What the developer wrote
Authored by Christian Decker
ci: Remove nix check
It was breaking a lot, due to Cargo dependencies not being published,
no surprise there, we are just publishing them with the changes it is
complaining about.
What changed, and why it matters
This commit removes a Nix flake validation job from the project's continuous integration (CI) workflow. The change only affects GitHub Actions configuration and does not modify any application code, cryptographic logic, network handling, or user-facing behavior. It is a build/maintenance change, not a security fix or vulnerability.
No security action required. Monitor that the removed CI check is replaced or re-enabled once Cargo dependencies are published, if Nix flake integrity remains a project priority.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit deletes the check-flake job from .github/workflows/ci.yaml and removes its dependency from the gather job. The stated reason is that the Nix flake check was frequently failing because Cargo dependencies had not yet been published, while the project was in the process of publishing them. No source code, tests, dependencies, or runtime configuration were changed.
Changed components
.github/workflows/ci.yamlInspect captured patch +1 / −22
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d635abbd..5d3b5d25 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -594,25 +594,6 @@ jobs:
cat config.vars
VALGRIND=0 uv run eatmydata pytest tests/ -vvv -n ${PYTEST_PAR} ${PYTEST_OPTS}
- check-flake:
- name: Check Nix Flake
- runs-on: ubuntu-22.04
- strategy:
- fail-fast: true
- steps:
- - name: Checkout
- uses: actions/checkout@v4
- with:
- submodules: "recursive"
- - name: Check Nix flake inputs
- uses: DeterminateSystems/flake-checker-action@v12
- - name: Install Nix
- uses: cachix/install-nix-action@V31
- with:
- nix_path: nixpkgs=channel:nixos-25.05
- - name: Check flake
- run: nix flake check .?submodules=1#
-
gather:
# A dummy task that depends on the full matrix of tests, and
# signals successful completion. Used for the PR status to pass
@@ -625,19 +606,17 @@ jobs:
- integration-valgrind
- integration-sanitizers
- min-btc-support
- - check-flake
if: ${{ always() }}
steps:
- name: Complete
env:
- JOB_NAMES: "INTEGRATION CHECK_UNITS VALGRIND SANITIZERS BTC FLAKE"
+ JOB_NAMES: "INTEGRATION CHECK_UNITS VALGRIND SANITIZERS BTC"
INTEGRATION: ${{ needs.integration.result }}
CHECK_UNITS: ${{ needs['check-units'].result }}
VALGRIND: ${{ needs['integration-valgrind'].result }}
SANITIZERS: ${{ needs['integration-sanitizers'].result }}
DOCS: ${{ needs['update-docs-examples'].result }}
BTC: ${{ needs['min-btc-support'].result }}
- FLAKE: ${{ needs['check-flake'].result }}
run: |
failed=""
for name in $JOB_NAMES; do
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.