From acafd055e623557499cacf1e89572387152a288c Mon Sep 17 00:00:00 2001 From: Everett Hildenbrandt Date: Mon, 27 Jul 2026 16:30:26 +0000 Subject: [PATCH 1/6] .github/workflows/{master,test,test-cachix-pin,update-version}.yml: bump action versions Pure version bumps, no behavioral changes to any job. - actions/checkout v4 (v3 in update-version.yml) -> v7 - cachix/install-nix-action v31.5.1 -> v31.11.0 - cachix/cachix-action v16 -> v17 - dcarbone/install-jq-action v3 -> v4 - workflow/nix-shell-action v3 -> v4.0.0 The checkout bump is the one that matters for the ongoing secretless-CI work. As of v6, persist-credentials writes the token to a separate file under $RUNNER_TEMP and wires it in via git includeIf, rather than dropping it into .git/config inside the workspace where every later step and build script in the job can read it. That directly reduces exposure of JENKINS_GITHUB_PAT in update-version.yml, which is the only place we persist a real PAT and then push with it. v7 rather than v6: v7 refuses fork-PR checkouts by default, but assertSafePrCheckout early-returns unless the event is pull_request_target or workflow_run. Every workflow here triggers on pull_request, push, or workflow_dispatch, so the guard never fires -- including the ui-tests checkout of rust-lang/rust, which is the only place we name a foreign repository. v7.0.1 also hardens the guard's ref trimming to ASCII-only. workflow/nix-shell-action is pinned to the exact tag because that repo publishes no v4 moving tag, unlike the others. dtolnay/rust-toolchain stays on @master: it ships no versioned releases, and the channel is read dynamically from rust-toolchain.toml. Note for deployment: checkout@v7, cachix-action@v17 and nix-shell-action@v4 are all node24, which requires Actions Runner >= v2.327.1. Most jobs here run on self-hosted runners (linux/normal, ARM64, MacM1). Runners auto-update by default, but any registered with --disableupdate will fail with an unhelpful runtime-not-found error. Co-Authored-By: Claude Opus 5 --- .github/workflows/master.yml | 10 +++++----- .github/workflows/test-cachix-pin.yml | 4 ++-- .github/workflows/test.yml | 18 +++++++++--------- .github/workflows/update-version.yml | 6 +++--- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index fe86a894..4d8b7f9e 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -16,7 +16,7 @@ jobs: runs-on: [self-hosted, linux, normal] steps: - name: 'Check out code' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ github.event.push.head.sha }} fetch-depth: 0 @@ -40,13 +40,13 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: 'Check out code' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ github.event.push.head.sha }} fetch-depth: 0 - name: 'Build and cache stable-mir-json' - uses: workflow/nix-shell-action@v3 + uses: workflow/nix-shell-action@v4.0.0 env: GC_DONT_GC: 1 CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_PUBLIC_TOKEN }} @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: 'Check out code' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ github.event.push.head.sha }} fetch-depth: 0 - name: 'Publish stable-mir-json to k-framework-binary cache' - uses: workflow/nix-shell-action@v3 + uses: workflow/nix-shell-action@v4.0.0 env: CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}' GC_DONT_GC: '1' diff --git a/.github/workflows/test-cachix-pin.yml b/.github/workflows/test-cachix-pin.yml index 9ee32cfa..a2af140e 100644 --- a/.github/workflows/test-cachix-pin.yml +++ b/.github/workflows/test-cachix-pin.yml @@ -14,10 +14,10 @@ jobs: runs-on: [self-hosted, linux, normal] steps: - name: 'Check out code' - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: 'Verify cachix publish and pin' - uses: workflow/nix-shell-action@v3 + uses: workflow/nix-shell-action@v4.0.0 env: CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}' GC_DONT_GC: '1' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index cf425808..6e1f1312 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -16,7 +16,7 @@ jobs: runs-on: [self-hosted, linux, normal] steps: - name: 'Check out code' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: # Check out pull request HEAD instead of merge commit. ref: ${{ github.event.pull_request.head.sha }} @@ -56,7 +56,7 @@ jobs: cargo fmt --check - name: 'Install Nix' - uses: cachix/install-nix-action@v31.5.1 + uses: cachix/install-nix-action@v31.11.0 with: install_url: https://releases.nixos.org/nix/nix-2.30.1/install extra_nix_config: | @@ -74,7 +74,7 @@ jobs: runs-on: [self-hosted, linux, normal] steps: - name: 'Check out code' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: # Check out pull request HEAD instead of merge commit. ref: ${{ github.event.pull_request.head.sha }} @@ -104,7 +104,7 @@ jobs: RUSTFLAGS='--deny warnings' cargo build -vv - name: 'Install a good-enough jq version' - uses: dcarbone/install-jq-action@v3 + uses: dcarbone/install-jq-action@v4 with: version: 1.7.1 force: true @@ -121,7 +121,7 @@ jobs: runs-on: [self-hosted, linux, normal] steps: - name: 'Check out code' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: # Check out pull request HEAD instead of merge commit. ref: ${{ github.event.pull_request.head.sha }} @@ -158,7 +158,7 @@ jobs: echo "rustc-commit=$COMMIT" >> "$GITHUB_OUTPUT" - name: 'Check out Rust repo' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: rust-lang/rust ref: ${{ steps.rustc-meta.outputs.rustc-commit }} @@ -184,7 +184,7 @@ jobs: timeout-minutes: 20 steps: - name: 'Check out code' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: # Check out pull request HEAD instead of merge commit. ref: ${{ github.event.pull_request.head.sha }} @@ -192,7 +192,7 @@ jobs: - name: 'Install Nix' if: ${{ matrix.runner != 'MacM1' }} - uses: cachix/install-nix-action@v31.5.1 + uses: cachix/install-nix-action@v31.11.0 with: install_url: https://releases.nixos.org/nix/nix-2.30.1/install extra_nix_config: | @@ -201,7 +201,7 @@ jobs: - name: 'Install Cachix' if: ${{ matrix.runner != 'MacM1' }} - uses: cachix/cachix-action@v16 + uses: cachix/cachix-action@v17 with: name: k-framework diff --git a/.github/workflows/update-version.yml b/.github/workflows/update-version.yml index 35ffa8a0..4c30124e 100644 --- a/.github/workflows/update-version.yml +++ b/.github/workflows/update-version.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Check out code' - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: submodules: recursive token: ${{ secrets.JENKINS_GITHUB_PAT }} @@ -26,14 +26,14 @@ jobs: git config user.name devops git config user.email devops@runtimeverification.com - name: 'Install Nix' - uses: cachix/install-nix-action@v31.5.1 + uses: cachix/install-nix-action@v31.11.0 with: install_url: https://releases.nixos.org/nix/nix-2.30.1/install extra_nix_config: | substituters = http://cache.nixos.org https://cache.iog.io trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} - - uses: cachix/cachix-action@v16 + - uses: cachix/cachix-action@v17 with: name: k-framework authToken: ${{ secrets.CACHIX_PUBLIC_TOKEN }} From 5416374d75a852cbd306168e780d2b826a36b177 Mon Sep 17 00:00:00 2001 From: Everett Hildenbrandt Date: Mon, 27 Jul 2026 16:35:32 +0000 Subject: [PATCH 2/6] .github/workflows/{test-cachix-pin,update-version}.yml: drop three unneeded secrets Removes every secret that was not actually load-bearing, taking the repo from 6 secret references to 3. All three that remain are now confined to master.yml, on the push-to-master release path; test.yml, test-cachix-pin.yml and update-version.yml no longer reference any secret beyond the automatic GITHUB_TOKEN. - test-cachix-pin.yml: drop CACHIX_AUTH_TOKEN. check-cachix-pin.sh never reads it. The script's only network calls are bare curls to the pin API and to .narinfo, and both serve k-framework-binary without authentication (verified: HTTP 200 unauthenticated on both). The env var was inherited from master.yml, where kup publish shares the step and does need it. - update-version.yml: drop the cachix authToken. The job's only nix work is 'nix flake update', which resolves and locks inputs without building a derivation, so it has nothing to push. The step stays as a read-only substituter, matching the pattern test.yml already uses. - update-version.yml: replace the JENKINS_GITHUB_PAT checkout token with the automatic GITHUB_TOKEN plus 'permissions: contents: write', which is all the 'Push updates' step needs. The repo has no .gitmodules, so the 'submodules: recursive' input is a no-op and raises no auth concern. Caveat on the last one: pushes authenticated with GITHUB_TOKEN do not create new workflow runs. That is what we want for the self-loop, since this workflow both triggers on and pushes to _update-deps/runtimeverification/rv-nix-tools. But if that branch has an open PR, the Test workflow will no longer re-run on it after the flake update lands. Nothing in this repo's history shows such a PR, so this is untested against the real devops flow; revert to a PAT or swap in a GitHub App token if the downstream PR CI turns out to matter. Co-Authored-By: Claude Opus 5 --- .github/workflows/test-cachix-pin.yml | 4 +++- .github/workflows/update-version.yml | 9 +++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test-cachix-pin.yml b/.github/workflows/test-cachix-pin.yml index a2af140e..12eca152 100644 --- a/.github/workflows/test-cachix-pin.yml +++ b/.github/workflows/test-cachix-pin.yml @@ -19,7 +19,9 @@ jobs: - name: 'Verify cachix publish and pin' uses: workflow/nix-shell-action@v4.0.0 env: - CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}' + # No CACHIX_AUTH_TOKEN: check-cachix-pin.sh reads neither it nor any + # other credential. It only curls the pin API and .narinfo, both + # of which serve k-framework-binary unauthenticated. GC_DONT_GC: '1' OWNER_REPO: '${{ github.repository }}' REV: '${{ inputs.ref }}' diff --git a/.github/workflows/update-version.yml b/.github/workflows/update-version.yml index 4c30124e..2d3b218c 100644 --- a/.github/workflows/update-version.yml +++ b/.github/workflows/update-version.yml @@ -10,6 +10,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# Grant the automatic GITHUB_TOKEN write access so the 'Push updates' step can +# push without a PAT. This is the only permission the job needs. +permissions: + contents: write + jobs: update-versions: name: 'Update Dependency Versions' @@ -19,7 +24,6 @@ jobs: uses: actions/checkout@v7 with: submodules: recursive - token: ${{ secrets.JENKINS_GITHUB_PAT }} fetch-depth: 0 - name: 'Configure GitHub user' run: | @@ -33,10 +37,11 @@ jobs: substituters = http://cache.nixos.org https://cache.iog.io trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} + # Read-only: this job runs 'nix flake update', which resolves and locks + # inputs without building any derivation, so it never pushes to the cache. - uses: cachix/cachix-action@v17 with: name: k-framework - authToken: ${{ secrets.CACHIX_PUBLIC_TOKEN }} - name: 'Update Nix flake inputs' run: | RV_NIX_TOOLS_VERSION=$(cat deps/rv-nix-tools) From 357908b240618a4489436c6167ff326e80734a44 Mon Sep 17 00:00:00 2001 From: Everett Hildenbrandt Date: Mon, 27 Jul 2026 17:56:45 +0000 Subject: [PATCH 3/6] .github/workflows/{master,test-cachix-pin,update-version}.yml, .github/scripts/check-cachix-pin.sh: drop deployment CI Deployment is out of scope for this version and will be restored separately. Removes every workflow that publishes, notifies, or pushes, leaving test.yml as the sole workflow. The repo now references no stored secret at all. - master.yml: all three jobs were deployment. update-deps dispatched runtimeverification/devops, nix-cache pushed to the k-framework cache, and nix-binary-cache ran kup publish against k-framework-binary. This file held all three remaining stored secrets. - test-cachix-pin.yml: workflow_dispatch-only verification that a release was published and pinned to cachix. Meaningless without the publish it verifies. - check-cachix-pin.sh: orphaned by the two removals above; nothing else referenced it. - update-version.yml: bumped the rv-nix-tools flake input and pushed. Not deployment as such, but not CI testing either, and it is driven by the same RV devops automation as master.yml's dispatch, so it belongs with that batch when it returns. Removing it also retires the untested GITHUB_TOKEN-push path noted in the previous commit rather than shipping it. install-yq.sh is kept; test.yml calls it in all three of its rustc jobs. deps/rv-nix-tools is kept: nothing in-tree reads it now, but it is the write target of the external devops automation and update-version.yml will need it again when restored. No effect on the nix build: nix/stable-mir-json-source/default.nix already filters .github/ out of the source. Co-Authored-By: Claude Opus 5 --- .github/scripts/check-cachix-pin.sh | 86 --------------------------- .github/workflows/master.yml | 84 -------------------------- .github/workflows/test-cachix-pin.yml | 30 ---------- .github/workflows/update-version.yml | 52 ---------------- 4 files changed, 252 deletions(-) delete mode 100755 .github/scripts/check-cachix-pin.sh delete mode 100644 .github/workflows/master.yml delete mode 100644 .github/workflows/test-cachix-pin.yml delete mode 100644 .github/workflows/update-version.yml diff --git a/.github/scripts/check-cachix-pin.sh b/.github/scripts/check-cachix-pin.sh deleted file mode 100755 index 528d11c0..00000000 --- a/.github/scripts/check-cachix-pin.sh +++ /dev/null @@ -1,86 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -# Kup relies on cachix registry k-framework-binary. -CACHE="k-framework-binary" -OWNER_REPO="${OWNER_REPO:-$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')}" -REV="${REV:-${GITHUB_SHA:-$(git rev-parse HEAD)}}" -UNAME_S="$(uname -s)" -UNAME_M="$(uname -m)" -case "${UNAME_S}-${UNAME_M}" in - Linux-x86_64) SYSTEM="x86_64-linux" ;; - Linux-aarch64 | Linux-arm64) SYSTEM="aarch64-linux" ;; - Darwin-x86_64) SYSTEM="x86_64-darwin" ;; - Darwin-arm64) SYSTEM="aarch64-darwin" ;; - *) - echo "Unsupported platform: ${UNAME_S}-${UNAME_M}" >&2 - exit 1 - ;; -esac -PIN_API_URL="https://app.cachix.org/api/v1/cache/${CACHE}/pin" -CHECK_PACKAGES=(stable-mir-json) - -SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/stdout}" - -{ - echo "## Cachix Publish Summary" - echo "CACHE: $CACHE" - echo "OWNER_REPO: $OWNER_REPO" - echo "REV: $REV" - echo "SYSTEM: $SYSTEM" - echo "PACKAGES: ${CHECK_PACKAGES[*]}" -} >> "$SUMMARY" - -# Verify push + pin together for each package. Both can become visible with delay. -PIN_VISIBILITY_TIMEOUT_SECONDS=120 # 2 minutes -PIN_VISIBILITY_INTERVAL_SECONDS=5 # 5 seconds -PIN_VISIBILITY_ATTEMPTS=$((PIN_VISIBILITY_TIMEOUT_SECONDS / PIN_VISIBILITY_INTERVAL_SECONDS)) -for i in $(seq 1 "$PIN_VISIBILITY_ATTEMPTS"); do - PIN_JSON="$(curl -fsSL "${PIN_API_URL}?q=${REV}")" - ALL_OK=1 - - for PKG in "${CHECK_PACKAGES[@]}"; do - KEY="github:${OWNER_REPO}/${REV}#packages.${SYSTEM}.${PKG}" - STORE_PATH="$( - echo "$PIN_JSON" \ - | jq -r --arg k "$KEY" 'map(select(.name == $k)) | first | (.lastRevision.storePath // .storePath // .store_path // .path // "")' - )" - if [ -z "$STORE_PATH" ]; then - PIN_STATUS="pin-missing" - PUSH_STATUS="000" - ALL_OK=0 - { - echo "key-${PKG}: ${KEY}" - echo "pin-status-${PKG}: ${PIN_STATUS}" - echo "push-http-${PKG}: ${PUSH_STATUS}" - } - continue - fi - - PIN_STATUS="pin-ok" - HASH="$(basename "$STORE_PATH" | cut -d- -f1)" - PUSH_NARINFO_URL="https://${CACHE}.cachix.org/${HASH}.narinfo" - PUSH_STATUS="$(curl -sS -o /dev/null -w '%{http_code}' "$PUSH_NARINFO_URL")" || PUSH_STATUS="000" - if [ "$PUSH_STATUS" != "200" ]; then - ALL_OK=0 - fi - - { - echo "key-${PKG}: ${KEY}" - echo "store-path-${PKG}: ${STORE_PATH}" - echo "pin-status-${PKG}: ${PIN_STATUS}" - echo "push-http-${PKG}: ${PUSH_STATUS}" - } - done - - if [ "$ALL_OK" = "1" ]; then - echo "cachix-status: push-and-pin-ok-for-all-packages" >> "$SUMMARY" - exit 0 - fi - - echo "cachix-check-attempt-${i}: not-ready, retrying in ${PIN_VISIBILITY_INTERVAL_SECONDS}s" - sleep "$PIN_VISIBILITY_INTERVAL_SECONDS" -done - -echo "cachix-status: push-or-pin-missing-after-${PIN_VISIBILITY_TIMEOUT_SECONDS}s-for-at-least-one-package" >> "$SUMMARY" -exit 1 diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml deleted file mode 100644 index 4d8b7f9e..00000000 --- a/.github/workflows/master.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: 'Master Release' -on: - push: - branches: [ "master" ] - workflow_dispatch: -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -env: - CARGO_TERM_COLOR: always - -jobs: - update-deps: - name: "Update Dependents" - runs-on: [self-hosted, linux, normal] - steps: - - name: 'Check out code' - uses: actions/checkout@v7 - with: - ref: ${{ github.event.push.head.sha }} - fetch-depth: 0 - - name: 'Update dependents' - run: | - set -x - VERSION=$(git rev-parse HEAD) - curl --fail \ - -X POST \ - -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer ${{ secrets.JENKINS_GITHUB_PAT }}" \ - -H "X-GitHub-Api-Version: 2022-11-28" \ - https://api.github.com/repos/runtimeverification/devops/dispatches \ - -d '{"event_type":"on-demand-test","client_payload":{"repo":"runtimeverification/stable-mir-json","version":"'${VERSION}'"}}' - - nix-cache: - name: 'Populate Nix Cache' - strategy: - matrix: - runner: [normal, ARM64] - runs-on: ${{ matrix.runner }} - steps: - - name: 'Check out code' - uses: actions/checkout@v7 - with: - ref: ${{ github.event.push.head.sha }} - fetch-depth: 0 - - - name: 'Build and cache stable-mir-json' - uses: workflow/nix-shell-action@v4.0.0 - env: - GC_DONT_GC: 1 - CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_PUBLIC_TOKEN }} - with: - packages: jq - script: | - STABLE_MIR_JSON=$(nix build --extra-experimental-features 'nix-command flakes' .#stable-mir-json --json | jq -r '.[].outputs | to_entries[].value') - DRV=$(nix-store --query --deriver ${STABLE_MIR_JSON}) - nix-store --query --requisites --include-outputs ${DRV} | cachix push k-framework - - nix-binary-cache: - name: 'Populate Nix Binary Cache' - strategy: - matrix: - runner: [normal, ARM64] - runs-on: ${{ matrix.runner }} - steps: - - name: 'Check out code' - uses: actions/checkout@v7 - with: - ref: ${{ github.event.push.head.sha }} - fetch-depth: 0 - - - name: 'Publish stable-mir-json to k-framework-binary cache' - uses: workflow/nix-shell-action@v4.0.0 - env: - CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}' - GC_DONT_GC: '1' - with: - packages: jq - script: | - export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH" - kup publish k-framework-binary .#stable-mir-json --keep-days 180 || true - - bash .github/scripts/check-cachix-pin.sh diff --git a/.github/workflows/test-cachix-pin.yml b/.github/workflows/test-cachix-pin.yml deleted file mode 100644 index 12eca152..00000000 --- a/.github/workflows/test-cachix-pin.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: 'Test Cachix Pin' - -on: - workflow_dispatch: - inputs: - ref: - description: 'Git ref (tag or SHA) of an existing release to verify' - required: true - type: string - -jobs: - verify-cachix-pin: - name: 'Verify Cachix Pin' - runs-on: [self-hosted, linux, normal] - steps: - - name: 'Check out code' - uses: actions/checkout@v7 - - - name: 'Verify cachix publish and pin' - uses: workflow/nix-shell-action@v4.0.0 - env: - # No CACHIX_AUTH_TOKEN: check-cachix-pin.sh reads neither it nor any - # other credential. It only curls the pin API and .narinfo, both - # of which serve k-framework-binary unauthenticated. - GC_DONT_GC: '1' - OWNER_REPO: '${{ github.repository }}' - REV: '${{ inputs.ref }}' - with: - packages: jq - script: bash .github/scripts/check-cachix-pin.sh diff --git a/.github/workflows/update-version.yml b/.github/workflows/update-version.yml deleted file mode 100644 index 2d3b218c..00000000 --- a/.github/workflows/update-version.yml +++ /dev/null @@ -1,52 +0,0 @@ ---- -name: 'Update Version' -on: - push: - branches: - - '_update-deps/runtimeverification/rv-nix-tools' - workflow_dispatch: -# Stop in progress workflows on the same branch and same workflow to use latest committed code -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -# Grant the automatic GITHUB_TOKEN write access so the 'Push updates' step can -# push without a PAT. This is the only permission the job needs. -permissions: - contents: write - -jobs: - update-versions: - name: 'Update Dependency Versions' - runs-on: ubuntu-latest - steps: - - name: 'Check out code' - uses: actions/checkout@v7 - with: - submodules: recursive - fetch-depth: 0 - - name: 'Configure GitHub user' - run: | - git config user.name devops - git config user.email devops@runtimeverification.com - - name: 'Install Nix' - uses: cachix/install-nix-action@v31.11.0 - with: - install_url: https://releases.nixos.org/nix/nix-2.30.1/install - extra_nix_config: | - substituters = http://cache.nixos.org https://cache.iog.io - trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= - access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} - # Read-only: this job runs 'nix flake update', which resolves and locks - # inputs without building any derivation, so it never pushes to the cache. - - uses: cachix/cachix-action@v17 - with: - name: k-framework - - name: 'Update Nix flake inputs' - run: | - RV_NIX_TOOLS_VERSION=$(cat deps/rv-nix-tools) - sed -i 's! rv-nix-tools.url = "github:runtimeverification/rv-nix-tools/[a-z0-9\.]*"! rv-nix-tools.url = "github:runtimeverification/rv-nix-tools/'"${RV_NIX_TOOLS_VERSION}"'"!' flake.nix - nix flake update - git add flake.nix flake.lock && git commit -m 'flake.{nix,lock}: update Nix derivations' || true - - name: 'Push updates' - run: git push From 4b79a0640682f47e2dac6b9f69d9e85af5028e1b Mon Sep 17 00:00:00 2001 From: Everett Hildenbrandt Date: Mon, 27 Jul 2026 18:12:41 +0000 Subject: [PATCH 4/6] .github/workflows/test.yml: rename ui-tests job to "UI Tests" Display name only; the job id stays ui-tests to match the lowercase-kebab convention of the other three. Also fixes the last step of that job, which was named 'Run smir integration tests' but runs 'make test-ui'. It was copy-pasted from the integration-tests job and made the log read as though the wrong suite was running. Co-Authored-By: Claude Opus 5 --- .github/workflows/test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 6e1f1312..4d6fe4f1 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -117,7 +117,7 @@ jobs: ui-tests: needs: code-quality - name: "ui-tests" + name: "UI Tests" runs-on: [self-hosted, linux, normal] steps: - name: 'Check out code' @@ -169,7 +169,7 @@ jobs: run: | # Warning check should be redundant since code-quality runs first RUSTFLAGS='--deny warnings' cargo build -vv - - name: 'Run smir integration tests' + - name: 'Run smir UI tests' run: | RUST_DIR_ROOT='rust' VERBOSE=1 make test-ui From 035cc59342cebebffe9c625d89c772e536f2b8b0 Mon Sep 17 00:00:00 2001 From: Everett Hildenbrandt Date: Mon, 27 Jul 2026 18:18:17 +0000 Subject: [PATCH 5/6] .github/workflows/test.yml: rename integration-tests job to "Integration Tests" Display name only. Completes the title-case pass over the four job names: Code Quality, Integration Tests, UI Tests, Nix Tests. Co-Authored-By: Claude Opus 5 --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 4d6fe4f1..fc9050db 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -70,7 +70,7 @@ jobs: integration-tests: needs: code-quality - name: "Integration tests" + name: "Integration Tests" runs-on: [self-hosted, linux, normal] steps: - name: 'Check out code' From 11c6cfb54886d7533e4b00b6d31f4091b67d0fea Mon Sep 17 00:00:00 2001 From: Everett Hildenbrandt Date: Mon, 27 Jul 2026 18:27:09 +0000 Subject: [PATCH 6/6] .github/workflows/test.yml: move rustc jobs to GitHub-hosted runners Code Quality, Integration Tests and UI Tests move from [self-hosted, linux, normal] to ubuntu-latest. Nix Tests stays self-hosted (see below). None of the three needs a big machine. run_ui_tests.sh is a serial loop over 2888 files, one stable_mir_json invocation at a time, so the self-hosted box's extra cores contribute nothing to the dominant phase; wall time is per-core-speed bound either way. Integration Tests is 29 programs. Code Quality is a build plus clippy, fmt and nixfmt, and it already installs its own Nix via install-nix-action, which is the standard GitHub-hosted path. Nothing in these jobs assumed a self-hosted host: every tool is installed in-job (yq via .github/scripts/install-yq.sh, the nightly via dtolnay/rust-toolchain, jq via install-jq-action), and ensure_rustc_commit.sh takes its regular-clone branch and finds the checkout already at the expected commit, so it never needs the fetch that fetch-depth: 1 would frustrate. Nix Tests is left alone deliberately. Its matrix includes the MacM1 self-hosted host, and it skips the Nix and Cachix install steps there because that host has Nix preinstalled; retargeting it means dropping those guards and installing Nix on a GitHub-hosted macOS runner. More importantly, dropping deployment CI removed the job that populated the k-framework cache with this repo's builds, so 'nix flake check' now rebuilds cold. The self-hosted runners still have a persistent /nix/store to absorb that; a GitHub-hosted runner would not, and the job's timeout-minutes: 20 would very likely be exceeded. Expected cost of the move: each of the three jobs now downloads the nightly toolchain (rust-toolchain.toml asks for llvm-tools, rustc-dev, rust-src and rust-analyzer) and builds from a cold cargo cache. Adding Swatinem/rust-cache would claw most of that back if the added minutes turn out to matter. Co-Authored-By: Claude Opus 5 --- .github/workflows/test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index fc9050db..0fceb1f2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -13,7 +13,7 @@ env: jobs: code-quality: name: "Code Quality" - runs-on: [self-hosted, linux, normal] + runs-on: ubuntu-latest steps: - name: 'Check out code' uses: actions/checkout@v7 @@ -71,7 +71,7 @@ jobs: integration-tests: needs: code-quality name: "Integration Tests" - runs-on: [self-hosted, linux, normal] + runs-on: ubuntu-latest steps: - name: 'Check out code' uses: actions/checkout@v7 @@ -118,7 +118,7 @@ jobs: ui-tests: needs: code-quality name: "UI Tests" - runs-on: [self-hosted, linux, normal] + runs-on: ubuntu-latest steps: - name: 'Check out code' uses: actions/checkout@v7