Skip to content

Commit 038c960

Browse files
opencode-agent[bot]opencode-agent[bot]
committed
Apply PR #11495: fix(nix): restore native runners for darwin hash computation
2 parents e4ed286 + 89ca748 commit 038c960

3 files changed

Lines changed: 103 additions & 104 deletions

File tree

‎.github/workflows/nix-hashes.yml‎

Lines changed: 94 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -21,120 +21,135 @@ on:
2121
- ".github/workflows/nix-hashes.yml"
2222

2323
jobs:
24-
nix-hashes:
25-
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
24+
compute-hash:
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
include:
29+
- system: x86_64-linux
30+
runner: blacksmith-4vcpu-ubuntu-2404
31+
runner-pr: ubuntu-24.04
32+
- system: aarch64-linux
33+
runner: blacksmith-4vcpu-ubuntu-2404-arm
34+
runner-pr: ubuntu-24.04-arm
35+
- system: x86_64-darwin
36+
runner: macos-15-intel
37+
runner-pr: macos-13
38+
- system: aarch64-darwin
39+
runner: macos-latest
40+
runner-pr: macos-latest
41+
runs-on: ${{ github.event_name == 'pull_request' && matrix.runner-pr || matrix.runner }}
42+
43+
steps:
44+
- name: Checkout repository
45+
uses: actions/checkout@v6
46+
47+
- name: Setup Nix
48+
uses: nixbuild/nix-quick-install-action@v34
49+
50+
- name: Compute node_modules hash
51+
id: hash
52+
env:
53+
SYSTEM: ${{ matrix.system }}
54+
run: |
55+
set -euo pipefail
56+
57+
BUILD_LOG=$(mktemp)
58+
trap 'rm -f "$BUILD_LOG"' EXIT
59+
60+
# Build with fakeHash to trigger hash mismatch and reveal correct hash
61+
nix build ".#packages.${SYSTEM}.node_modules_updater" --no-link 2>&1 | tee "$BUILD_LOG" || true
62+
63+
HASH="$(grep -E 'got:\s+sha256-' "$BUILD_LOG" | sed -E 's/.*got:\s+(sha256-[A-Za-z0-9+/=]+).*/\1/' | head -n1 || true)"
64+
if [ -z "$HASH" ]; then
65+
HASH="$(grep -A2 'hash mismatch' "$BUILD_LOG" | grep 'got:' | sed -E 's/.*got:\s+(sha256-[A-Za-z0-9+/=]+).*/\1/' | head -n1 || true)"
66+
fi
67+
68+
if [ -z "$HASH" ]; then
69+
echo "::error::Failed to compute hash for ${SYSTEM}"
70+
cat "$BUILD_LOG"
71+
exit 1
72+
fi
73+
74+
echo "$HASH" > hash.txt
75+
echo "Computed hash for ${SYSTEM}: $HASH"
76+
77+
- name: Upload hash
78+
uses: actions/upload-artifact@v4
79+
with:
80+
name: hash-${{ matrix.system }}
81+
path: hash.txt
82+
retention-days: 1
83+
84+
update-hashes:
85+
needs: compute-hash
86+
if: github.event_name != 'pull_request'
2687
runs-on: blacksmith-4vcpu-ubuntu-2404
27-
env:
28-
TITLE: node_modules hashes
2988

3089
steps:
3190
- name: Checkout repository
3291
uses: actions/checkout@v6
3392
with:
3493
token: ${{ secrets.GITHUB_TOKEN }}
3594
fetch-depth: 0
36-
ref: ${{ github.head_ref || github.ref_name }}
37-
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
95+
ref: ${{ github.ref_name }}
3896

3997
- name: Setup git committer
40-
id: committer
4198
uses: ./.github/actions/setup-git-committer
4299
with:
43100
opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
44101
opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
45102

46-
- name: Setup Nix
47-
uses: nixbuild/nix-quick-install-action@v34
48-
49103
- name: Pull latest changes
50-
env:
51-
TARGET_BRANCH: ${{ github.head_ref || github.ref_name }}
52104
run: |
53-
BRANCH="${TARGET_BRANCH:-${GITHUB_REF_NAME}}"
54-
git pull --rebase --autostash origin "$BRANCH"
105+
git pull --rebase --autostash origin "$GITHUB_REF_NAME"
55106
56-
- name: Compute all node_modules hashes
107+
- name: Download hash artifacts
108+
uses: actions/download-artifact@v4
109+
with:
110+
path: hashes
111+
pattern: hash-*
112+
113+
- name: Update hashes.json
57114
run: |
58115
set -euo pipefail
59116
60117
HASH_FILE="nix/hashes.json"
61-
SYSTEMS="x86_64-linux aarch64-linux x86_64-darwin aarch64-darwin"
62-
63-
if [ ! -f "$HASH_FILE" ]; then
64-
mkdir -p "$(dirname "$HASH_FILE")"
65-
echo '{"nodeModules":{}}' > "$HASH_FILE"
66-
fi
67-
68-
for SYSTEM in $SYSTEMS; do
69-
echo "Computing hash for ${SYSTEM}..."
70-
BUILD_LOG=$(mktemp)
71-
trap 'rm -f "$BUILD_LOG"' EXIT
72118
73-
# The updater derivations use fakeHash, so they will fail and reveal the correct hash
74-
UPDATER_ATTR=".#packages.x86_64-linux.${SYSTEM}_node_modules"
75-
76-
nix build "$UPDATER_ATTR" --no-link 2>&1 | tee "$BUILD_LOG" || true
77-
78-
CORRECT_HASH="$(grep -E 'got:\s+sha256-[A-Za-z0-9+/=]+' "$BUILD_LOG" | awk '{print $2}' | head -n1 || true)"
79-
80-
if [ -z "$CORRECT_HASH" ]; then
81-
CORRECT_HASH="$(grep -A2 'hash mismatch' "$BUILD_LOG" | grep 'got:' | awk '{print $2}' | sed 's/sha256:/sha256-/' || true)"
82-
fi
83-
84-
if [ -z "$CORRECT_HASH" ]; then
85-
echo "Failed to determine correct node_modules hash for ${SYSTEM}."
86-
cat "$BUILD_LOG"
87-
exit 1
119+
[ -f "$HASH_FILE" ] || echo '{"nodeModules":{}}' > "$HASH_FILE"
120+
121+
for SYSTEM in x86_64-linux aarch64-linux x86_64-darwin aarch64-darwin; do
122+
FILE="hashes/hash-${SYSTEM}/hash.txt"
123+
if [ -f "$FILE" ]; then
124+
HASH="$(tr -d '[:space:]' < "$FILE")"
125+
echo "${SYSTEM}: ${HASH}"
126+
jq --arg sys "$SYSTEM" --arg h "$HASH" '.nodeModules[$sys] = $h' "$HASH_FILE" > tmp.json
127+
mv tmp.json "$HASH_FILE"
128+
else
129+
echo "::warning::Missing hash for ${SYSTEM}"
88130
fi
89-
90-
echo " ${SYSTEM}: ${CORRECT_HASH}"
91-
jq --arg sys "$SYSTEM" --arg h "$CORRECT_HASH" \
92-
'.nodeModules[$sys] = $h' "$HASH_FILE" > "${HASH_FILE}.tmp"
93-
mv "${HASH_FILE}.tmp" "$HASH_FILE"
94131
done
95132
96-
echo "All hashes computed:"
97133
cat "$HASH_FILE"
98134
99-
- name: Commit ${{ env.TITLE }} changes
100-
env:
101-
TARGET_BRANCH: ${{ github.head_ref || github.ref_name }}
135+
- name: Commit changes
102136
run: |
103137
set -euo pipefail
104138
105139
HASH_FILE="nix/hashes.json"
106-
echo "Checking for changes..."
107-
108-
summarize() {
109-
local status="$1"
110-
{
111-
echo "### Nix $TITLE"
112-
echo ""
113-
echo "- ref: ${GITHUB_REF_NAME}"
114-
echo "- status: ${status}"
115-
} >> "$GITHUB_STEP_SUMMARY"
116-
if [ -n "${GITHUB_SERVER_URL:-}" ] && [ -n "${GITHUB_REPOSITORY:-}" ] && [ -n "${GITHUB_RUN_ID:-}" ]; then
117-
echo "- run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" >> "$GITHUB_STEP_SUMMARY"
118-
fi
119-
echo "" >> "$GITHUB_STEP_SUMMARY"
120-
}
121-
122-
FILES=("$HASH_FILE")
123-
STATUS="$(git status --short -- "${FILES[@]}" || true)"
124-
if [ -z "$STATUS" ]; then
125-
echo "No changes detected."
126-
summarize "no changes"
140+
141+
if [ -z "$(git status --short -- "$HASH_FILE")" ]; then
142+
echo "No changes to commit"
143+
echo "### Nix hashes" >> "$GITHUB_STEP_SUMMARY"
144+
echo "Status: no changes" >> "$GITHUB_STEP_SUMMARY"
127145
exit 0
128146
fi
129147
130-
echo "Changes detected:"
131-
echo "$STATUS"
132-
git add "${FILES[@]}"
148+
git add "$HASH_FILE"
133149
git commit -m "chore: update nix node_modules hashes"
134150
135-
BRANCH="${TARGET_BRANCH:-${GITHUB_REF_NAME}}"
136-
git pull --rebase --autostash origin "$BRANCH"
137-
git push origin HEAD:"$BRANCH"
138-
echo "Changes pushed successfully"
151+
git pull --rebase --autostash origin "$GITHUB_REF_NAME"
152+
git push origin HEAD:"$GITHUB_REF_NAME"
139153
140-
summarize "committed $(git rev-parse --short HEAD)"
154+
echo "### Nix hashes" >> "$GITHUB_STEP_SUMMARY"
155+
echo "Status: committed $(git rev-parse --short HEAD)" >> "$GITHUB_STEP_SUMMARY"

‎flake.nix‎

Lines changed: 5 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -42,28 +42,15 @@
4242
desktop = pkgs.callPackage ./nix/desktop.nix {
4343
inherit opencode;
4444
};
45-
# nixpkgs cpu naming to bun cpu naming
46-
cpuMap = { x86_64 = "x64"; aarch64 = "arm64"; };
47-
# matrix of node_modules builds - these will always fail due to fakeHash usage
48-
# but allow computation of the correct hash from any build machine for any cpu/os
49-
# see the update-nix-hashes workflow for usage
50-
moduleUpdaters = pkgs.lib.listToAttrs (
51-
pkgs.lib.concatMap (cpu:
52-
map (os: {
53-
name = "${cpu}-${os}_node_modules";
54-
value = node_modules.override {
55-
bunCpu = cpuMap.${cpu};
56-
bunOs = os;
57-
hash = pkgs.lib.fakeHash;
58-
};
59-
}) [ "linux" "darwin" ]
60-
) [ "x86_64" "aarch64" ]
61-
);
6245
in
6346
{
6447
default = opencode;
6548
inherit opencode desktop;
66-
} // moduleUpdaters
49+
# Updater derivation with fakeHash - build fails and reveals correct hash
50+
node_modules_updater = node_modules.override {
51+
hash = pkgs.lib.fakeHash;
52+
};
53+
}
6754
);
6855
};
6956
}

‎nix/node_modules.nix‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
lib,
33
stdenvNoCC,
44
bun,
5-
bunCpu ? if stdenvNoCC.hostPlatform.isAarch64 then "arm64" else "x64",
6-
bunOs ? if stdenvNoCC.hostPlatform.isLinux then "linux" else "darwin",
75
rev ? "dirty",
86
hash ?
97
(lib.pipe ./hashes.json [
@@ -16,6 +14,9 @@ let
1614
builtins.readFile
1715
builtins.fromJSON
1816
];
17+
platform = stdenvNoCC.hostPlatform;
18+
bunCpu = if platform.isAarch64 then "arm64" else "x64";
19+
bunOs = if platform.isLinux then "linux" else "darwin";
1920
in
2021
stdenvNoCC.mkDerivation {
2122
pname = "opencode-node_modules";
@@ -39,9 +40,7 @@ stdenvNoCC.mkDerivation {
3940
"SOCKS_SERVER"
4041
];
4142

42-
nativeBuildInputs = [
43-
bun
44-
];
43+
nativeBuildInputs = [ bun ];
4544

4645
dontConfigure = true;
4746

@@ -63,10 +62,8 @@ stdenvNoCC.mkDerivation {
6362

6463
installPhase = ''
6564
runHook preInstall
66-
6765
mkdir -p $out
6866
find . -type d -name node_modules -exec cp -R --parents {} $out \;
69-
7067
runHook postInstall
7168
'';
7269

0 commit comments

Comments
 (0)