hercules-ci-agent 0.10.10 → 0.10.11

raw patch · 3 files changed

+18/−1 lines, 3 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• CHANGELOG.md +9/−0
• hercules-ci-agent.cabal +1/−1
• src/Hercules/Effect.hs +8/−0

@@ -5,6 +5,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.10.11] - 2026-10-18++### Fixed++- `/nix/var/nix` is now read-only, so that Nix's store detection recognizes it+  as a daemon store, even if `NIX_REMOTE` is unset.+  `/nix/var/nix/profiles` is writable, but not persisted, like before, but also+  when the root is set to read-only.+ ## [0.10.10] - 2026-10-13  ### Fixed

@@ -1,7 +1,7 @@ cabal-version: 2.4  name:           hercules-ci-agent-version:        0.10.10+version:        0.10.11 synopsis:       Runs Continuous Integration tasks on your machines category:       Nix, CI, Testing, DevOps homepage:       https://docs.hercules-ci.com

@@ -185,6 +185,12 @@   etcDir <- mkDir "etc"   secretsDir <- mkDir "secrets"   containerDir <- mkDir "container-state"+  nixStateDir <- mkDir "nix-state"+  createDirectory (dir </> "nix-state/daemon-socket")+  -- Mount point for the socket; the read-only parent prevents its creation+  -- by the container runtime.+  liftIO $ writeFile (dir </> "nix-state/daemon-socket/socket") ""+  nixProfilesDir <- mkDir "nix-state/profiles"   let extraSecrets =         runEffectToken p           & maybe@@ -280,6 +286,8 @@           { extraBindMounts =               [ BindMount {pathInContainer = "/build", pathInHost = buildDir, readOnly = False},                 BindMount {pathInContainer = "/secrets", pathInHost = secretsDir, readOnly = True},+                BindMount {pathInContainer = "/nix/var/nix", pathInHost = nixStateDir, readOnly = True},+                BindMount {pathInContainer = "/nix/var/nix/profiles", pathInHost = nixProfilesDir, readOnly = False},                 BindMount {pathInContainer = "/nix/var/nix/daemon-socket/socket", pathInHost = toS forwardedSocketPath, readOnly = True}               ]                 ++ [ BindMount {pathInContainer = "/etc", pathInHost = etcDir, readOnly = False}