From 0c49978b2278c9ab71f95049560713bdc6384d95 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 3 Nov 2026 00:53:30 +0000 Subject: [PATCH 1/2] Adopt the org CI Replace pages.yml with .github/workflows/ci.yml (pkgs org-ci caller, minor 0), add the org ruleset file, update the docs that pointed at pages.yml, and bump org-pkgs. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01E5NrkgmtBE4jpQ1PUPbs6v --- .github/rulesets/default.json | 41 +++++++ .github/workflows/ci.yml | 33 ++++++ .github/workflows/pages.yml | 52 --------- CLAUDE.md | 5 +- README.md | 4 +- documentation/docs/getting-started.md | 10 +- flake.lock | 151 +++++++++++++++++++++++++- 7 files changed, 232 insertions(+), 64 deletions(-) create mode 100644 .github/rulesets/default.json create mode 100644 .github/workflows/ci.yml delete mode 100644 .github/workflows/pages.yml diff --git a/.github/rulesets/default.json b/.github/rulesets/default.json new file mode 100644 index 0000000..44e36da --- /dev/null +++ b/.github/rulesets/default.json @@ -0,0 +1,41 @@ +{ + "name": "default", + "target": "branch", + "enforcement": "active", + "conditions": { + "ref_name": { + "include": ["~DEFAULT_BRANCH"], + "exclude": [] + } + }, + "rules": [ + { "type": "deletion" }, + { "type": "non_fast_forward" }, + { "type": "required_linear_history" }, + { "type": "required_signatures" }, + { + "type": "pull_request", + "parameters": { + "required_approving_review_count": 0, + "dismiss_stale_reviews_on_push": false, + "require_code_owner_review": false, + "require_last_push_approval": false, + "required_review_thread_resolution": false, + "allowed_merge_methods": ["squash"] + } + }, + { + "type": "required_status_checks", + "parameters": { + "strict_required_status_checks_policy": true, + "do_not_enforce_on_create": false, + "required_status_checks": [ + { "context": "ci / flake-check", "integration_id": 15368 } + ] + } + } + ], + "bypass_actors": [ + { "actor_id": null, "actor_type": "OrganizationAdmin", "bypass_mode": "pull_request" } + ] +} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..abfcfef --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,33 @@ +# Org standard CI: the external-systems/pkgs org-ci workflow. `nix flake +# check` on PRs, the merge queue and main; on main, after it passes, the +# docs/slides deploy to GitHub Pages and a 0.. release. +# +# Required status check for the ruleset: "ci / flake-check". +# +# Private flake inputs (e.g. external-systems/secrets): give the repo the +# NIX_APP_ID + NIX_APP_PRIVATE_KEY org secrets and add +# `private-repos: secrets` under `with:`. +name: ci + +on: + push: + branches: [main] + pull_request: + merge_group: + workflow_dispatch: + +permissions: {} + +jobs: + ci: + uses: external-systems/pkgs/.github/workflows/org-ci.yml@main + # The union org-ci's jobs need; each job narrows it to its own. + permissions: + contents: write + actions: write + pages: write + id-token: write + with: + # Release series x in 0.x.y. + minor: 0 + secrets: inherit diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml deleted file mode 100644 index afd5975..0000000 --- a/.github/workflows/pages.yml +++ /dev/null @@ -1,52 +0,0 @@ -# Build the MkDocs site (with the slide deck at /slides/) using Nix and -# deploy it to GitHub Pages. Pull requests only check and build. -# -# One-time setup: Settings → Pages → Build and deployment → Source: -# "GitHub Actions". -name: pages - -on: - push: - branches: [main] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -# One deployment at a time; a newer push cancels an older pending one. -concurrency: - group: pages-${{ github.ref }} - cancel-in-progress: true - -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: cachix/install-nix-action@v31 - - name: Check (both builds + Nix lint) - run: nix flake check -L - - name: Build the site - run: | - nix build .#documentation -L - # Copy out of the read-only Nix store for the Pages upload. - cp -rL result _site - chmod -R u+w _site - - uses: actions/upload-pages-artifact@v3 - with: - path: _site - - deploy: - if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main' - needs: build - runs-on: ubuntu-latest - permissions: - pages: write - id-token: write - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - steps: - - id: deployment - uses: actions/deploy-pages@v4 diff --git a/CLAUDE.md b/CLAUDE.md index 0895ae0..1e4c8e6 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -12,8 +12,9 @@ The website and deck are built in CI and published to GitHub Pages only. Never commit build output: no `result` / `result-*` links, no `_site/`, `site/` or `documentation/site/` (all gitignored), no built deck copied into the tree, no `gh-pages` branch pushes. To publish, merge to `main`; -`.github/workflows/pages.yml` runs `nix flake check`, builds -`.#documentation` (deck at `/slides/`) and deploys it. +`.github/workflows/ci.yml` calls the org CI (external-systems/pkgs +`org-ci.yml`): it runs `nix flake check`, builds `.#documentation` (deck +at `/slides/`) and deploys it. Change CI only in pkgs, never here. ## Build and check diff --git a/README.md b/README.md index 389dd84..8d9d312 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,7 @@ Remember to `git add` new files: Nix only sees files git tracks. Never commit build output (`result`, `_site/`, `site/`): CI builds the docs site, deck included, and deploys it to GitHub Pages -(`.github/workflows/pages.yml`). +(`.github/workflows/ci.yml`, the external-systems/pkgs org CI). The docs site this repo builds is also its tutorial: start with `documentation/docs/getting-started.md`, or run the preview and read it in @@ -80,7 +80,7 @@ flake-parts/ consumer-facing modules, auto-imported: the template output dev/ dev partition: inputs (dev/flake.lock), formatter, checks, docs devenv.yaml dev shell (devenv CLI), the org shell from external-systems/pkgs documentation/ flake-module.nix + MkDocs site (mkdocs.yml, docs/) + slides/ deck -.github/workflows/ pages.yml: check, build and deploy the docs site to GitHub Pages +.github/ ci.yml (org CI: check, Pages deploy, release) + rulesets/default.json .vscode/ nixd (Nix language server) settings ``` diff --git a/documentation/docs/getting-started.md b/documentation/docs/getting-started.md index cc3984b..358e542 100644 --- a/documentation/docs/getting-started.md +++ b/documentation/docs/getting-started.md @@ -80,10 +80,12 @@ nix flake check # builds both sites, lints, checks the lock files ## 6. Publish to GitHub Pages -The repo ships `.github/workflows/pages.yml`. On every push to `main` it -runs `nix flake check`, builds the docs site (slides included under -`/slides/`) and deploys it to GitHub Pages. Pull requests run the same -checks and build without deploying. +The repo ships `.github/workflows/ci.yml`, which calls the +external-systems org CI (`org-ci.yml` in external-systems/pkgs). Pull +requests run `nix flake check` (the `ci / flake-check` status). On every +push to `main` it also builds the docs site (slides included under +`/slides/`), deploys it to GitHub Pages and tags a `0..` +release. Turn it on once per repo: **Settings → Pages → Build and deployment → Source: GitHub Actions**. The site then appears at diff --git a/flake.lock b/flake.lock index 368c720..ebf4cee 100644 --- a/flake.lock +++ b/flake.lock @@ -81,6 +81,30 @@ "type": "github" } }, + "moscripts": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "nixpkgs" + ], + "pyproject-build-systems": "pyproject-build-systems_2", + "pyproject-nix": "pyproject-nix_2", + "systems": "systems_3", + "uv2nix": "uv2nix_2" + }, + "locked": { + "lastModified": 1776608080, + "narHash": "sha256-4vVq0KIJe/no8+6RMDLFgc6PhbsKas45+vvJBzkKw7k=", + "rev": "c7b7977f4494fc1d48eada86d6f8e9174a74d0e1", + "revCount": 77, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/andrewthomaslee/moscripts/0.1.0/019da619-cbca-7990-81d0-6071370e1994/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/andrewthomaslee/moscripts/%2A" + } + }, "nix-github-actions": { "inputs": { "nixpkgs": [ @@ -123,14 +147,16 @@ "inputs": { "flake-parts": "flake-parts", "import-tree": "import-tree", - "nixpkgs": "nixpkgs" + "moscripts": "moscripts", + "nixpkgs": "nixpkgs", + "zen-browser": "zen-browser" }, "locked": { - "lastModified": 1793444658, - "narHash": "sha256-Fk+uJAmFS0FbZqH48EoqRifwiJM1Z1TlfX5f4hZS4/M=", + "lastModified": 1793666333, + "narHash": "sha256-mgGnU2A7gcLhPVu6gsMHJ4TqO5wHIDxV+6N9xbFfVE4=", "owner": "external-systems", "repo": "pkgs", - "rev": "e058d99fe9f04de4fc47ce892d0efbfebba7929b", + "rev": "c66adf4c5f91d4da541ff9d896c86eb5414886c3", "type": "github" }, "original": { @@ -193,6 +219,38 @@ "type": "github" } }, + "pyproject-build-systems_2": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "moscripts", + "nixpkgs" + ], + "pyproject-nix": [ + "org-pkgs", + "moscripts", + "pyproject-nix" + ], + "uv2nix": [ + "org-pkgs", + "moscripts", + "uv2nix" + ] + }, + "locked": { + "lastModified": 1756087852, + "narHash": "sha256-4jc3JDQt75fYXFrglgqyzF6C6zLU0QGLymzian4aP+U=", + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "rev": "6edb3ae27395cd88be3d64b732d1539957dad59c", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "type": "github" + } + }, "pyproject-nix": { "inputs": { "nixpkgs": [ @@ -214,6 +272,28 @@ "type": "github" } }, + "pyproject-nix_2": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "moscripts", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1756395552, + "narHash": "sha256-5aJM14MpoLk2cdZAetu60OkLQrtFLWTICAyn1EP7ZpM=", + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "rev": "030dffc235dcf240d918c651c78dc5f158067b51", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "type": "github" + } + }, "reveal-js": { "flake": false, "locked": { @@ -280,6 +360,21 @@ "type": "github" } }, + "systems_3": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "treefmt-nix": { "inputs": { "nixpkgs": [ @@ -326,6 +421,54 @@ "repo": "uv2nix", "type": "github" } + }, + "uv2nix_2": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "moscripts", + "nixpkgs" + ], + "pyproject-nix": [ + "org-pkgs", + "moscripts", + "pyproject-nix" + ] + }, + "locked": { + "lastModified": 1756466761, + "narHash": "sha256-ALXRHIMXQ4qVNfCbcWykC23MjMwUoHn9BreoBfqmq0Y=", + "owner": "pyproject-nix", + "repo": "uv2nix", + "rev": "0529e6d8227517205afcd1b37eee3088db745730", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "uv2nix", + "type": "github" + } + }, + "zen-browser": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1793356942, + "narHash": "sha256-3ddg7v2Ya11zEeQghXELyFwYIpv+nCTm2uVmu3LmvfU=", + "owner": "youwen5", + "repo": "zen-browser-flake", + "rev": "532b9a848c6b96d9f607e8856d1a458bdb7dcf66", + "type": "github" + }, + "original": { + "owner": "youwen5", + "repo": "zen-browser-flake", + "type": "github" + } } }, "root": "root", From 8a16675527110b35190b5396b15c62a84196e2c2 Mon Sep 17 00:00:00 2001 From: andrewthomaslee Date: Mon, 2 Nov 2026 19:18:43 -0600 Subject: [PATCH 2/2] update locks --- dev/flake.lock | 12 ++-- devenv.lock | 153 +++++++++++++++++++++++++++++++++++++++++++++++-- devenv.yaml | 2 +- 3 files changed, 155 insertions(+), 12 deletions(-) diff --git a/dev/flake.lock b/dev/flake.lock index e09c9e5..745ee9e 100644 --- a/dev/flake.lock +++ b/dev/flake.lock @@ -16,6 +16,12 @@ "type": "github" } }, + "root": { + "inputs": { + "dev-nixpkgs": "dev-nixpkgs", + "treefmt-nix": "treefmt-nix" + } + }, "treefmt-nix": { "inputs": { "nixpkgs": [ @@ -35,12 +41,6 @@ "repo": "treefmt-nix", "type": "github" } - }, - "root": { - "inputs": { - "dev-nixpkgs": "dev-nixpkgs", - "treefmt-nix": "treefmt-nix" - } } }, "root": "root", diff --git a/devenv.lock b/devenv.lock index 9379ced..2006446 100644 --- a/devenv.lock +++ b/devenv.lock @@ -53,6 +53,30 @@ "type": "github" } }, + "moscripts": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "nixpkgs" + ], + "pyproject-build-systems": "pyproject-build-systems", + "pyproject-nix": "pyproject-nix", + "systems": "systems", + "uv2nix": "uv2nix" + }, + "locked": { + "lastModified": 1776608080, + "narHash": "sha256-4vVq0KIJe/no8+6RMDLFgc6PhbsKas45+vvJBzkKw7k=", + "rev": "c7b7977f4494fc1d48eada86d6f8e9174a74d0e1", + "revCount": 77, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/andrewthomaslee/moscripts/0.1.0/019da619-cbca-7990-81d0-6071370e1994/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/andrewthomaslee/moscripts/%2A" + } + }, "nixpkgs": { "locked": { "lastModified": 1793110635, @@ -73,20 +97,76 @@ "inputs": { "flake-parts": "flake-parts", "import-tree": "import-tree", - "nixpkgs": "nixpkgs" + "moscripts": "moscripts", + "nixpkgs": "nixpkgs", + "zen-browser": "zen-browser" }, "locked": { - "lastModified": 1793444658, - "narHash": "sha256-Fk+uJAmFS0FbZqH48EoqRifwiJM1Z1TlfX5f4hZS4/M=", + "lastModified": 1793666333, + "narHash": "sha256-mgGnU2A7gcLhPVu6gsMHJ4TqO5wHIDxV+6N9xbFfVE4=", "owner": "external-systems", "repo": "pkgs", - "rev": "e058d99fe9f04de4fc47ce892d0efbfebba7929b", + "rev": "c66adf4c5f91d4da541ff9d896c86eb5414886c3", "type": "github" }, "original": { "owner": "external-systems", "repo": "pkgs", - "rev": "e058d99fe9f04de4fc47ce892d0efbfebba7929b", + "rev": "c66adf4c5f91d4da541ff9d896c86eb5414886c3", + "type": "github" + } + }, + "pyproject-build-systems": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "moscripts", + "nixpkgs" + ], + "pyproject-nix": [ + "org-pkgs", + "moscripts", + "pyproject-nix" + ], + "uv2nix": [ + "org-pkgs", + "moscripts", + "uv2nix" + ] + }, + "locked": { + "lastModified": 1756087852, + "narHash": "sha256-4jc3JDQt75fYXFrglgqyzF6C6zLU0QGLymzian4aP+U=", + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "rev": "6edb3ae27395cd88be3d64b732d1539957dad59c", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "type": "github" + } + }, + "pyproject-nix": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "moscripts", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1756395552, + "narHash": "sha256-5aJM14MpoLk2cdZAetu60OkLQrtFLWTICAyn1EP7ZpM=", + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "rev": "030dffc235dcf240d918c651c78dc5f158067b51", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "pyproject.nix", "type": "github" } }, @@ -99,6 +179,69 @@ ], "org-pkgs": "org-pkgs" } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "uv2nix": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "moscripts", + "nixpkgs" + ], + "pyproject-nix": [ + "org-pkgs", + "moscripts", + "pyproject-nix" + ] + }, + "locked": { + "lastModified": 1756466761, + "narHash": "sha256-ALXRHIMXQ4qVNfCbcWykC23MjMwUoHn9BreoBfqmq0Y=", + "owner": "pyproject-nix", + "repo": "uv2nix", + "rev": "0529e6d8227517205afcd1b37eee3088db745730", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "uv2nix", + "type": "github" + } + }, + "zen-browser": { + "inputs": { + "nixpkgs": [ + "org-pkgs", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1793356942, + "narHash": "sha256-3ddg7v2Ya11zEeQghXELyFwYIpv+nCTm2uVmu3LmvfU=", + "owner": "youwen5", + "repo": "zen-browser-flake", + "rev": "532b9a848c6b96d9f607e8856d1a458bdb7dcf66", + "type": "github" + }, + "original": { + "owner": "youwen5", + "repo": "zen-browser-flake", + "type": "github" + } } }, "root": "root", diff --git a/devenv.yaml b/devenv.yaml index 07036ce..eb3934e 100644 --- a/devenv.yaml +++ b/devenv.yaml @@ -6,7 +6,7 @@ # pkgs ("attribute 'bash' missing"). inputs: org-pkgs: - url: github:external-systems/pkgs/e058d99fe9f04de4fc47ce892d0efbfebba7929b + url: github:external-systems/pkgs/c66adf4c5f91d4da541ff9d896c86eb5414886c3 nixpkgs: follows: org-pkgs/nixpkgs imports: