From b2c9170bc0f71822fb8c2cadf888e1edd89fa0b4 Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Mon, 24 Aug 2026 17:12:21 -0700 Subject: [PATCH 1/3] Generate the package list from pkgs/ instead of a sed script MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Releases have been landing in pkgs/step-agent/ without a matching attribute in default.nix since June: 0.68.0, 0.69.0 and every 0.69.x prerelease were uninstallable by name, and the bare `step-agent` attribute still pointed at 0.65.0-rc11 behind a repo redirect. addpkg.sh never learned which release triggered it. It registered whichever file sorted highest: ls -1 pkgs/step-agent/step-agent_* | sort -Vr | head -n 1 So once 0.70.0-rc1 existed, every subsequent 0.69.x release found that file already registered and added nothing, leaving `git commit` to fail on a clean tree — four red build runs between 07-27 and 08-01. `sort -V` also ranks 0.68.0-rc1 above 0.68.0, which is why a stable release could be skipped in favour of its own release candidate. Separately, the stable-release check matched `_N_N_N$` against a dotted filename and so could never fire, freezing the default attribute permanently. default.nix now reads pkgs// directly, so the attribute set cannot drift from what goreleaser committed and the 21 orphaned derivations register themselves. The unsuffixed attribute resolves to the highest stable version via builtins.compareVersions. This removes addpkg.sh and the add-pkg job entirely. With the commit-back step gone, the release-check gate that guarded it goes too, so the nix evaluation and build now run on pull requests rather than only on goreleaser release commits. Also drops four derivations for nightly and -dev builds whose GitHub release assets are long deleted; those artifacts belong in nur-dev. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build.yml | 59 ------------- README.md | 18 ++++ addpkg.sh | 58 ------------- default.nix | 82 +++++++++++-------- .../step-agent_0.0.0-nightly.20260327.nix | 62 -------------- .../step-agent_0.0.0-nightly.20260331.nix | 62 -------------- pkgs/step-agent/step-agent_0.64.0-dev70.nix | 62 -------------- pkgs/step-agent/step-agent_0.64.0-dev72.nix | 62 -------------- 8 files changed, 66 insertions(+), 399 deletions(-) delete mode 100755 addpkg.sh delete mode 100644 pkgs/step-agent/step-agent_0.0.0-nightly.20260327.nix delete mode 100644 pkgs/step-agent/step-agent_0.0.0-nightly.20260331.nix delete mode 100644 pkgs/step-agent/step-agent_0.64.0-dev70.nix delete mode 100644 pkgs/step-agent/step-agent_0.64.0-dev72.nix diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7890712..8929092 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,23 +10,8 @@ on: permissions: read-all jobs: - release-check: - permissions: {} - runs-on: ubuntu-latest - outputs: - is-release: ${{ steps.condition-check.outputs.match }} - steps: - - id: condition-check - uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2 - with: - # matches: package_name: vX.Y.Z -> vX.Y.Z where XYZ are digits (including rc, e.g: vX.Y.Z-rcN) - # it detects a commit from goreleaser with a new nix package version. - regex: '\s*[a-zA-Z][\w]+:\s*v\d+\.\d+\.\d+(-rc\d+)?\s*->\s*v\d+\.\d+\.\d+(-rc\d+)?' - text: ${{ github.event.head_commit.message }} - tests: permissions: {} - needs: release-check strategy: matrix: nixPath: @@ -35,7 +20,6 @@ jobs: - nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/heads/nixos-25.11.tar.gz runs-on: ubuntu-latest - if: needs.release-check.outputs.is-release != '' steps: - name: Checkout repository uses: actions/checkout@v6 @@ -59,46 +43,3 @@ jobs: -I $PWD - name: Build nix packages run: nix shell -f '' nix-build-uncached -c nix-build-uncached ci.nix -A cacheOutputs - - add-pkg: - permissions: - contents: write - needs: [release-check, tests] - runs-on: ubuntu-latest - - if: needs.release-check.outputs.is-release != '' - steps: - - name: Configure PAT for git push - run: | - git config --global url.https://${{ secrets.NUR_PAT }}@github.com/.insteadOf https://github.com/ - - - name: Checkout repository - uses: actions/checkout@v6 - with: - token: ${{ secrets.NUR_PAT }} - - - name: Make addpkg script executable - run: chmod +x ./addpkg.sh - - name: Execute addpkg.sh to update nix package's catalog - run: ./addpkg.sh step-agent - - name: Setup bot SSH signing key - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - env: - HAS_SSH_PRIVATE_KEY: ${{ secrets.STEP_TRAVIS_CI_GH_PRIVATE_SIGNING_KEY != '' }} - if: ${{ env.HAS_SSH_PRIVATE_KEY == 'true' }} - with: - ssh-private-key: | - ${{ secrets.STEP_TRAVIS_CI_GH_PRIVATE_SIGNING_KEY }} - - name: Add and Commit default.nix - run: | - git config user.email "eng+ci@smallstep.com" - git config user.name "step-ci" - - # Configure GH commit signing key. - git config --global commit.gpgsign true - git config --global gpg.format ssh - git config --global user.signingkey "${{ secrets.STEP_TRAVIS_CI_GH_PUBLIC_SIGNING_KEY }}" - - git add default.nix && git commit -m "Add new package to default.nix" - - name: Push changes - run: git push diff --git a/README.md b/README.md index 1c7ab33..304342d 100644 --- a/README.md +++ b/README.md @@ -77,5 +77,23 @@ $ step-agent version ``` 8. More information about `step-agent` can be found on the following page: [Step Agent docs](https://smallstep.com/docs/platform/smallstep-app/) + +## Packaging + +Attributes are generated from the contents of `pkgs/`. Every +`pkgs//_.nix` is registered automatically as +`_`, with `.` replaced by `_`: + +| File | Attribute | +|------|-----------| +| `pkgs/step-agent/step-agent_0.69.0.nix` | `step-agent_0_69_0` | +| `pkgs/step-agent/step-agent_0.69.1-rc1.nix` | `step-agent_0_69_1-rc1` | + +The unsuffixed `step-agent` attribute is the highest **stable** version present +— prereleases are only reachable by their explicit attribute. + +Releasing is therefore just committing the derivation: goreleaser writes the +file from `smallstep/agent` and there is no package list to keep in sync. + ![Build and populate cache](https://github.com/smallstep/nur/workflows/Build%20and%20populate%20cache/badge.svg) diff --git a/addpkg.sh b/addpkg.sh deleted file mode 100755 index 3d52b04..0000000 --- a/addpkg.sh +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/bash - -[ $# -lt 1 ] && { - echo "usage: $0 " - exit 1 -} - -pkg="$1" -pkg_with_version=$(basename $(ls -1 pkgs/${pkg}/${pkg}_* | sort -Vr | head -n 1) .nix) -pkg_name="$(echo ${pkg_with_version} | tr '.' '_')" -nix_entry="pkgs.callPackage ./pkgs/${pkg}/${pkg_with_version}.nix { };" - -unameOut="$(uname -s)" -OS=Linux - -case "${unameOut}" in -Darwin*) OS=Mac ;; -esac - -# Handle differences between MacOS and Linux sed implementation. -if [ "$OS" = "Mac" ]; then - xsed() { - sed -i "" "$@" - } -else - xsed() { - sed -i "$@" - } -fi - -# Add a new entry for the package version to default.nix, including rc and dev releases. -# Example, for a ${pkg_with_version} = "step-agent_0_65_0-rc11", the entry below would be added: -# step-agent_0_65_0-rc11 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc11.nix { }; -if ! grep -Eqs "${pkg_with_version}[[:blank:]]*=" default.nix; then - echo "Adding new package entry to default.nix: pkg=$pkg version=$version" - - xsed "//a\\ - ${pkg_name} = ${nix_entry}" default.nix -fi - -# Check if package is a stable release, if so we update the default step-agent package entry to point to it. -# Otherwise quit. -if [[ ! "$pkg_with_version" =~ _[0-9]+_[0-9]+_[0-9]+$ ]]; then - echo "Non stable release $pkg_with_version, skipping default package update." - exit 0 -fi - -# patch default package name to point to the latest version -if ! grep -Eqs "${pkg}[[:blank:]]*=" default.nix; then - echo "Adding default $pkg package entry..." - - xsed "//a\\ - ${pkg} = ${nix_entry}" default.nix -else - echo "Updating $pkg to point to new version $version" - - xsed "s#^.*${pkg} *=.*\$# ${pkg} = ${nix_entry}#" default.nix -fi diff --git a/default.nix b/default.nix index 35335c9..7e17286 100644 --- a/default.nix +++ b/default.nix @@ -8,43 +8,57 @@ { pkgs ? import { } }: +let + inherit (pkgs) lib; + + # Every derivation under pkgs// is registered automatically, so this + # attribute set can never drift from what goreleaser has committed. Releases + # add a file and nothing else: there is no package list to keep in sync. + # + # pkgs/step-agent/step-agent_0.69.0.nix -> step-agent_0_69_0 + # pkgs/step-agent/step-agent_0.69.0-rc1.nix -> step-agent_0_69_0-rc1 + # + # Version and attribute name differ only in the separator, so we keep both. + releasesOf = name: + let + dir = ./pkgs + "/${name}"; + isRelease = file: type: type == "regular" && lib.hasSuffix ".nix" file; + versionOf = file: lib.removePrefix "${name}_" (lib.removeSuffix ".nix" file); + in + lib.mapAttrsToList + (file: _: rec { + version = versionOf file; + attr = "${name}_${builtins.replaceStrings [ "." ] [ "_" ] version}"; + package = pkgs.callPackage (dir + "/${file}") { }; + }) + (lib.filterAttrs isRelease (builtins.readDir dir)); + + # A release is stable when its version carries no -rc/-dev/nightly suffix. + isStable = release: builtins.match "[0-9]+\\.[0-9]+\\.[0-9]+" release.version != null; + + newest = releases: + lib.head (lib.sort (a: b: builtins.compareVersions a.version b.version > 0) releases); + + # `nur.repos.smallstep.step-agent` is the obvious thing to type, so it has to + # mean the current stable release rather than whichever file happens to sort + # last -- `sort -V` ranks 0.68.0-rc1 above 0.68.0, and prerelease lines run + # ahead of stable ones. + packageSet = name: + let + releases = releasesOf name; + byAttr = lib.listToAttrs + (map (r: lib.nameValuePair r.attr r.package) releases); + stable = lib.filter isStable releases; + in + byAttr // lib.optionalAttrs (stable != [ ]) { + ${name} = (newest stable).package; + }; + +in { # The `lib`, `modules`, and `overlays` names are special lib = import ./lib { inherit pkgs; }; # functions modules = import ./modules; # NixOS modules overlays = import ./overlays; # nixpkgs overlays - - # : DO NOT REMOVE THIS LINE - step-agent_0_70_0-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.70.0-rc2.nix { }; - step-agent_0_70_0-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.70.0-rc1.nix { }; - step-agent_0_68_0-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.68.0-rc1.nix { }; - step-agent_0_67_4-rc12 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc12.nix { }; - step-agent_0_67_4-rc11 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc11.nix { }; - step-agent_0_67_4-rc10 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc10.nix { }; - step-agent_0_67_4-rc9 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc9.nix { }; - step-agent_0_67_4-rc8 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc8.nix { }; - step-agent_0_67_4-rc7 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc7.nix { }; - step-agent_0_67_4-rc6 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc6.nix { }; - step-agent_0_67_4-rc4 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc4.nix { }; - step-agent_0_67_4-rc3 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc3.nix { }; - step-agent_0_67_4-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc2.nix { }; - step-agent_0_67_4-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc1.nix { }; - step-agent_0_67_3-rc3 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc3.nix { }; - step-agent_0_67_3-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc2.nix { }; - step-agent_0_67_3-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc1.nix { }; - step-agent_0_67_2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.2.nix { }; - step-agent_0_67_1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.1.nix { }; - step-agent_0_67_0 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.0.nix { }; - step-agent_0_66_0 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.66.0.nix { }; - step-agent_0_65_6 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.6.nix { }; - step-agent_0_65_5-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.5-rc2.nix { }; - step-agent_0_65_5-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.5-rc1.nix { }; - step-agent_0_65_4 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.4.nix { }; - step-agent_0_65_2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.2.nix { }; - step-agent_0_65_1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.1.nix { }; - step-agent_0_65_0-rc21 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc21.nix { }; - step-agent_0_65_0-rc20 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc20.nix { }; - step-agent_0_65_0-rc19 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc19.nix { }; - step-agent = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc11.nix { }; - step-agent_0_65_0-rc11 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc11.nix { }; } +// packageSet "step-agent" diff --git a/pkgs/step-agent/step-agent_0.0.0-nightly.20260327.nix b/pkgs/step-agent/step-agent_0.0.0-nightly.20260327.nix deleted file mode 100644 index fc6ff2e..0000000 --- a/pkgs/step-agent/step-agent_0.0.0-nightly.20260327.nix +++ /dev/null @@ -1,62 +0,0 @@ -# This file was generated by GoReleaser. DO NOT EDIT. -# vim: set ft=nix ts=2 sw=2 sts=2 et sta -{ - lib, - fetchurl, - installShellFiles, - stdenvNoCC, - stdenv, - autoPatchelfHook, - desktop-file-utils, - makeWrapper, - p11-kit, - polkit, - tpm2-openssl, - tpm2-tss, -}: -let - inherit (stdenvNoCC.hostPlatform) system; - shaMap = { - x86_64-linux = "0a2hvvnp3zvn6d9z4jn9r0il5cswq9g9qi3p298xld6880lb0jgz"; - aarch64-linux = "1si1nsd2g34ml6c71zlj9hk0q2sypmsk4f9xf118p4hq8gcz423j"; - }; - - urlMap = { - x86_64-linux = "https://github.com/smallstep/agent/releases/download/v0.0.0-nightly.20260327/step-agent_0.0.0-nightly.20260327_linux_amd64.tar.gz"; - aarch64-linux = "https://github.com/smallstep/agent/releases/download/v0.0.0-nightly.20260327/step-agent_0.0.0-nightly.20260327_linux_arm64.tar.gz"; - }; -in -stdenvNoCC.mkDerivation { - pname = "step-agent-plugin"; - version = "0.0.0-nightly.20260327"; - src = fetchurl { - url = urlMap.${system}; - sha256 = shaMap.${system}; - }; - - sourceRoot = "."; - - nativeBuildInputs = [ installShellFiles makeWrapper ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ]; - - buildInputs = lib.optionals stdenvNoCC.isLinux [ - stdenv.cc.cc.lib - ]; - - installPhase = '' - mkdir -p $out/bin - cp -vr ./step-agent $out/bin/step-agent - wrapProgram $out/bin/step-agent --prefix PATH : ${lib.makeBinPath (lib.optionals stdenvNoCC.isLinux [ tpm2-tss tpm2-openssl desktop-file-utils polkit p11-kit ])} - ''; - - meta = { - description = "step-agent-plugin is an automated certificate management agent plugin for step-cli."; - homepage = "https://github.com/smallstep/step-agent-plugin/"; - - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - - platforms = [ - "aarch64-linux" - "x86_64-linux" - ]; - }; -} diff --git a/pkgs/step-agent/step-agent_0.0.0-nightly.20260331.nix b/pkgs/step-agent/step-agent_0.0.0-nightly.20260331.nix deleted file mode 100644 index 4753b59..0000000 --- a/pkgs/step-agent/step-agent_0.0.0-nightly.20260331.nix +++ /dev/null @@ -1,62 +0,0 @@ -# This file was generated by GoReleaser. DO NOT EDIT. -# vim: set ft=nix ts=2 sw=2 sts=2 et sta -{ - lib, - fetchurl, - installShellFiles, - stdenvNoCC, - stdenv, - autoPatchelfHook, - desktop-file-utils, - makeWrapper, - p11-kit, - polkit, - tpm2-openssl, - tpm2-tss, -}: -let - inherit (stdenvNoCC.hostPlatform) system; - shaMap = { - x86_64-linux = "0cfm02v7yp4dv6dr3axpj5pysr5a57afc0wj0r1rbzf5mn0avsc9"; - aarch64-linux = "1xivymjana1fk333vnw8rkig6skh8mgg793fz4x6y0qd5ayid6i1"; - }; - - urlMap = { - x86_64-linux = "https://github.com/smallstep/agent/releases/download/v0.0.0-nightly.20260331/step-agent_0.0.0-nightly.20260331_linux_amd64.tar.gz"; - aarch64-linux = "https://github.com/smallstep/agent/releases/download/v0.0.0-nightly.20260331/step-agent_0.0.0-nightly.20260331_linux_arm64.tar.gz"; - }; -in -stdenvNoCC.mkDerivation { - pname = "step-agent-plugin"; - version = "0.0.0-nightly.20260331"; - src = fetchurl { - url = urlMap.${system}; - sha256 = shaMap.${system}; - }; - - sourceRoot = "."; - - nativeBuildInputs = [ installShellFiles makeWrapper ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ]; - - buildInputs = lib.optionals stdenvNoCC.isLinux [ - stdenv.cc.cc.lib - ]; - - installPhase = '' - mkdir -p $out/bin - cp -vr ./step-agent $out/bin/step-agent - wrapProgram $out/bin/step-agent --prefix PATH : ${lib.makeBinPath (lib.optionals stdenvNoCC.isLinux [ tpm2-tss tpm2-openssl desktop-file-utils polkit p11-kit ])} - ''; - - meta = { - description = "step-agent-plugin is an automated certificate management agent plugin for step-cli."; - homepage = "https://github.com/smallstep/step-agent-plugin/"; - - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - - platforms = [ - "aarch64-linux" - "x86_64-linux" - ]; - }; -} diff --git a/pkgs/step-agent/step-agent_0.64.0-dev70.nix b/pkgs/step-agent/step-agent_0.64.0-dev70.nix deleted file mode 100644 index 5a804f9..0000000 --- a/pkgs/step-agent/step-agent_0.64.0-dev70.nix +++ /dev/null @@ -1,62 +0,0 @@ -# This file was generated by GoReleaser. DO NOT EDIT. -# vim: set ft=nix ts=2 sw=2 sts=2 et sta -{ - lib, - fetchurl, - installShellFiles, - stdenvNoCC, - stdenv, - autoPatchelfHook, - desktop-file-utils, - makeWrapper, - p11-kit, - polkit, - tpm2-openssl, - tpm2-tss, -}: -let - inherit (stdenvNoCC.hostPlatform) system; - shaMap = { - x86_64-linux = "1y377njw0cnclc7xif77gnqlnyhq5vx4x2aains9lbmsqz6vxs1m"; - aarch64-linux = "1bvi62npvn8hw5n683p8nw8z6zdqzh53zijz6z0cazwfzrnkyfky"; - }; - - urlMap = { - x86_64-linux = "https://github.com/smallstep/agent/releases/download/v0.64.0-dev70/step-agent_0.64.0-dev70_linux_amd64.tar.gz"; - aarch64-linux = "https://github.com/smallstep/agent/releases/download/v0.64.0-dev70/step-agent_0.64.0-dev70_linux_arm64.tar.gz"; - }; -in -stdenvNoCC.mkDerivation { - pname = "step-agent-plugin"; - version = "0.64.0-dev70"; - src = fetchurl { - url = urlMap.${system}; - sha256 = shaMap.${system}; - }; - - sourceRoot = "."; - - nativeBuildInputs = [ installShellFiles makeWrapper ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ]; - - buildInputs = lib.optionals stdenvNoCC.isLinux [ - stdenv.cc.cc.lib - ]; - - installPhase = '' - mkdir -p $out/bin - cp -vr ./step-agent $out/bin/step-agent - wrapProgram $out/bin/step-agent --prefix PATH : ${lib.makeBinPath (lib.optionals stdenvNoCC.isLinux [ tpm2-tss tpm2-openssl desktop-file-utils polkit p11-kit ])} - ''; - - meta = { - description = "step-agent-plugin is an automated certificate management agent plugin for step-cli."; - homepage = "https://github.com/smallstep/step-agent-plugin/"; - - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - - platforms = [ - "aarch64-linux" - "x86_64-linux" - ]; - }; -} diff --git a/pkgs/step-agent/step-agent_0.64.0-dev72.nix b/pkgs/step-agent/step-agent_0.64.0-dev72.nix deleted file mode 100644 index 20bee54..0000000 --- a/pkgs/step-agent/step-agent_0.64.0-dev72.nix +++ /dev/null @@ -1,62 +0,0 @@ -# This file was generated by GoReleaser. DO NOT EDIT. -# vim: set ft=nix ts=2 sw=2 sts=2 et sta -{ - lib, - fetchurl, - installShellFiles, - stdenvNoCC, - stdenv, - autoPatchelfHook, - desktop-file-utils, - makeWrapper, - p11-kit, - polkit, - tpm2-openssl, - tpm2-tss, -}: -let - inherit (stdenvNoCC.hostPlatform) system; - shaMap = { - x86_64-linux = "0zm3r1llnxn60ai913rfbp231z2ha7642628gx02zsy8inmakcca"; - aarch64-linux = "0z4v5d5nrdz85q80ilv1ch34kkpj0c0c49c6giml74y2x8i9fqzb"; - }; - - urlMap = { - x86_64-linux = "https://github.com/smallstep/agent/releases/download/v0.64.0-dev72/step-agent_0.64.0-dev72_linux_amd64.tar.gz"; - aarch64-linux = "https://github.com/smallstep/agent/releases/download/v0.64.0-dev72/step-agent_0.64.0-dev72_linux_arm64.tar.gz"; - }; -in -stdenvNoCC.mkDerivation { - pname = "step-agent-plugin"; - version = "0.64.0-dev72"; - src = fetchurl { - url = urlMap.${system}; - sha256 = shaMap.${system}; - }; - - sourceRoot = "."; - - nativeBuildInputs = [ installShellFiles makeWrapper ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ]; - - buildInputs = lib.optionals stdenvNoCC.isLinux [ - stdenv.cc.cc.lib - ]; - - installPhase = '' - mkdir -p $out/bin - cp -vr ./step-agent $out/bin/step-agent - wrapProgram $out/bin/step-agent --prefix PATH : ${lib.makeBinPath (lib.optionals stdenvNoCC.isLinux [ tpm2-tss tpm2-openssl desktop-file-utils polkit p11-kit ])} - ''; - - meta = { - description = "step-agent-plugin is an automated certificate management agent plugin for step-cli."; - homepage = "https://github.com/smallstep/step-agent-plugin/"; - - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - - platforms = [ - "aarch64-linux" - "x86_64-linux" - ]; - }; -} From dee09bbfcb85372efab28d0ae85ac50df284744a Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Mon, 24 Aug 2026 17:19:59 -0700 Subject: [PATCH 2/3] Grant actions: read so Action CI can start MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Action CI has failed at workflow-creation time on every run since 2026-05-25, so actionlint and zizmor have not actually examined this repo in three months. smallstep/workflows f47abc3 gave the reusable zizmor job the actions: read permission it needs to read workflow run metadata. A reusable workflow cannot be granted more than its caller has, and this caller grants only contents: read and security-events: write, so the run is rejected before any job is created — which is why it reports startup_failure with no jobs and no annotations, and why it never surfaced as a failing check on a pull request. gateway, inventory and agent all grant the full set; nur was missed. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/actionci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/actionci.yml b/.github/workflows/actionci.yml index 9a3f9e2..f8482e6 100644 --- a/.github/workflows/actionci.yml +++ b/.github/workflows/actionci.yml @@ -16,6 +16,7 @@ jobs: actionci: permissions: contents: read + actions: read security-events: write uses: smallstep/workflows/.github/workflows/actionci.yml@main secrets: inherit From 5a9e9abc4e804947f58ded6b50797f5c4c4b538a Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Mon, 24 Aug 2026 17:21:37 -0700 Subject: [PATCH 3/3] Quote the nix include paths flagged by shellcheck actionlint has not run against this repo since May, so the unquoted command substitution and $PWD in the evaluation step have gone unreported. Both are carried over unchanged from the previous workflow; quoting them is behaviour-preserving on the runner, where the path contains no spaces. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8929092..ebf3a77 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -39,7 +39,7 @@ jobs: --option restrict-eval true \ --option allow-import-from-derivation true \ --drv-path --show-trace \ - -I nixpkgs=$(nix-instantiate --find-file nixpkgs) \ - -I $PWD + -I "nixpkgs=$(nix-instantiate --find-file nixpkgs)" \ + -I "$PWD" - name: Build nix packages run: nix shell -f '' nix-build-uncached -c nix-build-uncached ci.nix -A cacheOutputs