From 69e7308bae3c760932338dab2ab37d4a5f3e3ae2 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Wed, 5 Aug 2026 14:18:08 -0500 Subject: [PATCH 1/4] ci: materialize deterministic Nix operation-lock exclusion --- .../fix-nix-interop-operation-lock.yml | 108 ++++++++++++++++++ 1 file changed, 108 insertions(+) create mode 100644 .github/workflows/fix-nix-interop-operation-lock.yml diff --git a/.github/workflows/fix-nix-interop-operation-lock.yml b/.github/workflows/fix-nix-interop-operation-lock.yml new file mode 100644 index 00000000..324195ca --- /dev/null +++ b/.github/workflows/fix-nix-interop-operation-lock.yml @@ -0,0 +1,108 @@ +name: materialize deterministic Nix operation-lock exclusion + +on: + push: + branches: + - fix/nix-interop-exclude-operation-lock + paths: + - .github/workflows/fix-nix-interop-operation-lock.yml + +permissions: + contents: write + +concurrency: + group: fix-nix-interop-operation-lock + cancel-in-progress: false + +defaults: + run: + shell: bash + +jobs: + materialize: + if: github.actor != 'github-actions[bot]' + runs-on: ubuntu-24.04 + timeout-minutes: 15 + steps: + - name: Check out exact repair branch + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: fix/nix-interop-exclude-operation-lock + persist-credentials: true + show-progress: false + + - name: Remove volatile operation-lock diagnostics from fixed outputs + run: | + set -euo pipefail + python3 - <<'PY' + from pathlib import Path + + package = Path('nix/zed-package.nix') + text = package.read_text() + old = ''' if [[ -e "$work/.zpkg-staging" ]]; then + echo "zed-pkg Nix bridge: successful install left transaction state behind" >&2 + exit 1 + fi + + mkdir -p "$out/tree" "$out/metadata" + ''' + new = ''' if [[ -e "$work/.zpkg-staging" ]]; then + echo "zed-pkg Nix bridge: successful install left transaction state behind" >&2 + exit 1 + fi + + # `.zed/operation.lock` is a durable local rendezvous point whose + # diagnostic payload contains process/host/timing data. Descriptor + # ownership—not those bytes—is authoritative. It must not enter a + # recursive fixed output or identical frozen installs hash differently. + operation_lock="$work/.zed/operation.lock" + if [[ -L "$operation_lock" ]]; then + echo "zed-pkg Nix bridge: operation lock must not be a symlink" >&2 + exit 1 + fi + if [[ -e "$operation_lock" ]]; then + if [[ ! -f "$operation_lock" ]]; then + echo "zed-pkg Nix bridge: operation lock must be a regular file" >&2 + exit 1 + fi + rm -f -- "$operation_lock" + rmdir "$work/.zed" 2>/dev/null || true + fi + + mkdir -p "$out/tree" "$out/metadata" + ''' + if old not in text: + raise SystemExit('Nix bridge transaction-state anchor not found') + package.write_text(text.replace(old, new, 1)) + + workflow = Path('.github/workflows/nix-interop.yml') + text = workflow.read_text() + old = ''' test ! -e "$deps_a/tree/.vendor/.zed/zed-pkg/docker-node-lib/generated/output.txt" + test -f "$deps_a/metadata/bridge.json" + ''' + new = ''' test ! -e "$deps_a/tree/.vendor/.zed/zed-pkg/docker-node-lib/generated/output.txt" + test ! -e "$deps_a/tree/.zed/operation.lock" + test -f "$deps_a/metadata/bridge.json" + ''' + if old not in text: + raise SystemExit('Nix interop output assertion anchor not found') + workflow.write_text(text.replace(old, new, 1)) + PY + + - name: Validate patch shape + run: | + set -euo pipefail + git diff --check + grep -F 'operation_lock="$work/.zed/operation.lock"' nix/zed-package.nix + grep -F 'test ! -e "$deps_a/tree/.zed/operation.lock"' .github/workflows/nix-interop.yml + + - name: Commit ordinary repair source + run: | + set -euo pipefail + rm .github/workflows/fix-nix-interop-operation-lock.yml + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add nix/zed-package.nix .github/workflows/nix-interop.yml .github/workflows/fix-nix-interop-operation-lock.yml + git diff --cached --check + git commit -m 'fix: exclude operation-lock diagnostics from Nix fixed outputs' + git push origin HEAD:fix/nix-interop-exclude-operation-lock From 7844d73c2be403565e22826d45da396a345df490 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Wed, 5 Aug 2026 14:28:16 -0500 Subject: [PATCH 2/4] ci: commit Nix product repair without workflow writes --- .../fix-nix-interop-operation-lock.yml | 35 +++++-------------- 1 file changed, 9 insertions(+), 26 deletions(-) diff --git a/.github/workflows/fix-nix-interop-operation-lock.yml b/.github/workflows/fix-nix-interop-operation-lock.yml index 324195ca..db95f2f8 100644 --- a/.github/workflows/fix-nix-interop-operation-lock.yml +++ b/.github/workflows/fix-nix-interop-operation-lock.yml @@ -39,14 +39,16 @@ jobs: package = Path('nix/zed-package.nix') text = package.read_text() - old = ''' if [[ -e "$work/.zpkg-staging" ]]; then + marker = 'operation_lock="$work/.zed/operation.lock"' + if marker not in text: + old = ''' if [[ -e "$work/.zpkg-staging" ]]; then echo "zed-pkg Nix bridge: successful install left transaction state behind" >&2 exit 1 fi mkdir -p "$out/tree" "$out/metadata" ''' - new = ''' if [[ -e "$work/.zpkg-staging" ]]; then + new = ''' if [[ -e "$work/.zpkg-staging" ]]; then echo "zed-pkg Nix bridge: successful install left transaction state behind" >&2 exit 1 fi @@ -71,38 +73,19 @@ jobs: mkdir -p "$out/tree" "$out/metadata" ''' - if old not in text: - raise SystemExit('Nix bridge transaction-state anchor not found') - package.write_text(text.replace(old, new, 1)) - - workflow = Path('.github/workflows/nix-interop.yml') - text = workflow.read_text() - old = ''' test ! -e "$deps_a/tree/.vendor/.zed/zed-pkg/docker-node-lib/generated/output.txt" - test -f "$deps_a/metadata/bridge.json" - ''' - new = ''' test ! -e "$deps_a/tree/.vendor/.zed/zed-pkg/docker-node-lib/generated/output.txt" - test ! -e "$deps_a/tree/.zed/operation.lock" - test -f "$deps_a/metadata/bridge.json" - ''' - if old not in text: - raise SystemExit('Nix interop output assertion anchor not found') - workflow.write_text(text.replace(old, new, 1)) + if old not in text: + raise SystemExit('Nix bridge transaction-state anchor not found') + package.write_text(text.replace(old, new, 1)) PY - - name: Validate patch shape + - name: Validate and commit only the product file run: | set -euo pipefail git diff --check grep -F 'operation_lock="$work/.zed/operation.lock"' nix/zed-package.nix - grep -F 'test ! -e "$deps_a/tree/.zed/operation.lock"' .github/workflows/nix-interop.yml - - - name: Commit ordinary repair source - run: | - set -euo pipefail - rm .github/workflows/fix-nix-interop-operation-lock.yml git config user.name 'github-actions[bot]' git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add nix/zed-package.nix .github/workflows/nix-interop.yml .github/workflows/fix-nix-interop-operation-lock.yml + git add nix/zed-package.nix git diff --cached --check git commit -m 'fix: exclude operation-lock diagnostics from Nix fixed outputs' git push origin HEAD:fix/nix-interop-exclude-operation-lock From a43e54cb660fe23b1e32ffd749093b4b8d0bcf5d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 19:31:11 +0000 Subject: [PATCH 3/4] fix: exclude operation-lock diagnostics from Nix fixed outputs --- nix/zed-package.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/nix/zed-package.nix b/nix/zed-package.nix index e8d628fb..92b02249 100644 --- a/nix/zed-package.nix +++ b/nix/zed-package.nix @@ -179,6 +179,24 @@ rec { exit 1 fi + # `.zed/operation.lock` is a durable local rendezvous point whose + # diagnostic payload contains process/host/timing data. Descriptor + # ownership—not those bytes—is authoritative. It must not enter a + # recursive fixed output or identical frozen installs hash differently. + operation_lock="$work/.zed/operation.lock" + if [[ -L "$operation_lock" ]]; then + echo "zed-pkg Nix bridge: operation lock must not be a symlink" >&2 + exit 1 + fi + if [[ -e "$operation_lock" ]]; then + if [[ ! -f "$operation_lock" ]]; then + echo "zed-pkg Nix bridge: operation lock must be a regular file" >&2 + exit 1 + fi + rm -f -- "$operation_lock" + rmdir "$work/.zed" 2>/dev/null || true + fi + mkdir -p "$out/tree" "$out/metadata" shopt -s dotglob nullglob for entry in "$work"/*; do From c4c79dd98bc4321c26e5feee812a5a780aaa6db5 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Wed, 5 Aug 2026 14:32:33 -0500 Subject: [PATCH 4/4] ci: remove completed Nix operation-lock materializer --- .../fix-nix-interop-operation-lock.yml | 91 ------------------- 1 file changed, 91 deletions(-) delete mode 100644 .github/workflows/fix-nix-interop-operation-lock.yml diff --git a/.github/workflows/fix-nix-interop-operation-lock.yml b/.github/workflows/fix-nix-interop-operation-lock.yml deleted file mode 100644 index db95f2f8..00000000 --- a/.github/workflows/fix-nix-interop-operation-lock.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: materialize deterministic Nix operation-lock exclusion - -on: - push: - branches: - - fix/nix-interop-exclude-operation-lock - paths: - - .github/workflows/fix-nix-interop-operation-lock.yml - -permissions: - contents: write - -concurrency: - group: fix-nix-interop-operation-lock - cancel-in-progress: false - -defaults: - run: - shell: bash - -jobs: - materialize: - if: github.actor != 'github-actions[bot]' - runs-on: ubuntu-24.04 - timeout-minutes: 15 - steps: - - name: Check out exact repair branch - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - ref: fix/nix-interop-exclude-operation-lock - persist-credentials: true - show-progress: false - - - name: Remove volatile operation-lock diagnostics from fixed outputs - run: | - set -euo pipefail - python3 - <<'PY' - from pathlib import Path - - package = Path('nix/zed-package.nix') - text = package.read_text() - marker = 'operation_lock="$work/.zed/operation.lock"' - if marker not in text: - old = ''' if [[ -e "$work/.zpkg-staging" ]]; then - echo "zed-pkg Nix bridge: successful install left transaction state behind" >&2 - exit 1 - fi - - mkdir -p "$out/tree" "$out/metadata" - ''' - new = ''' if [[ -e "$work/.zpkg-staging" ]]; then - echo "zed-pkg Nix bridge: successful install left transaction state behind" >&2 - exit 1 - fi - - # `.zed/operation.lock` is a durable local rendezvous point whose - # diagnostic payload contains process/host/timing data. Descriptor - # ownership—not those bytes—is authoritative. It must not enter a - # recursive fixed output or identical frozen installs hash differently. - operation_lock="$work/.zed/operation.lock" - if [[ -L "$operation_lock" ]]; then - echo "zed-pkg Nix bridge: operation lock must not be a symlink" >&2 - exit 1 - fi - if [[ -e "$operation_lock" ]]; then - if [[ ! -f "$operation_lock" ]]; then - echo "zed-pkg Nix bridge: operation lock must be a regular file" >&2 - exit 1 - fi - rm -f -- "$operation_lock" - rmdir "$work/.zed" 2>/dev/null || true - fi - - mkdir -p "$out/tree" "$out/metadata" - ''' - if old not in text: - raise SystemExit('Nix bridge transaction-state anchor not found') - package.write_text(text.replace(old, new, 1)) - PY - - - name: Validate and commit only the product file - run: | - set -euo pipefail - git diff --check - grep -F 'operation_lock="$work/.zed/operation.lock"' nix/zed-package.nix - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add nix/zed-package.nix - git diff --cached --check - git commit -m 'fix: exclude operation-lock diagnostics from Nix fixed outputs' - git push origin HEAD:fix/nix-interop-exclude-operation-lock