From 8b30144e94d9cf218f348c3d33e89f17f3faf44a Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Tue, 10 Nov 2026 22:06:48 -0500 Subject: [PATCH] ci: pin nix run nixpkgs to the flake's nixpkgs Bare `nix run nixpkgs#...` pulls the latest nixpkgs from the registry. That can differ from run to run, and it costs an extra download. Add `--inputs-from .` so these calls use the nixpkgs pinned in flake.lock, as the qemu build step already does. Assisted-by: Claude --- .github/workflows/ami-release-nix.yml | 2 +- .github/workflows/dockerhub-release-matrix.yml | 14 +++++++------- .github/workflows/manual-docker-release.yml | 14 +++++++------- .../publish-nix-pgupgrade-bin-flake-version.yml | 6 +++--- .../workflows/publish-nix-pgupgrade-scripts.yml | 6 +++--- .github/workflows/qemu-image-build.yml | 6 +++--- .github/workflows/qemu-image-release.yml | 2 +- .github/workflows/testinfra-ami-build.yml | 2 +- 8 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml index 74810ef270..045675025c 100644 --- a/.github/workflows/ami-release-nix.yml +++ b/.github/workflows/ami-release-nix.yml @@ -32,7 +32,7 @@ jobs: - name: Set PostgreSQL versions id: set-versions run: | - VERSIONS=$(nix run nixpkgs#yq-go -- -o=json -I=0 '.postgres_major' ansible/vars.yml) + VERSIONS=$(nix run --inputs-from . nixpkgs#yq-go -- -o=json -I=0 '.postgres_major' ansible/vars.yml) echo "postgres_versions=$VERSIONS" >> "$GITHUB_OUTPUT" build: diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml index 763071abcd..70906b6333 100644 --- a/.github/workflows/dockerhub-release-matrix.yml +++ b/.github/workflows/dockerhub-release-matrix.yml @@ -25,7 +25,7 @@ jobs: - name: Generate build matrix id: set-matrix run: | - nix run nixpkgs#nushell -- -c 'let versions = (open ansible/vars.yml | get postgres_major) + nix run --inputs-from . nixpkgs#nushell -- -c 'let versions = (open ansible/vars.yml | get postgres_major) let base_matrix = ($versions | each { |ver| let version = ($ver | str trim) let dockerfile = $"Dockerfile-($version)" @@ -80,7 +80,7 @@ jobs: - id: args run: | - nix run nixpkgs#nushell -- -c ' + nix run --inputs-from . nixpkgs#nushell -- -c ' open ansible/vars.yml | items { |key value| {name: $key, item: $value} } | where { |it| ($it.item | describe) == "string" } @@ -112,7 +112,7 @@ jobs: id: image run: | if [[ "${{ matrix.arch }}" == "arm64" ]]; then - pg_version=$(nix run nixpkgs#nushell -- -c ' + pg_version=$(nix run --inputs-from . nixpkgs#nushell -- -c ' let version = "${{ matrix.postgres.version }}" let is_multigres = ($version | str starts-with "multigres-") let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version } @@ -126,7 +126,7 @@ jobs: ') echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT else - pg_version=$(nix run nixpkgs#nushell -- -c ' + pg_version=$(nix run --inputs-from . nixpkgs#nushell -- -c ' let version = "${{ matrix.postgres.version }}" let is_multigres = ($version | str starts-with "multigres-") let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version } @@ -170,7 +170,7 @@ jobs: - name: Get image tag id: get_version run: | - nix run nixpkgs#nushell -- -c ' + nix run --inputs-from . nixpkgs#nushell -- -c ' let version = "${{ matrix.version }}" let is_multigres = ($version | str starts-with "multigres-") let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version } @@ -217,7 +217,7 @@ jobs: - name: Get Versions from Matrix Config id: get_versions run: | - nix run nixpkgs#nushell -- -c ' + nix run --inputs-from . nixpkgs#nushell -- -c ' # Parse the matrix configuration directly let matrix_config = (${{ toJson(needs.prepare.outputs.matrix_config) }} | from json) @@ -237,7 +237,7 @@ jobs: - name: Combine Results id: combine run: | - nix run nixpkgs#nushell -- -c ' + nix run --inputs-from . nixpkgs#nushell -- -c ' # Get all results files and process them in one go let files = (ls **/results.txt | get name) echo $"Found files: ($files)" diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml index d63b468359..ea50a13768 100644 --- a/.github/workflows/manual-docker-release.yml +++ b/.github/workflows/manual-docker-release.yml @@ -23,7 +23,7 @@ jobs: - name: Generate build matrix id: set-matrix run: | - nix run nixpkgs#nushell -- -c 'let versions = (open ansible/vars.yml | get postgres_major) + nix run --inputs-from . nixpkgs#nushell -- -c 'let versions = (open ansible/vars.yml | get postgres_major) let base_matrix = ($versions | each { |ver| let version = ($ver | str trim) let dockerfile = $"Dockerfile-($version)" @@ -78,7 +78,7 @@ jobs: - id: args run: | - nix run nixpkgs#nushell -- -c ' + nix run --inputs-from . nixpkgs#nushell -- -c ' open ansible/vars.yml | items { |key value| {name: $key, item: $value} } | where { |it| ($it.item | describe) == "string" } @@ -110,7 +110,7 @@ jobs: id: image run: | if [[ "${{ matrix.arch }}" == "arm64" ]]; then - pg_version=$(nix run nixpkgs#nushell -- -c ' + pg_version=$(nix run --inputs-from . nixpkgs#nushell -- -c ' let version = "${{ matrix.postgres.version }}" let is_multigres = ($version | str starts-with "multigres-") let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version } @@ -129,7 +129,7 @@ jobs: ') echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT else - pg_version=$(nix run nixpkgs#nushell -- -c ' + pg_version=$(nix run --inputs-from . nixpkgs#nushell -- -c ' let version = "${{ matrix.postgres.version }}" let is_multigres = ($version | str starts-with "multigres-") let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version } @@ -178,7 +178,7 @@ jobs: - name: Get image tag id: get_version run: | - nix run nixpkgs#nushell -- -c ' + nix run --inputs-from . nixpkgs#nushell -- -c ' let version = "${{ matrix.version }}" let is_multigres = ($version | str starts-with "multigres-") let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version } @@ -225,7 +225,7 @@ jobs: - name: Get Versions from Matrix Config id: get_versions run: | - nix run nixpkgs#nushell -- -c ' + nix run --inputs-from . nixpkgs#nushell -- -c ' # Parse the matrix configuration directly let matrix_config = (${{ toJson(needs.prepare.outputs.matrix_config) }} | from json) @@ -245,7 +245,7 @@ jobs: - name: Combine Results id: combine run: | - nix run nixpkgs#nushell -- -c ' + nix run --inputs-from . nixpkgs#nushell -- -c ' # Get all results files and process them in one go let files = (ls **/results.txt | get name) echo $"Found files: ($files)" diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml index cf84c561a3..25b774105f 100644 --- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml +++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml @@ -34,7 +34,7 @@ jobs: echo "Error: git revision '$rev' not found" exit 1 fi - VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major') + VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run --inputs-from . nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major') echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT publish-staging: @@ -70,7 +70,7 @@ jobs: file=ansible/vars.yml fi - VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}') + VERSION=$(git show "$rev:$file" | nix run --inputs-from . nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}') echo "version=$VERSION" >> "$GITHUB_OUTPUT" echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT" @@ -146,7 +146,7 @@ jobs: file=ansible/vars.yml fi - VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}') + VERSION=$(git show "$rev:$file" | nix run --inputs-from . nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}') echo "version=$VERSION" >> "$GITHUB_OUTPUT" echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml index dbe6f81298..2a95fe09d5 100644 --- a/.github/workflows/publish-nix-pgupgrade-scripts.yml +++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml @@ -41,7 +41,7 @@ jobs: echo "Error: git revision '$rev' not found" exit 1 fi - VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major') + VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run --inputs-from . nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major') echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT publish-staging: @@ -77,7 +77,7 @@ jobs: file=ansible/vars.yml fi - VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}') + VERSION=$(git show "$rev:$file" | nix run --inputs-from . nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}') echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Create a tarball containing pg_upgrade scripts @@ -149,7 +149,7 @@ jobs: file=ansible/vars.yml fi - VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}') + VERSION=$(git show "$rev:$file" | nix run --inputs-from . nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}') echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Create a tarball containing pg_upgrade scripts diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index ff09afd657..af3e2026f6 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -99,7 +99,7 @@ jobs: - name: Require non-numeric suffix for manual publish if: steps.stamp.outputs.cached != 'true' && inputs.publish && github.event_name == 'workflow_dispatch' && env.TARGET_ARCH == 'arm64' run: | - SUFFIX=$(nix run nixpkgs#yq -- -e ".postgres_release.postgres$POSTGRES_MAJOR_VERSION" ansible/postgres_release.yml | sed -E 's/[0-9\.]+(.*)$/\1/') + SUFFIX=$(nix run --inputs-from . nixpkgs#yq -- -e ".postgres_release.postgres$POSTGRES_MAJOR_VERSION" ansible/postgres_release.yml | sed -E 's/[0-9\.]+(.*)$/\1/') if [[ -z $SUFFIX ]]; then echo "Version must include non-numeric characters if published manually." exit 1 @@ -129,7 +129,7 @@ jobs: - name: Grab release version id: process_release_version run: | - PG_VERSION=$(nix run nixpkgs#yq -- -er ".postgres_release.postgres$POSTGRES_MAJOR_VERSION" ansible/postgres_release.yml) + PG_VERSION=$(nix run --inputs-from . nixpkgs#yq -- -er ".postgres_release.postgres$POSTGRES_MAJOR_VERSION" ansible/postgres_release.yml) if [[ "$TARGET_ARCH" == amd64 ]]; then PG_VERSION="$PG_VERSION-amd64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" fi @@ -161,7 +161,7 @@ jobs: - name: Compress disk image if: steps.stamp.outputs.cached != 'true' && inputs.publish run: | - nix run nixpkgs#zstd -- -T0 -o "$RUNNER_TEMP/packer-cloudimg.zst" packer-work-qemu-*/output-cloudimg/packer-cloudimg + nix run --inputs-from . nixpkgs#zstd -- -T0 -o "$RUNNER_TEMP/packer-cloudimg.zst" packer-work-qemu-*/output-cloudimg/packer-cloudimg - name: Upload disk image if: inputs.publish diff --git a/.github/workflows/qemu-image-release.yml b/.github/workflows/qemu-image-release.yml index f96c44aefc..7bca3becc1 100644 --- a/.github/workflows/qemu-image-release.yml +++ b/.github/workflows/qemu-image-release.yml @@ -58,7 +58,7 @@ jobs: - name: Build image run: | mkdir -p image-context/output-cloudimg - nix run nixpkgs#zstd -- -d -o image-context/output-cloudimg/packer-cloudimg "$RUNNER_TEMP/disk-image/packer-cloudimg.zst" + nix run --inputs-from . nixpkgs#zstd -- -d -o image-context/output-cloudimg/packer-cloudimg "$RUNNER_TEMP/disk-image/packer-cloudimg.zst" docker build --platform "linux/$TARGET_ARCH" -f Dockerfile-kubernetes -t "postgres:$IMAGE_TAG" image-context - name: configure aws credentials - staging diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml index 78b7417ccb..25fb6c6599 100644 --- a/.github/workflows/testinfra-ami-build.yml +++ b/.github/workflows/testinfra-ami-build.yml @@ -56,7 +56,7 @@ jobs: fi # plain assignments so set -e catches a failing substitution; an empty should_run would skip every AMI - versions=$(nix run nixpkgs#yq-go -- '.postgres_major[]' ansible/vars.yml) + versions=$(nix run --inputs-from . nixpkgs#yq-go -- '.postgres_major[]' ansible/vars.yml) include='[]' for version in $versions; do for target in amd64:x86_64-linux:blacksmith-2vcpu-ubuntu-2404 arm64:aarch64-linux:blacksmith-2vcpu-ubuntu-2404-arm; do