Refresh the Nix vendorHash for the go-dependencies bump - #701
Merged
Conversation
#697 changed go.sum this morning and the Nix vendorHash in nix/package.nix stayed at the previous value, so `nix build` fails with a hash mismatch. Main's own Test run did not show it: the Nix job only builds when a flake-relevant path changes, and the merge commit that landed on main touched none, so the job reported success with the build skipped. Any branch that touches go.sum, flake.*, nix/ or test.yml now fails on it. The hash is the one CI computed on two independent runs of the build.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
There was a problem hiding this comment.
🟢 Approved
The hash is validly encoded, and the changed path triggers the Nix build verification.
Pull request overview
Refreshes the Nix dependency hash after the Go dependency update.
Changes:
- Updates
vendorHashto the CI-computed SHA-256 value.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
nix/package.nix |
Refreshes the Nix Go dependency hash. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
jeremy
added a commit
that referenced
this pull request
Sep 10, 2026
…endor-hash * origin/main: ci: bump zizmorcore/zizmor-action in the github-actions group (#698) Reference in-repo workflows with GitHub's self-repository syntax (#700) Kill the Codex probe's process group when its deadline expires (#694) Refresh the Nix vendorHash for the go-dependencies bump (#701)
jeremy
added a commit
that referenced
this pull request
Sep 12, 2026
* Refresh the Nix vendorHash on Dependabot Go bumps #697 changed go.sum, nix/package.nix's vendorHash stayed put, and because "Nix flake builds" is not a required check here the PR auto-merged red and main's flake was broken until #701 refreshed the hash by hand. This thin caller runs basecamp/.github's reusable workflow on Dependabot PRs that touch go.mod or go.sum: it builds the flake at the PR's merge commit, takes the corrected hash from Nix's go-modules fixed-output mismatch, and commits exactly that one line back to the PR with a one-hour App token, so the PR's own Nix check verifies it before auto-merge lands it. Pinned to the reusable workflow's branch SHA; re-pin once it merges. * Sequence Dependabot auto-merge after the vendorHash refresh Auto-merge waits for required checks only, and "Nix flake builds" is not one here, so a stand-alone refresh workflow raced the merge: the required checks could finish and land the stale head minutes before the push, which would then reach a closed PR. The refresh now lives in the auto-merge workflow and the auto-merge job `needs:` it, so `gh pr merge --auto` runs only once the hash is current or the push has landed, and not at all when the refresh failed. The reusable workflow decides "Go bump" from the PR's changed files and is a no-op otherwise, so the path filter goes away and an actions bump can never receive the push; re-pinned to the basecamp/.github head that enforces that. * Pin the vendorHash refresh at the revision that makes non-Go bumps a no-op
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#697 changed
go.sumthis morning and the NixvendorHashinnix/package.nixstayed at the previous value, sonix buildnow fails with a hash mismatch. Main's own Test run did not show it: the Nix job builds only when a flake-relevant path changes, and the merge commit that landed on main touched none of them, so the job reported success with the build skipped. Any branch that touchesgo.sum,flake.*,nix/, ortest.ymlfails on it; #700 hit it by editingtest.yml.The new hash is the value CI computed on two independent runs. This PR touches
nix/package.nix, so its own Nix job runs the build and is the verification.Worth noting for the filter: a Dependabot Go bump changes
go.sum, so the bump PR's own run does build the flake, but the stale hash only fails there if that check is required. This one merged with it red or skipped; theNix flake buildscheck may be worth marking required so the next one cannot.Summary by cubic
Refreshes the Nix
vendorHashinnix/package.nixto match the recentgo.sumupdate, fixingnix buildhash mismatches on branches that touchgo.sum,flake.*,nix/, ortest.yml. The new hash is from two independent CI runs, and this PR's Nix job verifies the build because it changesnix/package.nix.Written for commit 5a9cfcc. Summary will update on new commits.