropped.You can confirm in a local
nix repl(not runnable in the review sandbox as no Nix interpreter is available):builtins.foldl' (acc: v: acc // { ${v.group} = acc.${v.group} or [ ] ++ [ v.user ]; }) { } [ { group = "nixbld"; user = "a"; } { group = "nixbld"; user = "b"; } ] # => { nixbld = [ "a" "b" ]; }If it returns
{ nixbld = [ "a" "b" ]; }, the existing code is fine as-is.
105-131: LGTM!Also applies to: 144-144
lib/nu-lib/flake.nu (1)
205-218: LGTM!flake/dev/scripts/module-graph.nu (1)
254-257: 🎯 Functional CorrectnessNo action needed here. The nested-option regex only becomes problematic if a file contains multiple
options.<...> = { ... }blocks; that pattern doesn’t occur in the modules this script scans, so it isn’t misattributing an existing enable path.> Likely an incorrect or invalid review comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.