From 856ea954557958f39ca16e977067ca9284d5aed4 Mon Sep 17 00:00:00 2001 From: Mike Rosseel Date: Sat, 15 Aug 2026 14:21:20 +0200 Subject: [PATCH] ci(nixos): retire the preview label from the testable PR build The preview label did nothing testable did not. Both job conditions accepted either, and nothing downstream inspected which one was applied: update_manifest.py never receives a label and writes every PR build into channels["unstable"]. This repo has no preview label, so the condition was dead; the label existed only on the mrosseel fork, where it has now been deleted and testable's description corrected to say it publishes to the unstable channel. Both actions/checkout allow-unsafe-pr-checkout opt-ins are unchanged. --- .github/workflows/nixos-pr-build.yml | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/.github/workflows/nixos-pr-build.yml b/.github/workflows/nixos-pr-build.yml index 004591805..0bdc6e930 100644 --- a/.github/workflows/nixos-pr-build.yml +++ b/.github/workflows/nixos-pr-build.yml @@ -6,10 +6,10 @@ name: Build PiFinder NixOS (testable PRs) # `pull_request_target` runs in the BASE repo's trusted context, so the job has # the real ATTIC_TOKEN and a read-write GITHUB_TOKEN even for fork PRs. The # contributor's code is checked out explicitly (head SHA) and built. This is -# only reached after a maintainer applies the `testable` (or `preview`) label — -# that label is the security boundary: it runs contributor code with the cache -# push token, so review the diff before labeling, and re-review on each new push -# to a labeled PR. +# only reached after a maintainer applies the `testable` label — that label is +# the security boundary: it runs contributor code with the cache push token, so +# review the diff before labeling, and re-review on each new push to a labeled +# PR. # # Build strategy: the free GitHub-hosted ubuntu-24.04-arm runner builds first. # Its cores are faster than the Pi5, and the Attic cache (cache.pifinder.eu) is @@ -33,9 +33,7 @@ permissions: jobs: # Primary: free GitHub-hosted arm64 runner (native aarch64, no QEMU). build-hosted: - if: | - contains(github.event.pull_request.labels.*.name, 'preview') || - contains(github.event.pull_request.labels.*.name, 'testable') + if: contains(github.event.pull_request.labels.*.name, 'testable') runs-on: ubuntu-24.04-arm # Generous: only a kernel/source change compiles from scratch (~1 h on this # 4-core runner); everything else substitutes from Attic in minutes. @@ -52,8 +50,8 @@ jobs: persist-credentials: false # Fork PRs: pull_request_target checkout of the head requires opt-in # since actions/checkout began refusing it. The head SHA is pinned - # explicitly and only reached after the `testable`/`preview` label, - # which is the review gate for running contributor code. + # explicitly and only reached after the `testable` label, which is the + # review gate for running contributor code. allow-unsafe-pr-checkout: true - uses: DeterminateSystems/nix-installer-action@main @@ -106,8 +104,7 @@ jobs: needs: build-hosted if: | always() && - (contains(github.event.pull_request.labels.*.name, 'preview') || - contains(github.event.pull_request.labels.*.name, 'testable')) && + contains(github.event.pull_request.labels.*.name, 'testable') && needs.build-hosted.result == 'failure' runs-on: [self-hosted, aarch64] timeout-minutes: 240 @@ -121,8 +118,8 @@ jobs: persist-credentials: false # Fork PRs: pull_request_target checkout of the head requires opt-in # since actions/checkout began refusing it. The head SHA is pinned - # explicitly and only reached after the `testable`/`preview` label, - # which is the review gate for running contributor code. + # explicitly and only reached after the `testable` label, which is the + # review gate for running contributor code. allow-unsafe-pr-checkout: true - name: Ensure nix is on PATH (self-hosted runner)