autonomic-bot
2cede01ed7
Mechanical, semantics-preserving cleanup so the codebase passes the new lint stage:
- ruff format: all 32 Python files (wraps long signatures, normalizes quotes/blank lines).
- nixpkgs-fmt: modules/drone-runner.nix.
- shfmt (-i 2 -ci): scripts/*.sh.
Lint fixes (reviewed, behavior-preserving — no test weakened):
- ruff SIM105: try/except-pass -> contextlib.suppress (abra.py app_config rm; lifecycle.py janitor).
- ruff SIM115: open().read() -> with open() (run_recipe_ci.py redaction-values + gitea-token).
- statix: merge repeated sops `secrets.*` keys into one `secrets = { ... }` (comments kept);
empty fn pattern `{ ... }:` -> `_:` (packages.nix).
- deadnix: drop unused lambda args (flake `self`; configuration.nix `lib`; overlay `final` -> `_`).
Verified on cc-ci: `scripts/lint.sh` -> lint: PASS; nixosConfigurations.cc-ci evaluates;
all Python byte-compiles. The deployed bridge/dashboard/runner source changes hash (reformat),
so cc-ci will be rebuilt to the new closure in W2 before the cold D1-D10 re-verification.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
57 lines
2.0 KiB
Nix
57 lines
2.0 KiB
Nix
{
|
|
description = "cc-ci — Co-op Cloud recipe CI server (NixOS)";
|
|
|
|
inputs = {
|
|
# Pinned to the exact revision cc-ci already runs, so the first rebuild from
|
|
# this repo is a true no-op-then-base (M0). Bump deliberately, not drift.
|
|
nixpkgs.url = "github:NixOS/nixpkgs/50ab793786d9de88ee30ec4e4c24fb4236fc2674";
|
|
|
|
# Pinned to a commit that still uses plain `buildGoModule` — sops-nix master moved to
|
|
# `buildGo125Module` (Go 1.25), which our pinned nixpkgs 24.11 (2025-06-30) does not have.
|
|
sops-nix.url = "github:Mic92/sops-nix/77c423a03b9b2b79709ea2cb63336312e78b72e2";
|
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
outputs = { nixpkgs, sops-nix, ... }:
|
|
let
|
|
system = "x86_64-linux";
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
# Lint/format toolchain (Phase 1b, RL1). Same tools the `.drone.yml` lint stage and
|
|
# `scripts/lint.sh` use, built from the pinned nixpkgs so CI and local agree byte-for-byte.
|
|
# Nix: nixpkgs-fmt (format) · statix (lints) · deadnix (dead code).
|
|
# Python: ruff (lint + format). Shell: shellcheck + shfmt. YAML: yamllint.
|
|
lintTools = with pkgs; [
|
|
nixpkgs-fmt
|
|
statix
|
|
deadnix
|
|
ruff
|
|
shellcheck
|
|
shfmt
|
|
yamllint
|
|
];
|
|
in
|
|
{
|
|
nixosConfigurations.cc-ci = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
sops-nix.nixosModules.sops
|
|
./hosts/cc-ci/configuration.nix
|
|
];
|
|
};
|
|
|
|
devShells.${system} = {
|
|
# Devshell for working on the harness/bridge locally (tools + lint toolchain).
|
|
default = pkgs.mkShell {
|
|
packages = (with pkgs; [ git jq curl ]) ++ lintTools;
|
|
};
|
|
# `nix develop .#lint` — exactly the lint toolchain, nothing else. Used by
|
|
# `scripts/lint.sh` and the `.drone.yml` lint stage.
|
|
lint = pkgs.mkShell {
|
|
packages = lintTools;
|
|
};
|
|
};
|
|
|
|
formatter.${system} = pkgs.nixpkgs-fmt;
|
|
};
|
|
}
|