From cc6a39ed718d0d64ef5eed61c8c746e2563496a3 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 07:10:49 -0500 Subject: [PATCH 1/9] ci: format current-main Nix bundle files once --- .../format-current-main-nix-bundle-once.yml | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 .github/workflows/format-current-main-nix-bundle-once.yml diff --git a/.github/workflows/format-current-main-nix-bundle-once.yml b/.github/workflows/format-current-main-nix-bundle-once.yml new file mode 100644 index 00000000..1694d144 --- /dev/null +++ b/.github/workflows/format-current-main-nix-bundle-once.yml @@ -0,0 +1,82 @@ +name: Format current-main Nix bundle files once + +on: + push: + branches: + - fix/format-current-main-nix-bundle + +permissions: + contents: write + +concurrency: + group: format-current-main-nix-bundle-once + cancel-in-progress: false + +jobs: + format: + if: github.actor != 'github-actions[bot]' + runs-on: ubuntu-24.04 + timeout-minutes: 15 + steps: + - name: Check out exact branch + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 1 + persist-credentials: true + show-progress: false + + - name: Install pinned formatter + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: stable + components: rustfmt + + - name: Apply and constrain formatting repair + shell: bash + run: | + set -euo pipefail + cargo fmt --all + + python3 - <<'PY' + import subprocess + + allowed = { + 'src/nix_bundle_write.rs', + 'tests/nix_bundle_write_boundaries.rs', + 'tests/nix_bundle_write_cli.rs', + } + changed = { + line.strip() + for line in subprocess.check_output( + ['git', 'diff', '--name-only'], text=True + ).splitlines() + if line.strip() + } + unexpected = changed - allowed + if unexpected: + raise SystemExit( + 'formatter changed files outside the reviewed repair boundary: ' + + ', '.join(sorted(unexpected)) + ) + if not changed: + raise SystemExit('current main is already rustfmt-clean; no repair commit needed') + PY + + cargo fmt --all --check + cargo test --locked --test nix_bundle_write_cli --no-run + cargo test --locked --test nix_bundle_write_boundaries --no-run + + - name: Commit only permanent formatting changes + shell: bash + run: | + set -euo pipefail + rm .github/workflows/format-current-main-nix-bundle-once.yml + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add \ + src/nix_bundle_write.rs \ + tests/nix_bundle_write_boundaries.rs \ + tests/nix_bundle_write_cli.rs \ + .github/workflows/format-current-main-nix-bundle-once.yml + git commit -m 'style(DEN-1592): format Nix bundle writer' + git push origin HEAD:fix/format-current-main-nix-bundle From 44f3a5a592338ed6bc3251dcb401ee92fd86945b Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 07:12:51 -0500 Subject: [PATCH 2/9] ci: allow one-shot formatter on pull request --- .../workflows/format-current-main-nix-bundle-once.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/format-current-main-nix-bundle-once.yml b/.github/workflows/format-current-main-nix-bundle-once.yml index 1694d144..5fbeb14c 100644 --- a/.github/workflows/format-current-main-nix-bundle-once.yml +++ b/.github/workflows/format-current-main-nix-bundle-once.yml @@ -4,6 +4,11 @@ on: push: branches: - fix/format-current-main-nix-bundle + pull_request: + branches: + - main + paths: + - .github/workflows/format-current-main-nix-bundle-once.yml permissions: contents: write @@ -14,13 +19,14 @@ concurrency: jobs: format: - if: github.actor != 'github-actions[bot]' + if: github.actor != 'github-actions[bot]' && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - name: Check out exact branch + - name: Check out exact feature branch uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + ref: fix/format-current-main-nix-bundle fetch-depth: 1 persist-credentials: true show-progress: false From b7f7491f007c677e74377a70793ac3183852e028 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 07:15:47 -0500 Subject: [PATCH 3/9] ci(DEN-1592): materialize rustfmt patch read-only --- .../format-current-main-nix-bundle-once.yml | 48 +++++++++---------- 1 file changed, 22 insertions(+), 26 deletions(-) diff --git a/.github/workflows/format-current-main-nix-bundle-once.yml b/.github/workflows/format-current-main-nix-bundle-once.yml index 5fbeb14c..3d06642c 100644 --- a/.github/workflows/format-current-main-nix-bundle-once.yml +++ b/.github/workflows/format-current-main-nix-bundle-once.yml @@ -1,34 +1,29 @@ -name: Format current-main Nix bundle files once +name: Materialize current-main Nix bundle rustfmt patch on: - push: - branches: - - fix/format-current-main-nix-bundle pull_request: branches: - main paths: - .github/workflows/format-current-main-nix-bundle-once.yml + workflow_dispatch: permissions: - contents: write + contents: read concurrency: group: format-current-main-nix-bundle-once - cancel-in-progress: false + cancel-in-progress: true jobs: format: - if: github.actor != 'github-actions[bot]' && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-24.04 - timeout-minutes: 15 + timeout-minutes: 20 steps: - - name: Check out exact feature branch + - name: Check out exact repair candidate uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: fix/format-current-main-nix-bundle - fetch-depth: 1 - persist-credentials: true + persist-credentials: false show-progress: false - name: Install pinned formatter @@ -37,7 +32,7 @@ jobs: toolchain: stable components: rustfmt - - name: Apply and constrain formatting repair + - name: Generate and constrain formatting patch shell: bash run: | set -euo pipefail @@ -65,24 +60,25 @@ jobs: + ', '.join(sorted(unexpected)) ) if not changed: - raise SystemExit('current main is already rustfmt-clean; no repair commit needed') + raise SystemExit('current main is already rustfmt-clean; no repair needed') PY cargo fmt --all --check cargo test --locked --test nix_bundle_write_cli --no-run cargo test --locked --test nix_bundle_write_boundaries --no-run - - - name: Commit only permanent formatting changes - shell: bash - run: | - set -euo pipefail - rm .github/workflows/format-current-main-nix-bundle-once.yml - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add \ + git diff --binary -- \ src/nix_bundle_write.rs \ tests/nix_bundle_write_boundaries.rs \ tests/nix_bundle_write_cli.rs \ - .github/workflows/format-current-main-nix-bundle-once.yml - git commit -m 'style(DEN-1592): format Nix bundle writer' - git push origin HEAD:fix/format-current-main-nix-bundle + > "$RUNNER_TEMP/nix-bundle-rustfmt.patch" + test -s "$RUNNER_TEMP/nix-bundle-rustfmt.patch" + git diff --check + + - name: Upload reviewed formatter patch + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: nix-bundle-rustfmt-${{ github.sha }} + path: ${{ runner.temp }}/nix-bundle-rustfmt.patch + if-no-files-found: error + retention-days: 1 + include-hidden-files: false From 7519cc6a31e37caebf0c58b3c1cf90a670bc9e08 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 07:16:57 -0500 Subject: [PATCH 4/9] ci: emit read-only Nix bundle formatting evidence --- ...ormat-current-main-nix-bundle-evidence.yml | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 .github/workflows/format-current-main-nix-bundle-evidence.yml diff --git a/.github/workflows/format-current-main-nix-bundle-evidence.yml b/.github/workflows/format-current-main-nix-bundle-evidence.yml new file mode 100644 index 00000000..b8d9089d --- /dev/null +++ b/.github/workflows/format-current-main-nix-bundle-evidence.yml @@ -0,0 +1,91 @@ +name: Format current-main Nix bundle evidence + +on: + pull_request: + branches: + - main + paths: + - .github/workflows/format-current-main-nix-bundle-evidence.yml + - .github/workflows/format-current-main-nix-bundle-once.yml + +permissions: + contents: read + +concurrency: + group: format-current-main-nix-bundle-evidence-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + format-evidence: + runs-on: ubuntu-24.04 + timeout-minutes: 15 + steps: + - name: Check out exact feature branch without credentials + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: fix/format-current-main-nix-bundle + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Install pinned formatter + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: stable + components: rustfmt + + - name: Produce constrained formatting evidence + shell: bash + run: | + set -euo pipefail + cargo fmt --all + + python3 - <<'PY' + import subprocess + + allowed = { + 'src/nix_bundle_write.rs', + 'tests/nix_bundle_write_boundaries.rs', + 'tests/nix_bundle_write_cli.rs', + } + changed = { + line.strip() + for line in subprocess.check_output( + ['git', 'diff', '--name-only'], text=True + ).splitlines() + if line.strip() + } + if changed != allowed: + raise SystemExit( + 'expected exactly the three reviewed formatting files; got: ' + + ', '.join(sorted(changed)) + ) + PY + + cargo fmt --all --check + cargo test --locked --test nix_bundle_write_cli --no-run + cargo test --locked --test nix_bundle_write_boundaries --no-run + + mkdir -p evidence/src evidence/tests + cp src/nix_bundle_write.rs evidence/src/ + cp tests/nix_bundle_write_boundaries.rs evidence/tests/ + cp tests/nix_bundle_write_cli.rs evidence/tests/ + git diff --binary -- \ + src/nix_bundle_write.rs \ + tests/nix_bundle_write_boundaries.rs \ + tests/nix_bundle_write_cli.rs \ + > evidence/rustfmt.patch + sha256sum \ + evidence/src/nix_bundle_write.rs \ + evidence/tests/nix_bundle_write_boundaries.rs \ + evidence/tests/nix_bundle_write_cli.rs \ + evidence/rustfmt.patch \ + > evidence/SHA256SUMS + + - name: Upload exact formatted bytes + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: nix-bundle-rustfmt-files + path: evidence/ + if-no-files-found: error + retention-days: 3 From 241c0226cfc777aef7d808006e9328b7e6236c4b Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 07:42:32 -0500 Subject: [PATCH 5/9] ci(DEN-1592): move rustfmt materialization to available macOS runner --- .github/workflows/format-current-main-nix-bundle-once.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/format-current-main-nix-bundle-once.yml b/.github/workflows/format-current-main-nix-bundle-once.yml index 3d06642c..a7bbc3e8 100644 --- a/.github/workflows/format-current-main-nix-bundle-once.yml +++ b/.github/workflows/format-current-main-nix-bundle-once.yml @@ -17,7 +17,7 @@ concurrency: jobs: format: - runs-on: ubuntu-24.04 + runs-on: macos-15 timeout-minutes: 20 steps: - name: Check out exact repair candidate From 9d65dd1f2a7c73e8c1d8b8e70c7a0d7551f028b3 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 07:42:56 -0500 Subject: [PATCH 6/9] ci(DEN-1592): generate exact formatted bytes on macOS --- .github/workflows/format-current-main-nix-bundle-evidence.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/format-current-main-nix-bundle-evidence.yml b/.github/workflows/format-current-main-nix-bundle-evidence.yml index b8d9089d..77bf39dc 100644 --- a/.github/workflows/format-current-main-nix-bundle-evidence.yml +++ b/.github/workflows/format-current-main-nix-bundle-evidence.yml @@ -17,7 +17,7 @@ concurrency: jobs: format-evidence: - runs-on: ubuntu-24.04 + runs-on: macos-15 timeout-minutes: 15 steps: - name: Check out exact feature branch without credentials From cc4cff0083695c4a8a57c4c4ca1eecff2381b100 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 07:46:14 -0500 Subject: [PATCH 7/9] ci(DEN-1592): apply verified rustfmt repair --- .../apply-current-main-nix-rustfmt.yml | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 .github/workflows/apply-current-main-nix-rustfmt.yml diff --git a/.github/workflows/apply-current-main-nix-rustfmt.yml b/.github/workflows/apply-current-main-nix-rustfmt.yml new file mode 100644 index 00000000..84724476 --- /dev/null +++ b/.github/workflows/apply-current-main-nix-rustfmt.yml @@ -0,0 +1,82 @@ +name: apply verified current-main Nix rustfmt repair + +on: + push: + branches: + - fix/format-current-main-nix-bundle + paths: + - .github/workflows/apply-current-main-nix-rustfmt.yml + +permissions: + contents: write + +concurrency: + group: apply-current-main-nix-rustfmt + cancel-in-progress: false + +jobs: + apply: + runs-on: macos-15 + timeout-minutes: 25 + steps: + - name: Check out exact repair branch + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: fix/format-current-main-nix-bundle + fetch-depth: 1 + persist-credentials: true + show-progress: false + + - name: Install pinned formatter + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: stable + components: rustfmt + + - name: Apply and constrain the formatter output + shell: bash + run: | + set -euo pipefail + cargo fmt --all + + python3 - <<'PY' + import subprocess + + allowed = { + 'src/nix_bundle_write.rs', + 'tests/nix_bundle_write_boundaries.rs', + 'tests/nix_bundle_write_cli.rs', + } + changed = { + line.strip() + for line in subprocess.check_output( + ['git', 'diff', '--name-only'], text=True + ).splitlines() + if line.strip() + } + if changed != allowed: + raise SystemExit( + 'expected exactly the three independently verified formatting files; got: ' + + ', '.join(sorted(changed)) + ) + PY + + cargo fmt --all --check + cargo test --locked --test nix_bundle_write_cli --no-run + cargo test --locked --test nix_bundle_write_boundaries --no-run + git diff --check + + - name: Remove temporary formatting workflows and commit ordinary source + shell: bash + run: | + set -euo pipefail + rm -f \ + .github/workflows/apply-current-main-nix-rustfmt.yml \ + .github/workflows/format-current-main-nix-bundle-evidence.yml \ + .github/workflows/format-current-main-nix-bundle-once.yml + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add -A + git diff --cached --check + git commit -m 'style(DEN-1592): format merged Nix bundle writer' + git push origin HEAD:fix/format-current-main-nix-bundle From afb4c78562e37da06b58df03bc9e5c43f164d0f9 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 07:47:47 -0500 Subject: [PATCH 8/9] ci(DEN-1592): run verified formatter from same-repository PR context --- .github/workflows/apply-current-main-nix-rustfmt.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/apply-current-main-nix-rustfmt.yml b/.github/workflows/apply-current-main-nix-rustfmt.yml index 84724476..458d5b92 100644 --- a/.github/workflows/apply-current-main-nix-rustfmt.yml +++ b/.github/workflows/apply-current-main-nix-rustfmt.yml @@ -1,9 +1,9 @@ name: apply verified current-main Nix rustfmt repair on: - push: + pull_request: branches: - - fix/format-current-main-nix-bundle + - main paths: - .github/workflows/apply-current-main-nix-rustfmt.yml @@ -16,6 +16,7 @@ concurrency: jobs: apply: + if: github.event.pull_request.head.repo.full_name == github.repository && github.head_ref == 'fix/format-current-main-nix-bundle' runs-on: macos-15 timeout-minutes: 25 steps: From e1adaeec4166d1aa12479dc1db3a6518ec8e3d19 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 12:50:12 +0000 Subject: [PATCH 9/9] style(DEN-1592): format merged Nix bundle writer --- .../apply-current-main-nix-rustfmt.yml | 83 ----------------- ...ormat-current-main-nix-bundle-evidence.yml | 91 ------------------- .../format-current-main-nix-bundle-once.yml | 84 ----------------- src/nix_bundle_write.rs | 15 ++- tests/nix_bundle_write_boundaries.rs | 7 +- tests/nix_bundle_write_cli.rs | 17 ++-- 6 files changed, 17 insertions(+), 280 deletions(-) delete mode 100644 .github/workflows/apply-current-main-nix-rustfmt.yml delete mode 100644 .github/workflows/format-current-main-nix-bundle-evidence.yml delete mode 100644 .github/workflows/format-current-main-nix-bundle-once.yml diff --git a/.github/workflows/apply-current-main-nix-rustfmt.yml b/.github/workflows/apply-current-main-nix-rustfmt.yml deleted file mode 100644 index 458d5b92..00000000 --- a/.github/workflows/apply-current-main-nix-rustfmt.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: apply verified current-main Nix rustfmt repair - -on: - pull_request: - branches: - - main - paths: - - .github/workflows/apply-current-main-nix-rustfmt.yml - -permissions: - contents: write - -concurrency: - group: apply-current-main-nix-rustfmt - cancel-in-progress: false - -jobs: - apply: - if: github.event.pull_request.head.repo.full_name == github.repository && github.head_ref == 'fix/format-current-main-nix-bundle' - runs-on: macos-15 - timeout-minutes: 25 - steps: - - name: Check out exact repair branch - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - ref: fix/format-current-main-nix-bundle - fetch-depth: 1 - persist-credentials: true - show-progress: false - - - name: Install pinned formatter - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 - with: - toolchain: stable - components: rustfmt - - - name: Apply and constrain the formatter output - shell: bash - run: | - set -euo pipefail - cargo fmt --all - - python3 - <<'PY' - import subprocess - - allowed = { - 'src/nix_bundle_write.rs', - 'tests/nix_bundle_write_boundaries.rs', - 'tests/nix_bundle_write_cli.rs', - } - changed = { - line.strip() - for line in subprocess.check_output( - ['git', 'diff', '--name-only'], text=True - ).splitlines() - if line.strip() - } - if changed != allowed: - raise SystemExit( - 'expected exactly the three independently verified formatting files; got: ' - + ', '.join(sorted(changed)) - ) - PY - - cargo fmt --all --check - cargo test --locked --test nix_bundle_write_cli --no-run - cargo test --locked --test nix_bundle_write_boundaries --no-run - git diff --check - - - name: Remove temporary formatting workflows and commit ordinary source - shell: bash - run: | - set -euo pipefail - rm -f \ - .github/workflows/apply-current-main-nix-rustfmt.yml \ - .github/workflows/format-current-main-nix-bundle-evidence.yml \ - .github/workflows/format-current-main-nix-bundle-once.yml - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add -A - git diff --cached --check - git commit -m 'style(DEN-1592): format merged Nix bundle writer' - git push origin HEAD:fix/format-current-main-nix-bundle diff --git a/.github/workflows/format-current-main-nix-bundle-evidence.yml b/.github/workflows/format-current-main-nix-bundle-evidence.yml deleted file mode 100644 index 77bf39dc..00000000 --- a/.github/workflows/format-current-main-nix-bundle-evidence.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Format current-main Nix bundle evidence - -on: - pull_request: - branches: - - main - paths: - - .github/workflows/format-current-main-nix-bundle-evidence.yml - - .github/workflows/format-current-main-nix-bundle-once.yml - -permissions: - contents: read - -concurrency: - group: format-current-main-nix-bundle-evidence-${{ github.event.pull_request.number }} - cancel-in-progress: true - -jobs: - format-evidence: - runs-on: macos-15 - timeout-minutes: 15 - steps: - - name: Check out exact feature branch without credentials - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - ref: fix/format-current-main-nix-bundle - fetch-depth: 1 - persist-credentials: false - show-progress: false - - - name: Install pinned formatter - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 - with: - toolchain: stable - components: rustfmt - - - name: Produce constrained formatting evidence - shell: bash - run: | - set -euo pipefail - cargo fmt --all - - python3 - <<'PY' - import subprocess - - allowed = { - 'src/nix_bundle_write.rs', - 'tests/nix_bundle_write_boundaries.rs', - 'tests/nix_bundle_write_cli.rs', - } - changed = { - line.strip() - for line in subprocess.check_output( - ['git', 'diff', '--name-only'], text=True - ).splitlines() - if line.strip() - } - if changed != allowed: - raise SystemExit( - 'expected exactly the three reviewed formatting files; got: ' - + ', '.join(sorted(changed)) - ) - PY - - cargo fmt --all --check - cargo test --locked --test nix_bundle_write_cli --no-run - cargo test --locked --test nix_bundle_write_boundaries --no-run - - mkdir -p evidence/src evidence/tests - cp src/nix_bundle_write.rs evidence/src/ - cp tests/nix_bundle_write_boundaries.rs evidence/tests/ - cp tests/nix_bundle_write_cli.rs evidence/tests/ - git diff --binary -- \ - src/nix_bundle_write.rs \ - tests/nix_bundle_write_boundaries.rs \ - tests/nix_bundle_write_cli.rs \ - > evidence/rustfmt.patch - sha256sum \ - evidence/src/nix_bundle_write.rs \ - evidence/tests/nix_bundle_write_boundaries.rs \ - evidence/tests/nix_bundle_write_cli.rs \ - evidence/rustfmt.patch \ - > evidence/SHA256SUMS - - - name: Upload exact formatted bytes - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: nix-bundle-rustfmt-files - path: evidence/ - if-no-files-found: error - retention-days: 3 diff --git a/.github/workflows/format-current-main-nix-bundle-once.yml b/.github/workflows/format-current-main-nix-bundle-once.yml deleted file mode 100644 index a7bbc3e8..00000000 --- a/.github/workflows/format-current-main-nix-bundle-once.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Materialize current-main Nix bundle rustfmt patch - -on: - pull_request: - branches: - - main - paths: - - .github/workflows/format-current-main-nix-bundle-once.yml - workflow_dispatch: - -permissions: - contents: read - -concurrency: - group: format-current-main-nix-bundle-once - cancel-in-progress: true - -jobs: - format: - runs-on: macos-15 - timeout-minutes: 20 - steps: - - name: Check out exact repair candidate - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - show-progress: false - - - name: Install pinned formatter - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 - with: - toolchain: stable - components: rustfmt - - - name: Generate and constrain formatting patch - shell: bash - run: | - set -euo pipefail - cargo fmt --all - - python3 - <<'PY' - import subprocess - - allowed = { - 'src/nix_bundle_write.rs', - 'tests/nix_bundle_write_boundaries.rs', - 'tests/nix_bundle_write_cli.rs', - } - changed = { - line.strip() - for line in subprocess.check_output( - ['git', 'diff', '--name-only'], text=True - ).splitlines() - if line.strip() - } - unexpected = changed - allowed - if unexpected: - raise SystemExit( - 'formatter changed files outside the reviewed repair boundary: ' - + ', '.join(sorted(unexpected)) - ) - if not changed: - raise SystemExit('current main is already rustfmt-clean; no repair needed') - PY - - cargo fmt --all --check - cargo test --locked --test nix_bundle_write_cli --no-run - cargo test --locked --test nix_bundle_write_boundaries --no-run - git diff --binary -- \ - src/nix_bundle_write.rs \ - tests/nix_bundle_write_boundaries.rs \ - tests/nix_bundle_write_cli.rs \ - > "$RUNNER_TEMP/nix-bundle-rustfmt.patch" - test -s "$RUNNER_TEMP/nix-bundle-rustfmt.patch" - git diff --check - - - name: Upload reviewed formatter patch - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: nix-bundle-rustfmt-${{ github.sha }} - path: ${{ runner.temp }}/nix-bundle-rustfmt.patch - if-no-files-found: error - retention-days: 1 - include-hidden-files: false diff --git a/src/nix_bundle_write.rs b/src/nix_bundle_write.rs index 3cd097d0..8b6ae7f0 100644 --- a/src/nix_bundle_write.rs +++ b/src/nix_bundle_write.rs @@ -296,7 +296,8 @@ fn repack_planned_artifact(requested_root: &Path, plan: &NixExportPlan) -> Resul let bytes = fs::read(&packed.path) .with_context(|| format!("reading repacked artifact {}", packed.path.display()))?; let actual_sha256 = hex::encode(Sha256::digest(&bytes)); - if actual_sha256 != plan.source.artifact.sha256 || bytes.len() as u64 != plan.source.artifact.size + if actual_sha256 != plan.source.artifact.sha256 + || bytes.len() as u64 != plan.source.artifact.size { bail!( "deterministic repack does not match frozen Nix export plan (expected {} bytes at {}, got {} bytes at {})", @@ -589,9 +590,9 @@ mod tests { #[test] fn augmented_command_contains_plan_and_bundle_write() { let command = augment_root_command(crate::nix_export_plan::augment_root_command( - crate::fetch::augment_root_command( - crate::dev::augment_root_command(crate::cli::Cli::command()), - ), + crate::fetch::augment_root_command(crate::dev::augment_root_command( + crate::cli::Cli::command(), + )), )); let interop = command.find_subcommand("interop").unwrap(); let nix = interop.find_subcommand("nix").unwrap(); @@ -599,7 +600,11 @@ mod tests { let bundle = nix.find_subcommand("bundle").unwrap(); let write = bundle.find_subcommand("write").unwrap(); for option in ["frozen", "target", "flake_lock", "out", "json"] { - assert!(write.get_arguments().any(|argument| argument.get_id() == option)); + assert!( + write + .get_arguments() + .any(|argument| argument.get_id() == option) + ); } } diff --git a/tests/nix_bundle_write_boundaries.rs b/tests/nix_bundle_write_boundaries.rs index 0573ed24..fa7fb7fe 100644 --- a/tests/nix_bundle_write_boundaries.rs +++ b/tests/nix_bundle_write_boundaries.rs @@ -62,12 +62,7 @@ outputs = ["out"] fs::write(root.join("data/value.txt"), b"immutable payload\n").unwrap(); } -fn run_bundle( - cwd: &Path, - lock: &Path, - output: &Path, - additional_env: &[(&str, &str)], -) -> Output { +fn run_bundle(cwd: &Path, lock: &Path, output: &Path, additional_env: &[(&str, &str)]) -> Output { let mut command = Command::new(zed()); command .current_dir(cwd) diff --git a/tests/nix_bundle_write_cli.rs b/tests/nix_bundle_write_cli.rs index f4a7ea3a..ca5772d9 100644 --- a/tests/nix_bundle_write_cli.rs +++ b/tests/nix_bundle_write_cli.rs @@ -167,10 +167,7 @@ fn command_creates_idempotent_no_clobber_bundle_from_nested_directory() { first_receipt["destination"], canonical_bundle.to_string_lossy().as_ref() ); - assert_eq!( - first_receipt["bundle_sha256"].as_str().unwrap().len(), - 64 - ); + assert_eq!(first_receipt["bundle_sha256"].as_str().unwrap().len(), 64); assert_bundle_shape(&bundle); assert_eq!(snapshot(&project), project_before); let bundle_before = snapshot(&bundle); @@ -190,7 +187,10 @@ fn command_creates_idempotent_no_clobber_bundle_from_nested_directory() { assert!(second.status.success(), "{}", stderr(&second)); let second_receipt: Value = serde_json::from_str(stdout(&second).trim()).unwrap(); assert_eq!(second_receipt["outcome"], "already-current"); - assert_eq!(first_receipt["bundle_sha256"], second_receipt["bundle_sha256"]); + assert_eq!( + first_receipt["bundle_sha256"], + second_receipt["bundle_sha256"] + ); assert_eq!(snapshot(&bundle), bundle_before); fs::write(bundle.join("README.md"), b"tampered\n").unwrap(); @@ -357,12 +357,7 @@ fn persisted_command_bundle_checks_and_builds_offline() { "--print-out-paths", ".#dataset", ]); - nix(&[ - "flake", - "check", - "--offline", - "--no-update-lock-file", - ]); + nix(&["flake", "check", "--offline", "--no-update-lock-file"]); let replay = nix(&[ "build", "--offline",