From 224fab5825c492bfde3abf979bed7c2c0b9f865a Mon Sep 17 00:00:00 2001 From: Chris Hodapp Date: Tue, 1 Sep 2026 01:01:02 -0700 Subject: [PATCH 1/2] maint: bump CI actions and keep CI on upstream Nix The workflows pinned nix-installer-action@v16 (November 2024) and actions/checkout@v4 since the repository's first commit; neither pin was deliberate. Move to v22 and v7. The installer has defaulted `determinate` to true since v21, which would have switched CI from upstream Nix to Determinate Nix as a side effect of the bump. Pass `determinate: false` so the checks keep running against the Nix a consumer of this flake is likely to have. Nothing in checkout v5 through v7 affects these workflows: the checkouts are plain, so neither v6's credential-file change nor v7's fork-PR restriction applies. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/check.yml | 18 ++++++++++++++---- .github/workflows/pages.yml | 9 +++++++-- 2 files changed, 21 insertions(+), 6 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index f8d3a67..246e7cb 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -11,8 +11,13 @@ jobs: # there and the check still runs. HAVE_CACHIX: ${{ secrets.CACHIX_AUTH_TOKEN != '' }} steps: - - uses: actions/checkout@v4 - - uses: DeterminateSystems/nix-installer-action@v16 + - uses: actions/checkout@v7 + - uses: DeterminateSystems/nix-installer-action@v22 + with: + # Upstream Nix, not Determinate Nix: the action has + # defaulted determinate to true since v21, and this + # project targets the Nix everyone else runs. + determinate: false - if: env.HAVE_CACHIX == 'true' uses: cachix/cachix-action@v17 with: @@ -27,8 +32,13 @@ jobs: runs-on: ubuntu-latest continue-on-error: true steps: - - uses: actions/checkout@v4 - - uses: DeterminateSystems/nix-installer-action@v16 + - uses: actions/checkout@v7 + - uses: DeterminateSystems/nix-installer-action@v22 + with: + # Upstream Nix, not Determinate Nix: the action has + # defaulted determinate to true since v21, and this + # project targets the Nix everyone else runs. + determinate: false - run: | nix eval 'github:nix-caisson/caisson-compat#lib.caisson-compat.tests.summary' \ --override-input caisson "path:$PWD" diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index f640912..cf21f4c 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -17,8 +17,13 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: DeterminateSystems/nix-installer-action@v16 + - uses: actions/checkout@v7 + - uses: DeterminateSystems/nix-installer-action@v22 + with: + # Upstream Nix, not Determinate Nix: the action has + # defaulted determinate to true since v21, and this + # project targets the Nix everyone else runs. + determinate: false - run: nix run 'nixpkgs#mdbook' -- build - uses: actions/configure-pages@v5 - uses: actions/upload-pages-artifact@v3 From bd553a8ac13450d87197c3b21fea262dc1e76e84 Mon Sep 17 00:00:00 2001 From: Chris Hodapp Date: Tue, 1 Sep 2026 01:06:18 -0700 Subject: [PATCH 2/2] maint: advance the caisson-core pin caisson-core's CI bump merged; take its main. The range touches only .github/workflows/check.yml and README.md, so nothing caisson evaluates changed, and `nix flake check` passes against the new rev (75/75 unit tests). Advancing keeps the pin from reading as a deliberate hold on a superseded revision. Co-Authored-By: Claude Opus 5 (1M context) --- pins.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pins.nix b/pins.nix index 05a6f36..f84191f 100644 --- a/pins.nix +++ b/pins.nix @@ -16,8 +16,8 @@ caisson-core = { owner = "nix-caisson"; repo = "caisson-core"; - rev = "f0670d3a2419bfa603fc7041ce77d8915ecbb915"; - narHash = "sha256-smVchmdqGUAwe6lw4hUjWTdmvPKa1ePPEkk6piyFWps="; + rev = "32a7fae933827fd953959535af2ddc170366cafb"; + narHash = "sha256-ari+MqiCE5DrdxI+1yUSCyZQRf2Or82O9gCJcRTuxgY="; }; # The base library: the nixpkgs.lib mirror (nixpkgs' lib directory # published on its own, a small fetch; the lib sits under /lib).