diff --git a/CHANGELOG.md b/CHANGELOG.md --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.10.9] - 2026-10-13 + +### Added + +- Nix 2.34, 2.35 support + ## [0.10.8] - 2026-01-06 ### Added @@ -31,39 +37,48 @@ ### Added - - Nix 2.24 support +- Nix 2.24 support ## [0.10.4] - 2024-06-12 ### Fixed - - Embed data file to make packaging easier. +- Embed data file to make packaging easier. ## [0.10.3] - 2024-05-19 ### Fixed - - Updates in the Nix bindings, improving stability. +- Updates in the Nix bindings, improving stability. ## [0.10.2] - 2024-05-03 ### Added - - Add `nixSettings` configuration item, to more easily configure Nix settings such as `substituters`, overriding the system Nix settings. - - Cachix 1.7.2 support +- Add `nixSettings` configuration item, to more easily configure Nix settings such as `substituters`, overriding the system Nix settings. +- Cachix 1.7.2 support ### Fixed - - Remove most uses of `c_str()`, of which at least one exhibited undefined behavior. - - `nix-darwin` module now reads `system` correctly from the configuration. +- Remove most uses of `c_str()`, of which at least one exhibited undefined behavior. +- `nix-darwin` module now reads `system` correctly from the configuration. ## [0.10.1] - 2024-02-12 +### Added + +- Effect mounts. Specify [`effectMountables`](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#effectMountables) in the agent configuration, deploy, and [mount](https://docs.hercules-ci.com/hercules-ci-agent/effects/declaration.html#__hci_effect_mounts) them into an effect. This can be used for instance to expose the host's `/etc/hosts`, or hardware devices such as GPUs. Access is [controlled](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#effectMountables-condition) by the agent configuration. + +- New configuration option `remotePlatformsWithSameFeatures`, allowing a remote build to be used before more elaborate remote builder support is implemented. + The recommended method for running a cluster is still to install `hercules-ci-agent` on each machine, as that is more efficient and accurate. + +- Agent [labels](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#labels) can now be `null`, when using the JSON configuration format. + ### Changed - - More work is performed concurrently during evaluation, including binary cache lookups and (more) build dispatch. This results in a speedup. +- More work is performed concurrently during evaluation, including binary cache lookups and (more) build dispatch. This results in a speedup. - - Dependencies of build dependencies are not scheduled eagerly anymore. +- Dependencies of build dependencies are not scheduled eagerly anymore. This reduces the scope of all jobs that are evaluated by agents since this release, resulting in a speedup. This resolves a noticable slowdown when first evaluating significant Nixpkgs updates when its `staging` branch is merged. @@ -73,49 +88,52 @@ CI setups based on the Nix command line interface (almost all CIs) also behave this way. - - The recommended configuration format is now **JSON**, preferably generated using a configuration manager such as NixOS or nix-darwin. +- The recommended configuration format is now **JSON**, preferably generated using a configuration manager such as NixOS or nix-darwin. TOML is still supported, but does not support `null` in labels, and due to library limitations, it requires that intermediate tables be specified. See [the config file documentation](https://docs.hercules-ci.com/hercules-ci-agent/agent-config). - - `services.hercules-ci-agent` is now an alias for `services.hercules-ci-agents.""`, which still provides the same behavior as the old module. - - - Hardening flags have been applied to the NixOS module. - - - The effect sandbox now use the `crun` container runtime instead of `runc`. - - - Attribute sets containing a `_type` attribute are not scanned for derivations in `herculesCI.<...>.outputs`. This prevents accidental scanning of large or failing attribute trees, such as NixOS configurations. `nixosConfigurations` in Flakes are still built as usual, as they are not (verbatim) in the `herculesCI.<...>.outputs` attributes. - -### Added +- `services.hercules-ci-agent` is now an alias for `services.hercules-ci-agents.""`, which still provides the same behavior as the old module. - - Effect mounts. Specify [`effectMountables`](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#effectMountables) in the agent configuration, deploy, and [mount](https://docs.hercules-ci.com/hercules-ci-agent/effects/declaration.html#__hci_effect_mounts) them into an effect. This can be used for instance to expose the host's `/etc/hosts`, or hardware devices such as GPUs. Access is [controlled](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#effectMountables-condition) by the agent configuration. +- Hardening flags have been applied to the NixOS module. - - New configuration option `remotePlatformsWithSameFeatures`, allowing a remote build to be used before more elaborate remote builder support is implemented. - The recommended method for running a cluster is still to install `hercules-ci-agent` on each machine, as that is more efficient and accurate. +- The effect sandbox now use the `crun` container runtime instead of `runc`. - - Agent [labels](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#labels) can now be `null`, when using the JSON configuration format. +- Attribute sets containing a `_type` attribute are not scanned for derivations in `herculesCI.<...>.outputs`. This prevents accidental scanning of large or failing attribute trees, such as NixOS configurations. `nixosConfigurations` in Flakes are still built as usual, as they are not (verbatim) in the `herculesCI.<...>.outputs` attributes. ### Fixed - - Low level crash details are now reported in the log as expected. +- Low level crash details are now reported in the log as expected. - - An interaction between the Nix GC and threads has been fixed, solving such a crash. +- An interaction between the Nix GC and threads has been fixed, solving such a crash. ## [0.9.12] - 2023-06-28 ### Added - - Nix 2.16 support +- Nix 2.16 support - - Nix 2.15 support +- Nix 2.15 support ### Fixed - - Do not `chdir` the build worker. This functionality of the `process` package appears unreliable, but is not needed. +- Do not `chdir` the build worker. This functionality of the `process` package appears unreliable, but is not needed. ## [0.9.11] - 2023-03-06 -### BREAKING +### Added - - The `nix-darwin` module uses new user id and group id numbers, to match the upstream `nix-darwin` module. +- Nix verbosity can now be specified in the config file under the + new attribute `nixVerbosity`. + +- Cachix 1.3 support + +- Nix 2.14 support + +- Nix 2.13 support + + +### Changed + +- **Breaking:** The `nix-darwin` module uses new user id and group id numbers, to match the upstream `nix-darwin` module. The main benefit of the upstream change is that the agent user will not appear as a normal (human) user on the system. To migrate, run: @@ -138,82 +156,70 @@ ### Fixed - - Non-builder build errors such as output cycles are now reported +- Non-builder build errors such as output cycles are now reported in the build log. - - `ciSystems` is now taken into account by the default `onPush.default` +- `ciSystems` is now taken into account by the default `onPush.default` job when the `herculesCI` attribute of a flake is a function. - - `darwinConfigurations` is now filtered in accordance with `ciSystems`. - - -### Added - - - Nix verbosity can now be specified in the config file under the - new attribute `nixVerbosity`. - - - Cachix 1.3 support - - - Nix 2.14 support - - - Nix 2.13 support +- `darwinConfigurations` is now filtered in accordance with `ciSystems`. ## [0.9.10] - 2022-12-29 -### Fixed +### Added - - Detect stack overflows correctly in Nix evaluation +- Cachix 1.1 compatibility - - Retry errors from Nix-native (non-cachix) caches +### Changed -### Added +- Unwrap some error messages for readability - - Cachix 1.1 compatibility +### Fixed -### Changed +- Detect stack overflows correctly in Nix evaluation - - Unwrap some error messages for readability +- Retry errors from Nix-native (non-cachix) caches ## [0.9.9] - 2022-12-02 ### Fixed - - The flake `templates` check now allows filtered sources. +- The flake `templates` check now allows filtered sources. - - Tweaks to diagnostic messages +- Tweaks to diagnostic messages ## [0.9.8] - 2022-11-15 ### Added - - `herculesCI.onSchedule` jobs, which a created at set times. These can be used +- `herculesCI.onSchedule` jobs, which a created at set times. These can be used to automate work that doesn't start with a code change, such as automatic updates or impure periodic deployments. - - Secret types and the `GitToken` type, to be provided by the Hercules CI GitHub +- Secret types and the `GitToken` type, to be provided by the Hercules CI GitHub App. As of writing this requires a permission approval in the GitHub UI. This has to be initiated on the Hercules CI side. More on that very soon. - - More repository metadata in the `herculesCI` attribute; see [evaluation docs](https://docs.hercules-ci.com/hercules-ci-agent/evaluation/#param-herculesCI-primaryRepo). +- More repository metadata in the `herculesCI` attribute; see [evaluation docs](https://docs.hercules-ci.com/hercules-ci-agent/evaluation/#param-herculesCI-primaryRepo). ### Fixed - - Work around excessive stack use by libstdc++ regex [issue](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164) +- Work around excessive stack use by libstdc++ regex [issue](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164) The new limit of 256 MiB stack allows larger string inputs to be used. This bug was triggered by purs-nix and possibly other Nix expression libraries that parse substantial files. - - Lift the agent-side restriction on the number of derivations in a job. +- Lift the agent-side restriction on the number of derivations in a job. ## [0.9.7] - 2022-07-21 ### Added - - Nix 2.10 support +- Nix 2.10 support ### Removed - - `-nix_2_7` variants. Nixpkgs has stopped offering older versions of Nix. If +- `-nix_2_7` variants. Nixpkgs has stopped offering older versions of Nix. If you need an older version, you could inject an older Nixpkgs into this flake using `hercules-ci-agent.inputs.nixpkgs.follows = ...`. @@ -221,34 +227,34 @@ ### Added - - Nix 2.9 support +- Nix 2.9 support ### Fixed - - NixOS module: keep main process running when worker triggers system OOM killer. - - Missing file in hackage sdist +- NixOS module: keep main process running when worker triggers system OOM killer. +- Missing file in hackage sdist ## [0.9.5] - 2022-05-17 ### Added - - Concurrent IFD, reducing evaluation wall clock time - - Nix 2.8.0 support - - Improved log contexts +- Concurrent IFD, reducing evaluation wall clock time +- Nix 2.8.0 support +- Improved log contexts +### Removed + +- `hercules-ci-agent-nix_2_5` variant: upgrade to plain `hercules-ci-agent` (2.8.0) or `_nix_2_7`. + ### Fixed - - Workaround for cachix#406 (add `login` to `netrc`) - - A crash in `inline-c-cpp` exception handling (`inline-c-cpp` update) - - Towards the error "Could not push logs within 10 minutes after completion" +- Workaround for cachix#406 (add `login` to `netrc`) +- A crash in `inline-c-cpp` exception handling (`inline-c-cpp` update) +- Towards the error "Could not push logs within 10 minutes after completion" - Add a timeout to prevent hang in case of a stuck handshake - Enforce log limit on client side as well in case of excessive log spam and an upload bottleneck -### Removed - - - `hercules-ci-agent-nix_2_5` variant: upgrade to plain `hercules-ci-agent` (2.8.0) or `_nix_2_7`. - -## 0.9.4 - 2022-05-17 +## [0.9.4] - 2022-05-17 Bad release. See 0.9.5 for changes. @@ -256,31 +262,31 @@ ### Added - - The evaluator now caches build statuses and ignores redundant rebuild requests, giving a significant performance boost to IFD-heavy jobs. +- The evaluator now caches build statuses and ignores redundant rebuild requests, giving a significant performance boost to IFD-heavy jobs. ### Fixed - - The branch name in flake-based jobs is now handled correctly when special characters are present. +- The branch name in flake-based jobs is now handled correctly when special characters are present. ## [0.9.2] - 2022-03-30 ### Added - - Separate traces in the dashboard (as in `--show-trace`) +- Separate traces in the dashboard (as in `--show-trace`) ### Fixed - - Effects: `error: cannot open connection to remote store 'daemon': error: reading from file: Connection reset by peer` +- Effects: `error: cannot open connection to remote store 'daemon': error: reading from file: Connection reset by peer` ## [0.9.1] - 2022-03-18 ### Added - - The built-in flake support now has the `sourceInfo` attributes. +- The built-in flake support now has the `sourceInfo` attributes. ### Changed - - Flakes are checked out by Nix rather than custom local checkout. +- Flakes are checked out by Nix rather than custom local checkout. ## [0.9.0] - 2022-03-15 @@ -288,60 +294,60 @@ ### Added - - Flakes support! +- Flakes support! Instead of needing a `ci.nix`, the agent will pick up `flake.nix` and look for the [`herculesCI`](https://docs.hercules-ci.com/hercules-ci-agent/evaluation/#_herculesci_value) attribute in the flake. Only the `outputs.effects` sub-attributes may define effects, making attacks on secrets harder to conceal. - - Multiple jobs per commit +- Multiple jobs per commit - - Jobs that run with the latest successful dependency build +- Jobs that run with the latest successful dependency build - - Conditions on secrets, disallowing access to secrets except when the conditions are met. This enforces the four eyes principle when branch protection is set up to match the secrets' conditions. +- Conditions on secrets, disallowing access to secrets except when the conditions are met. This enforces the four eyes principle when branch protection is set up to match the secrets' conditions. A missing `condition` field does not give a great error message for security reasons, so follow the [upgrade guide](https://docs.hercules-ci.com/hercules-ci/guides/upgrade-to-agent-0.9/). - - Hardening against rogue contributors. Trivial attacks trying to read system paths or secrets are no longer possible. Similar to typical CIs, secrets _can_ be stolen under specific circumstances: either a misconfiguration of branch protection or by approval of a second maintainer. Note that issue was already largely addressed by only processing contributions from GitHub users with write access to the repository, which also still applies. +- Hardening against rogue contributors. Trivial attacks trying to read system paths or secrets are no longer possible. Similar to typical CIs, secrets _can_ be stolen under specific circumstances: either a misconfiguration of branch protection or by approval of a second maintainer. Note that issue was already largely addressed by only processing contributions from GitHub users with write access to the repository, which also still applies. - - Built-in support for fetching private repositories and tarballs. +- Built-in support for fetching private repositories and tarballs. ### Changed - - File lookup order has changed, to support flakes. `ci.nix` or `nix/ci.nix` still take top priority, followed by `flake.nix`, followed by `default.nix`. +- File lookup order has changed, to support flakes. `ci.nix` or `nix/ci.nix` still take top priority, followed by `flake.nix`, followed by `default.nix`. - - Installed private repositories can now be read by a collaborator. If you need to enforce confidentiality across repositories, contact us and use a personal access token with appropriate permissions in the meanwhile. +- Installed private repositories can now be read by a collaborator. If you need to enforce confidentiality across repositories, contact us and use a personal access token with appropriate permissions in the meanwhile. -### Fixed +### Removed - - When the root of a `ci.nix` is a list, an error message is returned. +- Nix 2.3 support -### Removed +### Fixed - - Nix 2.3 support +- When the root of a `ci.nix` is a list, an error message is returned. ## [0.8.7] - 2022-03-09 ### Added - - Nix 2.7 support - - Haskell `aeson` 2.0 support +- Nix 2.7 support +- Haskell `aeson` 2.0 support ## [0.8.6] - 2022-03-07 -### Fixed +### Added - - Build with newer Nix versions 2.5, 2.6 +- Improved conditional code support with `cabal-pkg-config-version-hook` -### Added +### Fixed - - Improved conditional code support with `cabal-pkg-config-version-hook` +- Build with newer Nix versions 2.5, 2.6 -## [0.8.5] +## [0.8.5] - 2022-01-21 ### Added - - The flake now has `.nixosModules.multi-agent-service` allowing multiple agents +- The flake now has `.nixosModules.multi-agent-service` allowing multiple agents to run on the same system. An instance with default settings can be enabled with `services.hercules-ci-agents."some-name" = {}`. User name and file paths are like the regular module, except replacing `hercules-ci-agent` by `hci-${name}` if the chosen `name` is not `""`. @@ -349,76 +355,76 @@ ### Fixed - - Fix mounting `/etc/resolv.conf`, work around runc#1523. Fixed by @Mic92 in #357 +- Fix mounting `/etc/resolv.conf`, work around runc#1523. Fixed by @Mic92 in #357 - - An issue where a Nix evaluator crash could lead to builds being triggered in +- An issue where a Nix evaluator crash could lead to builds being triggered in the backend for which the derivation hadn't been pushed to the cache yet, causing needless build failures. #314 - - A build error caused by a moved symbol in `cachix >= 0.7`. #363 +- A build error caused by a moved symbol in `cachix >= 0.7`. #363 - - A test that relied on `aeson` field order, which isn't stable. #352 +- A test that relied on `aeson` field order, which isn't stable. #352 -## [0.8.4] +## [0.8.4] - 2021-11-17 ### Added - - The path to `secrets.json` is now configurable in the module or config file, +- The path to `secrets.json` is now configurable in the module or config file, using the `secretsJsonPath` setting, analogous to `clusterJoinTokenPath`. - - `aarch64-darwin` is now officially supported. +- `aarch64-darwin` is now officially supported. - - All module settings options will be visible in the NixOS documentation. +- All module settings options will be visible in the NixOS documentation. Some less-used settings were hidden, specifically the file path options that default to `staticSecretsDirectory + "/cluster-join-token.key"`, etc. ### Changed - - The flake packages and modules now link with Nix 2.4. +- The flake packages and modules now link with Nix 2.4. Nix 2.3 support is still available via `packages.${system}.hercules-ci-agent-nix_2_3`, but will be removed in agent 0.9.x. - - No longer patch Boehm GC, staying closer to regular Nix and the Nixpkgs build of the `hercules-ci-agent`. +- No longer patch Boehm GC, staying closer to regular Nix and the Nixpkgs build of the `hercules-ci-agent`. ### Fixed - - Various fixes related to the upgrade to Nix 2.4. +- Various fixes related to the upgrade to Nix 2.4. -## [0.8.3] +## [0.8.3] - 2021-09-06 ### Added - - `hci` can now run in the effects sandbox +- `hci` can now run in the effects sandbox ### Fixed - - Interrupt handling has been improved +- Interrupt handling has been improved -## [0.8.2] +## [0.8.2] - 2021-06-22 ### Added - - Preparations for the next Nix version +- Preparations for the next Nix version ### Fixed - - #304, `message:epollControl: invalid argument (Bad file descriptor)` in effect task +- #304, `message:epollControl: invalid argument (Bad file descriptor)` in effect task -## [0.8.1] +## [0.8.1] - 2021-04-21 ### Added - - Attach user-defined labels to the agent, for retrieval via the API. +- Attach user-defined labels to the agent, for retrieval via the API. ### Fixed - - Fix an issue where long-runnin nix methods weren't interrupted - - Fix error `mkdir /run/runc: permission denied` +- Fix an issue where long-runnin nix methods weren't interrupted +- Fix error `mkdir /run/runc: permission denied` -## [0.8.0] +## [0.8.0] - 2021-03-07 ### Added - - Hercules CI Effects, a new feature for running programs that interact with +- Hercules CI Effects, a new feature for running programs that interact with the real world, with useful features for continous deployment. - Effects only run after the build completes successfully @@ -436,7 +442,7 @@ - Secrets are configured locally on your agents, so you don't have to trust a third party with your cloud credentials - - Hercules CI Agent is now a flake. The highlights are +- Hercules CI Agent is now a flake. The highlights are - `nixosModules` overriding the NixOS-distributed module to the in-repo version - `agent-profile` for agent machines, or - `agent-service` for just the service definition @@ -444,12 +450,12 @@ - `hercules-ci-cli` the user command line interface - `hercules-ci-agent` for custom installation methods, etc - - The `hci` command (flake: `defaultApp`) +- The `hci` command (flake: `defaultApp`) - `hci login` to authenticate yourself - `hci state` to work with Effects state files - `hci effect` to run effects locally - - Commit metadata as a `ci.nix` argument. Make your `ci.nix` a function: +- Commit metadata as a `ci.nix` argument. Make your `ci.nix` a function: ```nix { src ? { ref = null; rev = null; }}: @@ -459,68 +465,53 @@ `src.ref` will have e.g. `refs/heads/master` and `rev` will have the git commit SHA. - - Shell derivations will only be built for their dependencies. Add a +- Shell derivations will only be built for their dependencies. Add a `mkShell`-based expression like you would add a derivation. This behavior can be requested explicitly for shells and non-shell derivations alike by appending ` // { buildDependenciesOnly = true; }` to the attribute definition. - - Attributes can now be marked to require or ignore a build failure in the +- Attributes can now be marked to require or ignore a build failure in the derivation it references directly. (see [support#34](https://github.com/hercules-ci/support/issues/34)) - - `concurrentTasks` now has a default, `"auto"` for ease of setup and to help +- `concurrentTasks` now has a default, `"auto"` for ease of setup and to help avoid underutilization. -### Fixed - - - The parent directory name will match the repo name [support#40](https://github.com/hercules-ci/support/issues/40) - - - Previously, lines from Nix's configured netrc file were ignored. Now they are appended to Hercules CI's netrc lines. - ### Changed - - Cachix caches without `signingKeys` will be pushed to, as part of the recently +- Cachix caches without `signingKeys` will be pushed to, as part of the recently introduced write token feature (Cachix-managed signing keys) +### Fixed -## [0.7.5] - 2020-11-27 +- The parent directory name will match the repo name [support#40](https://github.com/hercules-ci/support/issues/40) -### Fixed +- Previously, lines from Nix's configured netrc file were ignored. Now they are appended to Hercules CI's netrc lines. - - GHC 8.10.2 compatibility for NixOS unstable / NixOS 21.03 - - Build with cachix 0.5.1. Write token support is not included due to a break configuration semantics. It will be available in >= 0.8. +## [0.7.5] - 2020-11-27 ### Changed - - The in-repo expressions have upgraded their dependency to NixOS 20.09 - - - Agent will now use `HERCULES_CI_API_BASE_URL` over `HERCULES_API_BASE_URL` if set. +- The in-repo expressions have upgraded their dependency to NixOS 20.09 - - Temporarily switch to cabal tooling due to breakage. `master` continues to be stack-based. +- Agent will now use `HERCULES_CI_API_BASE_URL` over `HERCULES_API_BASE_URL` if set. -## [0.7.4] - 2020-08-25 +- Temporarily switch to cabal tooling due to breakage. `master` continues to be stack-based. ### Fixed - - Paths that are missing from the binary cache will be rebuilt. This affected - agent 0.7 - 0.7.3 users with trusted user optimizations turned on, which is - the default when using the NixOS or nix-darwin modules. - - - Prevent states where no progress can be made. One caused by a potential buildup - of batched messages that may not fit within the timeout interval; the other - a receive operation without a timeout during the initial socket handshake. +- GHC 8.10.2 compatibility for NixOS unstable / NixOS 21.03 - - The log socket will remain open instead of reconnecting unnecessarily. +- Build with cachix 0.5.1. Write token support is not included due to a break configuration semantics. It will be available in >= 0.8. - - Add a safety measure to prevent unintended increases in workload in case - Nix sees an opportunity for concurrency that was not intended by Hercules CI. +## [0.7.4] - 2020-08-25 ### Changed - - The NixOS module in the hercules-ci-agent repo now disables the upcoming +- The NixOS module in the hercules-ci-agent repo now disables the upcoming module that is packaged upstream with NixOS. The upstream module will configure fewer things for you, to be in line with @@ -530,150 +521,163 @@ The configuration interface in the hercules-ci-agent repo will remain unchanged for `0.7` but `0.8` will match the upstream interface. +### Fixed + +- Paths that are missing from the binary cache will be rebuilt. This affected + agent 0.7 - 0.7.3 users with trusted user optimizations turned on, which is + the default when using the NixOS or nix-darwin modules. + +- Prevent states where no progress can be made. One caused by a potential buildup + of batched messages that may not fit within the timeout interval; the other + a receive operation without a timeout during the initial socket handshake. + +- The log socket will remain open instead of reconnecting unnecessarily. + +- Add a safety measure to prevent unintended increases in workload in case + Nix sees an opportunity for concurrency that was not intended by Hercules CI. + ## [0.7.3] - 2020-07-18 ### Added - - Evaluation log +- Evaluation log - - Configurable log level via config file or `extraOptions` +- Configurable log level via config file or `extraOptions` ### Changed - - Default log level is `InfoS` rather than `DebugS` +- Default log level is `InfoS` rather than `DebugS` ## [0.7.2] - 2020-06-18 ### Changed - - cachix: 0.3.7 -> 0.3.8. Improves reliability through better retries and improves error reporting +- cachix: 0.3.7 -> 0.3.8. Improves reliability through better retries and improves error reporting ## [0.7.1] - 2020-06-17 ### Added - - Push to any nix store, including S3, using the `NixCache` kind in `binary-caches.json` +- Push to any nix store, including S3, using the `NixCache` kind in `binary-caches.json` ### Changed - - Switch to Nixpkgs 20.03 +- Switch to Nixpkgs 20.03 - - Environment variables are now passed on to evaluation and build by default. This allows configuration to be passed to Nix without intervention from hercules-ci-agent. +- Environment variables are now passed on to evaluation and build by default. This allows configuration to be passed to Nix without intervention from hercules-ci-agent. - - `trusted-user` is not a requirement and is configured automatically when using the NixOS module or nix-darwin module. +- `trusted-user` is not a requirement and is configured automatically when using the NixOS module or nix-darwin module. ### Fixed - - Agent will now reset its connection with hercules-ci.com when pings are not acknowledged in time. +- Agent will now reset its connection with hercules-ci.com when pings are not acknowledged in time. - - Prevent running out of file descriptors by increasing the soft limit if possible. +- Prevent running out of file descriptors by increasing the soft limit if possible. ## [0.7.0] - 2020-05-05 -### Known issues - - - Agent process user must be in `trusted-users`. This is the case with the NixOS and nix-darwin module. Doing so is recommended for ease of use and performance but should not be a requirement. +**Known issue:** Agent process user must be in `trusted-users`. This is the case with the NixOS and nix-darwin module. Doing so is recommended for ease of use and performance but should not be a requirement. ### Added - - Jobs can be cancelled +- Jobs can be cancelled - - Build logs are streamed in realtime +- Build logs are streamed in realtime - - The build log now has timestamps and color +- The build log now has timestamps and color - - Distributed builds performance has improved by fetching fewer derivations +- Distributed builds performance has improved by fetching fewer derivations ### Fixed - - Extra nix options were not passed to the build process +- Extra nix options were not passed to the build process ## [0.6.6] - 2020-03-16 ### Fixed - - NixOS, nix-darwin modules: check the `nix-daemon` source and add option to patch an in-memory cache expiry issue +- NixOS, nix-darwin modules: check the `nix-daemon` source and add option to patch an in-memory cache expiry issue causing errors in build clusters (of more than 1 machine). The module asks for confirmation. - - **Manual action:** if you are not using the provided module and you run the agent on +- **Manual action:** if you are not using the provided module and you run the agent on more than one machine, and you use `nix-daemon`, to fix above issue, you need to: - either upgrade your system's Nix to a recent `master` or version 2.4.0 when released, - or apply this patch to your system's Nix installation: https://github.com/NixOS/nix/pull/3405 - - Cachix: 0.3.5 -> [0.3.7](https://github.com/cachix/cachix/blob/master/cachix/CHANGELOG.md#037---2020-03-12) to prevent uploading bad NARs in rare cases. +- Cachix: 0.3.5 -> [0.3.7](https://github.com/cachix/cachix/blob/master/cachix/CHANGELOG.md#037---2020-03-12) to prevent uploading bad NARs in rare cases. ## [0.6.5] - 2020-03-07 -### Fixed +### Added - - Work around a systemd behavior where it didn't restart the unit +- `--test-configuration` flag to validate the configuration without actually running the agent. -### Added +### Fixed - - `--test-configuration` flag to validate the configuration without actually running the agent. +- Work around a systemd behavior where it didn't restart the unit ## [0.6.4] - 2020-03-06 -### Fixed +### Added - - Fix a bug blocking evaluation when a store path is removed from cache or cache configuration is changed. +- Cached builds to speed up `aarch64-linux` agent deployments. -### Added +### Fixed - - Cached builds to speed up `aarch64-linux` agent deployments. +- Fix a bug blocking evaluation when a store path is removed from cache or cache configuration is changed. -### [0.6.3] - 2020-02-19 +## [0.6.3] - 2020-02-19 ### Fixed - - Fix a concurrency problem causing not all evaluation events to be written to server when evaluation fails. +- Fix a concurrency problem causing not all evaluation events to be written to server when evaluation fails. - - Fix evaluation errors triggered by build outputs go missing from cache, by requesting a forced rebuild. +- Fix evaluation errors triggered by build outputs go missing from cache, by requesting a forced rebuild. - - Fix blocked shutdown on NixOS, fix agent status in dashboard, by stopping agent before network shutdown #195. +- Fix blocked shutdown on NixOS, fix agent status in dashboard, by stopping agent before network shutdown #195. - - Fix upload of large outputs by using the correct http client manager for Cachix, removing a timeout. +- Fix upload of large outputs by using the correct http client manager for Cachix, removing a timeout. ### Changed - - Agent will now try to verify that the nix-daemon has narinfo-cache-negative-ttl = 0. This is required for correct operation. +- Agent will now try to verify that the nix-daemon has narinfo-cache-negative-ttl = 0. This is required for correct operation. -### [0.6.2] - 2020-01-30 +## [0.6.2] - 2020-01-30 ### Fixed - - Update cachix to support the API change for the new CDN. This update is +- Update cachix to support the API change for the new CDN. This update is required for uploading sources and compressed outputs over 100MB in size. Please update. -### [0.6.1] - 2019-11-06 +## [0.6.1] - 2019-11-06 ### Fixed - - Fix token leak to system log when reporting an HTTP exception. This was introduced by a library upgrade. +- Fix token leak to system log when reporting an HTTP exception. This was introduced by a library upgrade. This was discovered after tagging 0.6.0 but before the release was announced and before moving of the `stable` branch. Only users of the `hercules-ci-agent` `master` branch and the unannounced tag were exposed to this leak. We recommend to follow the `stable` branch. - - Temporarily revert a Nix GC configuration change that might cause problems +- Temporarily revert a Nix GC configuration change that might cause problems until agent gc root behavior is improved. -### [0.6.0] - 2019-11-04 +## [0.6.0] - 2019-11-04 ### Changed - - Switch to Nix 2.3 and NixOS 19.09. *You should update your deployment to reflect the NixOS upgrade*, unless you're using terraform or nix-darwin, where it's automatic. - - Increased parallellism during push to cachix - - Switch to NixOS 19.09 - - Enable min-free/max-free Nix GC +- Switch to Nix 2.3 and NixOS 19.09. *You should update your deployment to reflect the NixOS upgrade*, unless you're using terraform or nix-darwin, where it's automatic. +- Increased parallellism during push to cachix +- Switch to NixOS 19.09 +- Enable min-free/max-free Nix GC ### Fixed - - Transient errors during source code fetching are now retried - - Fixed a bug related to narinfo caching in the context of IFD - - Fixed an exception when the root of ci.nix is a list, although lists are unsupported +- Transient errors during source code fetching are now retried +- Fixed a bug related to narinfo caching in the context of IFD +- Fixed an exception when the root of ci.nix is a list, although lists are unsupported ## [0.5.0] - 2019-10-01 @@ -697,7 +701,7 @@ ### Fixed - - The agent will now actually auto-restart when the secrets files change. +- The agent will now actually auto-restart when the secrets files change. ## [0.4.0] - 2019-08-30 @@ -721,7 +725,7 @@ - Bump Cachix to fix a few bugs (errors with too many derivations, performance fixes, etc.) - - Modern BoehmGC initial settings for Nix memory limits +- Modern BoehmGC initial settings for Nix memory limits ## [0.3.2] - 2019-08-11 @@ -755,6 +759,20 @@ ## [0.3.0] - 2019-07-05 +### Added + +- Added Cachix support, for multi-agent and multi-platform support + +- Report derivation outputs with their size and hashes + +- Added Darwin support via nix-darwin + +- Support `requiredFeatures` attribute on derivations + +- Hello and hearthbeat protocol, which will allow the + service to be aware of how the agent is configured and + when it's online. + ### Changed - Configuration of the agent is now done via `--config agent.toml` @@ -776,20 +794,6 @@ - Added retries to status reporting to fix potential inconsistencies on the service -### Added - -- Added Cachix support, for multi-agent and multi-platform support - -- Report derivation outputs with their size and hashes - -- Added Darwin support via nix-darwin - -- Support `requiredFeatures` attribute on derivations - -- Hello and hearthbeat protocol, which will allow the - service to be aware of how the agent is configured and - when it's online. - ## [0.2] - 2019-05-14 - use [gitignore] instead of [nix-gitignore] @@ -806,7 +810,7 @@ - Support ci.nix or nix/ci.nix along with default.nix -## 0.1.0.0 - 2019-03-28 +## [0.1.0.0] - 2019-03-28 - Initial release @@ -827,6 +831,7 @@ [0.9.6]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.5...hercules-ci-agent-0.9.6 [0.9.5]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.3...hercules-ci-agent-0.9.5 [0.9.3]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.2...hercules-ci-agent-0.9.3 +[0.9.4]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.3...hercules-ci-agent-0.9.4 [0.9.2]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.1...hercules-ci-agent-0.9.2 [0.9.1]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.0...hercules-ci-agent-0.9.1 [0.9.0]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.8.7...hercules-ci-agent-0.9.0 @@ -843,6 +848,7 @@ [0.7.3]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.7.2...hercules-ci-agent-0.7.3 [0.7.2]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.7.1...hercules-ci-agent-0.7.2 [0.7.1]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.6...hercules-ci-agent-0.7.1 +[0.7.0]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.6...hercules-ci-agent-0.7.0 [0.6.6]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.5...hercules-ci-agent-0.6.6 [0.6.5]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.4...hercules-ci-agent-0.6.5 [0.6.4]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.3...hercules-ci-agent-0.6.4 diff --git a/cbits/hercules-aliases.h b/cbits/hercules-aliases.h --- a/cbits/hercules-aliases.h +++ b/cbits/hercules-aliases.h @@ -22,4 +22,25 @@ typedef nix::DerivationOutputs::iterator DerivationOutputsIterator; typedef nix::StringPairs::iterator StringPairsIterator; +#if NIX_IS_AT_LEAST(2, 34, 0) +#include "HaskellException.hxx" +#include + +/* Exception thrown by the builder callback into the evaluator. + * + * Nix >= 2.34 caches evaluation failures in thunks ("tFailed"). Deriving + * from nix::RecoverableEvalError gives the failed thunk a recovery value, + * so that forcing it again re-evaluates it, re-entering the builder + * callback, needed for resuming non-blocking IFD. + */ +class HerculesBuilderException : public HaskellException, public nix::RecoverableEvalError +{ +public: + HerculesBuilderException(nix::EvalState & state, const std::string & renderedException, void *stablePtr) + : HaskellException(renderedException, stablePtr) + , nix::RecoverableEvalError(state, "%s", renderedException) + {} +}; +#endif + using namespace std; diff --git a/cbits/nix-2.4/hercules-store.cxx b/cbits/nix-2.4/hercules-store.cxx --- a/cbits/nix-2.4/hercules-store.cxx +++ b/cbits/nix-2.4/hercules-store.cxx @@ -15,6 +15,10 @@ using namespace nix; +#if NIX_IS_AT_LEAST(2, 35, 0) +void WrappingStore::anchor() {} +#endif + #if NIX_IS_AT_LEAST(2, 29, 0) WrappingStore::WrappingStore(ref storeToWrap) : Store(storeToWrap->config), wrappedStore(storeToWrap) {} @@ -50,7 +54,13 @@ auto callbackPtr = std::make_shared(std::move(callback)); wrappedStore->queryPathInfo(path, {[=](std::future> vpi){ - (*callbackPtr)(vpi.get().get_ptr()); + try { + (*callbackPtr)(vpi.get().get_ptr()); + } catch (...) { + // Must not let exceptions (e.g. InvalidPath) escape this noexcept + // context; pass them to the caller through the callback instead. + callbackPtr->rethrow(); + } }}); } @@ -146,10 +156,17 @@ return wrappedStore->getFSAccessor(requireValidPath); } +#if NIX_IS_AT_LEAST(2, 34, 0) void WrappingStore::addSignatures(const StorePath& storePath, + const std::set& sigs) { + wrappedStore->addSignatures(storePath, sigs); +}; +#else +void WrappingStore::addSignatures(const StorePath& storePath, const StringSet& sigs) { wrappedStore->addSignatures(storePath, sigs); }; +#endif void WrappingStore::computeFSClosure(const StorePathSet& paths, StorePathSet& out, @@ -267,6 +284,10 @@ #endif void HerculesStore::buildPaths(const std::vector & derivedPaths, BuildMode buildMode, std::shared_ptr evalStore) { + if (builderCallback == nullptr) { + throw nix::Error("HerculesStore: builder callback is not set; this is a bug in hercules-ci-agent"); + } + std::exception_ptr exceptionToThrow(nullptr); // responsibility for delete is transferred to builderCallback diff --git a/cbits/nix-2.4/hercules-store.hh b/cbits/nix-2.4/hercules-store.hh --- a/cbits/nix-2.4/hercules-store.hh +++ b/cbits/nix-2.4/hercules-store.hh @@ -15,6 +15,11 @@ using namespace nix; class WrappingStore : public Store { +#if NIX_IS_AT_LEAST(2, 35, 0) + /* VTable anchor, required by nix::Store; see its declaration there. */ + void anchor() override; +#endif + public: ref wrappedStore; @@ -105,7 +110,11 @@ virtual std::shared_ptr getFSAccessor(const StorePath & path, bool requireValidPath = true) override; #endif +#if NIX_IS_AT_LEAST(2, 34, 0) + virtual void addSignatures(const StorePath & storePath, const std::set & sigs) override; +#else virtual void addSignatures(const StorePath & storePath, const StringSet & sigs) override; +#endif virtual void computeFSClosure(const StorePathSet & paths, StorePathSet & out, bool flipDirection = false, @@ -135,7 +144,8 @@ class HerculesStore final : public WrappingStore { public: StorePathSet ensuredPaths; - void (* builderCallback)(std::vector*, std::exception_ptr *exceptionToThrow); + // Set during evaluation; see setBuilderCallback. + void (* builderCallback)(std::vector*, std::exception_ptr *exceptionToThrow) = nullptr; HerculesStore(ref storeToWrap); diff --git a/hercules-ci-agent-worker/Hercules/Agent/Worker.hs b/hercules-ci-agent-worker/Hercules/Agent/Worker.hs --- a/hercules-ci-agent-worker/Hercules/Agent/Worker.hs +++ b/hercules-ci-agent-worker/Hercules/Agent/Worker.hs @@ -33,7 +33,7 @@ import Hercules.Agent.Worker.Env qualified import Hercules.Agent.Worker.Error (ExceptionText (exceptionTextMessage), exceptionTextMessage, renderException) import Hercules.Agent.Worker.Evaluate (runEval) -import Hercules.Agent.Worker.HerculesStore (setBuilderCallback, withHerculesStore) +import Hercules.Agent.Worker.HerculesStore (withHerculesStore) import Hercules.Agent.Worker.Logging (withKatip) import Hercules.Agent.WorkerProtocol.Command ( Command, @@ -147,7 +147,6 @@ drvOutputSubstituteAsyncs_ <- newTVarIO mempty drvsInProgress_ <- newIORef mempty withStore $ \wrappedStore_ -> withHerculesStore wrappedStore_ $ \herculesStore_ -> withKatip' do - liftIO $ setBuilderCallback herculesStore_ mempty let st = HerculesState { drvsCompleted = drvsCompleted_, diff --git a/hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Logger.hs b/hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Logger.hs --- a/hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Logger.hs +++ b/hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Logger.hs @@ -3,6 +3,9 @@ {-# LANGUAGE NumericUnderscores #-} {-# LANGUAGE QuasiQuotes #-} {-# LANGUAGE TemplateHaskell #-} +#ifdef __GHCIDE__ +# define NIX_IS_AT_LEAST(mm,m,p) 1 +#endif module Hercules.Agent.Worker.Build.Logger ( initLogger, @@ -45,15 +48,22 @@ C.using "namespace hercules_ci_cnix" +{- ORMOLU_DISABLE -} initLogger :: IO () initLogger = [C.throwBlock| void { +#if NIX_IS_AT_LEAST(2, 35, 0) + nix::logger = new HerculesLogger(); + herculesLogger = dynamic_cast(nix::logger); +#else nix::logger = std::make_unique(); herculesLogger = dynamic_cast(nix::logger.get()); +#endif if (herculesLogger == nullptr) { throw std::runtime_error("Failed to cast logger to HerculesLogger"); } }|] +{- ORMOLU_ENABLE -} popMany :: IO (Vector LogEntry) popMany = diff --git a/hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Prefetched.hs b/hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Prefetched.hs --- a/hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Prefetched.hs +++ b/hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Prefetched.hs @@ -312,8 +312,13 @@ success = successPtr != nullptr; if (failurePtr) { - printError(failurePtr->errorMsg); - errorMessage = stringdup(failurePtr->errorMsg); +#if NIX_IS_AT_LEAST(2, 34, 0) + const std::string & failureErrorMsg = failurePtr->msg(); +#else + const std::string & failureErrorMsg = failurePtr->errorMsg; +#endif + printError(failureErrorMsg); + errorMessage = stringdup(failureErrorMsg); } else { errorMessage = stringdup(""); } diff --git a/hercules-ci-agent-worker/Hercules/Agent/Worker/Evaluate.hs b/hercules-ci-agent-worker/Hercules/Agent/Worker/Evaluate.hs --- a/hercules-ci-agent-worker/Hercules/Agent/Worker/Evaluate.hs +++ b/hercules-ci-agent-worker/Hercules/Agent/Worker/Evaluate.hs @@ -177,7 +177,7 @@ isNonBlocking <- liftIO (newIORef False) - liftIO . setBuilderCallback hStore $ + builderCallback <- pure $ traverseSPWOs $ \storePathWithOutputs -> unlift $ do drvStorePath <- liftIO $ getStorePath storePathWithOutputs drvPath <- liftIO $ CNix.storePathToPath store drvStorePath @@ -232,6 +232,9 @@ maybeThrowBuildException result drvStorePath clearSubstituterCaches clearPathInfoCache store + -- The wrapped store caches negative path info lookups + -- independently; clear it so the built output is seen. + clearPathInfoCache (wrappedStore st) ensurePath (wrappedStore st) outputPath `catch` \(_e1 :: SomeException) -> do st.sendEvents $ pure $ Event.Build drvPath (decode outputName) (Just attempt0) doBlock @@ -246,6 +249,7 @@ maybeThrowBuildException result' drvStorePath clearSubstituterCaches clearPathInfoCache store + clearPathInfoCache (wrappedStore st) ensurePath (wrappedStore st) outputPath `catch` \e2 -> liftIO $ throwBuildError @@ -264,6 +268,7 @@ else void $ wait buildAsync withEvalStateConduit store $ \evalState -> do + liftIO $ setBuilderCallback hStore evalState builderCallback let evalEnv :: EvalEnv evalEnv = EvalEnv diff --git a/hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore.hs b/hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore.hs --- a/hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore.hs +++ b/hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore.hs @@ -1,6 +1,9 @@ {-# LANGUAGE CPP #-} {-# LANGUAGE QuasiQuotes #-} {-# LANGUAGE TemplateHaskell #-} +#ifdef __GHCIDE__ +# define NIX_IS_AT_LEAST(mm,m,p) 1 +#endif module Hercules.Agent.Worker.HerculesStore ( withHerculesStore, @@ -24,7 +27,7 @@ ) import Hercules.CNix.Encapsulation (moveToForeignPtrWrapper) import Hercules.CNix.Expr (Store (Store)) -import Hercules.CNix.Expr.Context (NixStorePathWithOutputs) +import Hercules.CNix.Expr.Context (EvalState, NixStorePathWithOutputs) import Hercules.CNix.Std.Vector (CStdVector, StdVector) import Hercules.CNix.Store.Context (Ref) import Language.C.Inline.Cpp qualified as C @@ -64,20 +67,38 @@ (*$(refHerculesStore* s))->printDiagnostics(); }|] +{- ORMOLU_DISABLE -} + -- TODO catch pure exceptions from displayException -setBuilderCallback :: Ptr (Ref HerculesStore) -> (StdVector NixStorePathWithOutputs -> IO ()) -> IO () -setBuilderCallback s callback = do + +-- | Set the callback that is invoked when the evaluator requests a build. +-- +-- The 'EvalState' is referenced by the exception the callback throws into +-- the evaluator: on Nix >= 2.34 the exception must be recoverable, so that +-- the interrupted attribute can be re-evaluated after its realisation +-- completes. It must remain valid for as long as the callback can be +-- invoked, i.e. for the duration of the evaluation. +setBuilderCallback :: Ptr (Ref HerculesStore) -> Ptr EvalState -> (StdVector NixStorePathWithOutputs -> IO ()) -> IO () +setBuilderCallback s evalState callback = do p <- mkBuilderCallback $ \sp exceptionToThrowPtr -> Control.Exception.catch (callback =<< moveToForeignPtrWrapper sp) $ \e -> withCString (displayException (e :: SomeException)) $ \renderedException -> do stablePtr <- castStablePtrToPtr <$> newStablePtr e [C.block| void { +#if NIX_IS_AT_LEAST(2, 34, 0) + nix::EvalState *evalState = $(EvalState *evalState); + assert(evalState); + (*$(exception_ptr *exceptionToThrowPtr)) = std::make_exception_ptr(HerculesBuilderException(*evalState, std::string($(const char* renderedException)), $(void* stablePtr))); +#else + (void) $(EvalState *evalState); (*$(exception_ptr *exceptionToThrowPtr)) = std::make_exception_ptr(HaskellException(std::string($(const char* renderedException)), $(void* stablePtr))); +#endif }|] [C.throwBlock| void { (*$(refHerculesStore* s))->setBuilderCallback($(void (*p)(std::vector*, exception_ptr *))); }|] +{- ORMOLU_ENABLE -} type BuilderCallback = Ptr (CStdVector NixStorePathWithOutputs) -> Ptr ExceptionPtr -> IO () diff --git a/hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore/Context.hs b/hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore/Context.hs --- a/hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore/Context.hs +++ b/hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore/Context.hs @@ -10,7 +10,7 @@ where import Data.Map qualified as M -import Hercules.CNix.Expr.Context (Ref) +import Hercules.CNix.Expr.Context (Ref, evalContext) import Hercules.CNix.Std.Vector (stdVectorCtx) import Hercules.CNix.Store.Context qualified as Store import Language.C.Inline.Context qualified as C @@ -29,6 +29,7 @@ <> C.bsCtx <> stdVectorCtx <> Store.context + <> evalContext <> herculesStoreContext (=:) :: k -> a -> Map k a diff --git a/hercules-ci-agent.cabal b/hercules-ci-agent.cabal --- a/hercules-ci-agent.cabal +++ b/hercules-ci-agent.cabal @@ -1,7 +1,7 @@ cabal-version: 2.4 name: hercules-ci-agent -version: 0.10.8 +version: 0.10.9 synopsis: Runs Continuous Integration tasks on your machines category: Nix, CI, Testing, DevOps homepage: https://docs.hercules-ci.com @@ -398,11 +398,11 @@ , uuid , vector pkgconfig-depends: - nix-store >= 2.28 && < 2.34 - , nix-expr >= 2.28 && < 2.34 - , nix-flake >= 2.28 && < 2.34 + nix-store >= 2.28 && < 2.36 + , nix-expr >= 2.28 && < 2.36 + , nix-flake >= 2.28 && < 2.36 -- TODO: replace stack overflow detection and remove nix-main - , nix-main >= 2.28 && < 2.34 + , nix-main >= 2.28 && < 2.36 default-language: Haskell2010 test-suite hercules-ci-agent-unit-tests @@ -493,5 +493,5 @@ main-is: hercules-ci-nix-daemon/daemon.cxx default-language: Haskell2010 pkgconfig-depends: - nix-store >= 2.28 && < 2.34 - , nix-main >= 2.28 && < 2.34 + nix-store >= 2.28 && < 2.36 + , nix-main >= 2.28 && < 2.36