mokhtar/nxdns
1
0
Fork 0
Code Pull Requests Actions Packages Releases 21 Activity

release: nix flake with tag-pinned hashes, reproducible tarballs (milestone 40)

Browse Source 
flake.nix fetches the release tarballs and carries their SRI hashes in a generated block. The cut tool builds the release locally with the toolchain gates.yml pins, in a normalized nine-variable environment, writes the hashes into flake.nix, and commits it with build.zig.zon as the single bump commit. The package job verifies the pins on the bump commit and the publish job verifies them again on the tag, before anything is uploaded.

The tarballs are written by dist_stage (std.tar.Writer, flate gzip) instead of the runner's tar and gzip, and -ffile-prefix-map keeps checkout paths out of the C objects; two checkouts at different absolute paths produce byte-identical archives. nxdns version, /api/version and the admin footer report the version only: the bump commit cannot know its own sha.
This commit is contained in:
mokhtar
2026-09-08 21:45:22 +02:00
parent 3e57f43e08
commit 22abcd9b7b
41 changed files with 1739 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/dist-placeholder/index.html
+1 -1
View File
@@ -52,7 +52,7 @@
});
fetch("/api/version")
.then((r) => r.json())
.then((v) => { el("version").textContent = v.version + " (" + v.git_commit + ")"; })
.then((v) => { el("version").textContent = v.version; })
.catch(() => {});
</script>
</body>
admin/src/features/activity/ActivityDetailPage.test.tsx
+1 -1
View File
@@ -16,7 +16,7 @@ let responses: Record<string, unknown>;
beforeEach(() => {
responses = {
"/api/version": { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 },
"/api/version": { version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 },
"/api/health": health(),
};
vi.stubGlobal(
admin/src/features/activity/ActivityPage.test.tsx
+1 -1
View File
@@ -86,7 +86,7 @@ function json(payload: unknown): Response {
return new Response(JSON.stringify(payload), { status: 200, headers: { "content-type": "application/json" } });
}
const VERSION = { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 };
const VERSION = { version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 };
/** The shell's own requests, which every test serves the same way. */
function stubFetch(handler: (url: string) => Response | Promise<Response>) {
admin/src/features/activity/LiveActivity.test.tsx
+1 -1
View File
@@ -48,7 +48,7 @@ const CLIENTS: Client[] = [
client("192.0.2.12", "", ""),
];
const VERSION = { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 };
const VERSION = { version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 };
let sources: FakeEventSource[];
let fetchMock: ReturnType<typeof vi.fn>;
admin/src/features/clients/testFixtures.tsx
+1 -1
View File
@@ -50,7 +50,7 @@ export const PREFIXES = {
client_prefixes: [{ id: 1, prefix: "192.168.1.0/24", group_id: 2, group: "kids", priority: 100 }],
};
const VERSION = { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 };
const VERSION = { version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 };
export const DATABASE = { authority: "database", path: null, reconciled_at: null, restart_pending: false };
export const MANAGED_FILE = {
admin/src/features/configuration/testFixtures.tsx
+1 -1
View File
@@ -194,7 +194,7 @@ function defaultResponses(status: ConfigStatus): Record<string, unknown> {
return {
"GET /api/config/status": status,
"GET /api/health": health(),
"GET /api/version": { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 },
"GET /api/version": { version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 },
"GET /api/groups": { groups: GROUPS },
"GET /api/groups/1/sources": { source_ids: [1] },
"GET /api/groups/2/sources": { source_ids: [] },
admin/src/features/diagnostics/DiagnosticDetailPage.test.tsx
+1 -1
View File
@@ -35,7 +35,7 @@ let requested: string[];
beforeEach(() => {
requested = [];
responses = {
"/api/version": { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 },
"/api/version": { version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 },
// The shell reads health for the Diagnostics nav badge on every route.
"/api/health": health(),
};
admin/src/features/diagnostics/DiagnosticsPage.test.tsx
+1 -1
View File
@@ -77,7 +77,7 @@ let requested: string[];
beforeEach(() => {
requested = [];
responses = {
"/api/version": { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 },
"/api/version": { version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 },
// The health strip at the top of the page; quiet on a healthy box, which is
// what every test below wants it to be.
"/api/health": health(),
admin/src/features/diagnostics/HealthStrip.test.tsx
+1 -1
View File
@@ -42,7 +42,7 @@ beforeEach(() => {
return healthFails ? json({ error: "health unavailable" }, 400) : json(healthBody);
}
if (url === "/api/version")
return json({ version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 });
return json({ version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 });
if (url.startsWith("/api/diagnostics"))
return json({ events: [], next_before: null, active: { warnings: 0, errors: 0 } });
return json({ error: "not stubbed" }, 404);
admin/src/features/overview/OverviewPage.test.tsx
+1 -1
View File
@@ -113,7 +113,7 @@ beforeEach(() => {
}
if (url === "/api/health") return json(healthBody);
if (url === "/api/version")
return json({ version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 });
return json({ version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 });
if (url.startsWith("/api/diagnostics")) {
return json({ events: [], next_before: null, active: { warnings: 0, errors: 0 } });
}
admin/src/lib/contractSamples.gen.ts
-1
View File
@@ -70,7 +70,6 @@ export const sample_get_health: Health = {
};
export const sample_get_version: Version = {
git_commit: "<build>",
uptime_seconds: 0,
version: "w10-test",
zig_version: "<build>",
admin/src/lib/types.ts
-1
View File
@@ -63,7 +63,6 @@ export interface Health {
export interface Version {
version: string;
git_commit: string;
zig_version: string;
uptime_seconds: number;
}
admin/src/shell/AppShell.test.tsx
+1 -1
View File
@@ -33,7 +33,7 @@ const RESPONSES: Record<string, unknown> = {
coverage: { complete: true, available_since: 0 },
},
"/api/diagnostics?state=active": { events: [], next_before: null, active: { warnings: 0, errors: 0 } },
"/api/version": { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 },
"/api/version": { version: "0.0.0-test", zig_version: "0.16.0", uptime_seconds: 1 },
};
/** Null makes the health poll fail, which the nav badge has to treat as unknown. */
admin/src/shell/AppShell.tsx
+1 -1
View File
@@ -318,7 +318,7 @@ function VersionFooter() {
const { data } = useQuery(versionQuery());
return (
<footer {...stylex.props(styles.versionFooter)}>
{data === undefined ? "nxdns" : `nxdns v${data.version} (${data.git_commit.slice(0, 7)})`}
{data === undefined ? "nxdns" : `nxdns v${data.version}`}
</footer>
);
}