Repository navigation
ci: run language tools from the flake dev shell - #19
Conversation
Refs furedea/reusable-workflows#23 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Replace setup-uv with the nix-setup composite action and run every step in nix develop. The nix-setup SHA is a placeholder until the release exists. Refs furedea/reusable-workflows#23 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Refs furedea/reusable-workflows#23 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
@codex review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| statix | ||
| ]) | ||
| ++ [ | ||
| (pkgs.callPackage ./nix/python.nix { }) |
There was a problem hiding this comment.
P1: CPython 3.14.9 will be compiled from source on every Linux CI job
nix/python.nix replaces python314's src and postPatch, which gives it a new derivation hash. cache.nixos.org can't have a prebuilt copy, so the first nix develop in each of lint, typecheck, test and audit compiles CPython from source. On x86_64-linux nixpkgs also turns on LTO by default, which makes the build slower. On a standard ubuntu-latest runner that build can take close to or more than the jobs' timeout-minutes: 10, and the four jobs each do it separately.
Before this PR the overlay was only evaluated on aarch64-darwin, where a developer builds it once. This PR is the first time CI builds it.
Unless nix-setup@v1.3.0 restores a /nix/store cache (or a binary cache) that already holds this exact derivation, expect these jobs to time out on a cold cache. The PR body's "変更後" CI time is still blank, so this hasn't been measured yet. Possible fixes:
- Push the derivation to a binary cache (Cachix, magic-nix-cache, etc.).
- Raise the timeouts.
- Keep
setup-uvon Linux until nixpkgs ships Python 3.14.9 or later.
There was a problem hiding this comment.
Measured on this PR (run 42621079854, cold cache): the four jobs compiled CPython 3.14.9 and still finished inside the 10 minute limit: test 4m33s, lint 4m49s, typecheck 6m08s, audit 6m30s. So the timeout risk did not materialize, but the cold-cache cost is real (main used to take about 43s in total). nix-setup v1.3.0 restores the Nix store cache keyed on flake.nix and flake.lock and saves it only on push to main, so a pull request run is always cold until the first main run seeds it. I cannot show the warm number before merge. Neither nixpkgs 26.05 (python314 3.14.7) nor the locked nixpkgs-unstable (3.14.7) ships 3.14.9, and dropping the override would bring back the compromised emSign root, so a binary cache or keeping setup-uv on Linux is a decision for the owner.
Review summary1 blocking finding (P1)
Checked, no issues found
🤖 Generated with Claude Code |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
概要
CI の Python ツール（uv，ruff，ty，pytest，deptry，vulture）を，flake の devShell から動かす形にする．
setup-uvをやめ，Nix の準備は reusable-workflows の composite actionnix-setup（v1.3.0）に任せる．手元と CI で同じ版になり，flake.lockで中身が固定される．変更
flake.nixaarch64-darwinとx86_64-linuxの両方で出すnix/uv.nix.github/workflows/ci.ymlsetup-uvをnix-setupに置き換え，defaults.run.shellをnix develop --command bash -eo pipefail {0}にするall-greenの needs は変えていない．all-greenは Nix を入れない job なので，step にshell: bashを明示した．nix/python.nixとuv.nixの上書きは残した．CI の時間
変更前は main の直近 run（42501897285），変更後はこの PR の run（42621079854，キャッシュなし）の値．
nix/python.nixの CPython 3.14.9 をソースからビルドしているため．nixpkgs（26.05 と unstable のロック版）は 3.14.7 までで，binary cache に 3.14.9 がない．nix-setupは Nix store をpush時だけ保存するので，PR の run は常にキャッシュなし．main に入った後の run で store が復元されるはずだが，その時間は merge 前には測れない．setup-uvを残すか．Refs furedea/reusable-workflows#23
🤖 Generated with Claude Code