chore(nix): nixpkgs d407951 → 148bab9c — go_1_26 1.26.4 → 1.26.5 (GO-2026-4970, GO-2026-5856) #258

Merged

dominik.polakovics merged 2 commits from afk/257 into main 2026-08-02 05:26:03 +02:00

Conversation 4 Commits 2 Files changed 3 +6 -6

dominik.polakovics commented 2026-08-02 04:42:22 +02:00

Owner

Copy link

Closes #257

What moved

nix flake update nixpkgs (not hand-edited): the single nixpkgs input goes from
d407951447dcd00442e97087bf374aad70c04cea (nixos-unstable, 2026-07-05) to
148bab9c1c3c53136ecb44a6ea356a0ed5b39b06 (nixos-unstable, 2026-08-01).
The flake.lock diff touches only that node.

Verified at the new rev with nix eval --raw:

attr	locked (old)	new	consequence
go_1_26	1.26.4	1.26.5	stdlib fixes for GO-2026-4970 (os.Root symlink escape) and GO-2026-5856 (crypto/tls ECH privacy leak)
golangci-lint	2.12.2	2.12.2 (unchanged)	ci.yml pin stands
nodejs	24.x	24.18.1 (unchanged major)	ci.yml node-version: "24" stands

Neither advisory is reachable from this repo (re-checked: no os.Root/OpenRoot, no crypto/tls import or ECH config anywhere under internal/ or cmd/) — this is toolchain hygiene per the issue, not an incident.

Doc/CI text kept in step

• docs/ops.md nixpkgs pin paragraph records the new rev (its own "record pin changes here" instruction).
• The two ci.yml comments citing the rev the pins were checked against (d407951…) now cite 148bab9…. The pins themselves are untouched — both versions are unchanged at the new rev.
• docs/ops.md §CI runner prerequisites needed no change (it names versions relative to "the current flake.lock", both unchanged).

Verification

• nix flake check passes at the new lock: all six x86_64-linux checks built — lab (full go test ./... checkPhase: 47 packages ok, with real git/tmux/prlimit), labctl, web (vitest 66/66 files, 975/975 tests), golangci-lint, nixos-module, nixos-container-closure (full toplevel). Environment note: this run's container cannot use nix's build sandbox (masked /proc blocks nested namespaces — "Mount too revealing"), so the local check ran unsandboxed; the ci-nix gate on this PR is the authoritative sandboxed run.
• govulncheck ./... under the new 1.26.5 toolchain: the two stdlib advisories no longer appear. The remaining reachable finding is GO-2026-5970 (golang.org/x/text v0.38.0, via store.Open → sql.Open) — a Go module dependency, already tracked as #250's headline item; out of scope here per the issue.

No changes under internal/, cmd/, or web/. vendorHash and importNpmLock are unaffected by this bump (functions of go.sum / package-lock.json, both untouched).

🤖 Generated with Claude Code

Closes #257 ## What moved `nix flake update nixpkgs` (not hand-edited): the single `nixpkgs` input goes from `d407951447dcd00442e97087bf374aad70c04cea` (nixos-unstable, 2026-07-05) to `148bab9c1c3c53136ecb44a6ea356a0ed5b39b06` (nixos-unstable, 2026-08-01). The `flake.lock` diff touches only that node. Verified at the new rev with `nix eval --raw`: | attr | locked (old) | new | consequence | |---|---|---|---| | `go_1_26` | 1.26.4 | **1.26.5** | stdlib fixes for GO-2026-4970 (`os.Root` symlink escape) and GO-2026-5856 (`crypto/tls` ECH privacy leak) | | `golangci-lint` | 2.12.2 | **2.12.2** (unchanged) | ci.yml pin stands | | `nodejs` | 24.x | **24.18.1** (unchanged major) | ci.yml `node-version: "24"` stands | Neither advisory is reachable from this repo (re-checked: no `os.Root`/`OpenRoot`, no `crypto/tls` import or ECH config anywhere under `internal/` or `cmd/`) — this is toolchain hygiene per the issue, not an incident. ## Doc/CI text kept in step - `docs/ops.md` **nixpkgs pin** paragraph records the new rev (its own "record pin changes here" instruction). - The two `ci.yml` comments citing the rev the pins were checked against (`d407951…`) now cite `148bab9…`. The pins themselves are untouched — both versions are unchanged at the new rev. - `docs/ops.md` §CI runner prerequisites needed no change (it names versions relative to "the current flake.lock", both unchanged). ## Verification - `nix flake check` passes at the new lock: all six x86_64-linux checks built — `lab` (full `go test ./...` checkPhase: 47 packages ok, with real git/tmux/prlimit), `labctl`, `web` (vitest 66/66 files, 975/975 tests), `golangci-lint`, `nixos-module`, `nixos-container-closure` (full toplevel). Environment note: this run's container cannot use nix's build sandbox (masked `/proc` blocks nested namespaces — "Mount too revealing"), so the local check ran unsandboxed; the `ci-nix` gate on this PR is the authoritative sandboxed run. - `govulncheck ./...` under the new 1.26.5 toolchain: the two stdlib advisories no longer appear. The remaining reachable finding is GO-2026-5970 (`golang.org/x/text` v0.38.0, via `store.Open → sql.Open`) — a Go module dependency, already tracked as #250's headline item; out of scope here per the issue. No changes under `internal/`, `cmd/`, or `web/`. `vendorHash` and `importNpmLock` are unaffected by this bump (functions of `go.sum` / `package-lock.json`, both untouched). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit 2026-08-02 04:42:22 +02:00

chore(nix): nixpkgs d407951 → 148bab9c — go_1_26 1.26.4 → 1.26.5 ... bbc7f99933

Move the nixpkgs flake input forward via `nix flake update nixpkgs`:
nixos-unstable d407951447dc (2026-07-05) → 148bab9c1c3c (2026-08-01).
Only the nixpkgs node changes in flake.lock.

go_1_26 moves 1.26.4 → 1.26.5, picking up the stdlib fixes for
GO-2026-4970 (os.Root symlink escape) and GO-2026-5856 (crypto/tls ECH
privacy leak). Neither is reachable from this repo (no os.Root/OpenRoot
use, no crypto/tls import) — this is toolchain hygiene, not an incident.

golangci-lint (2.12.2) and nodejs (24.18.1, still Node 24) are unchanged
at the new rev, so the native gate's pins stand; only the rev citations
in the ci.yml comments and the ops.md nixpkgs-pin record move, per the
latter's "record pin changes here".

Closes #257

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics referenced this pull request 2026-08-02 04:56:17 +02:00

labctl pr logs: Forgejo log adapter 500s on retried runs (attempt/2), blocking lander validation #259

dominik.polakovics commented 2026-08-02 04:56:43 +02:00

Author

Owner

Copy link

[autoland] verdict: reject

Verdict: FAIL — blocked on red checks that never produced a failure

Signal relied on: labctl pr checks 258 --wait → aggregate failure (exit 2), both rows red:

ci / native (pull_request)        failure   Failing after 11m42s   runs/353/jobs/0
ci-nix / flake-check (pull_request) failure  Failing after 11m43s   runs/352/jobs/0

Nothing vouches for this head, so it cannot land. But the red is not in this diff — read the rest before touching a file.

The content review is clean

Diff is 3 files / 6 lines, and matches #257's stated scope exactly:

• flake.lock:5-12 — only the nixpkgs node moves (d407951… → 148bab9c…, lastModified/narHash/rev). No other node, no hand-edit signature.
• docs/ops.md:86 — records the new rev, per that paragraph's own "Record pin changes here" instruction.
• .forgejo/workflows/ci.yml:15 and :83 — the two comments citing the rev the pins were checked against now cite 148bab9…. The pins themselves (node-version: "24", golangci-lint v2.12.2) are untouched, which is correct per the issue's table.
• Nothing under internal/, cmd/, or web/, as #257 requires.

Conventions all met: Conventional Commits title (chore(nix): …), body carries Closes #257, diff scope matches the linked issue with no drive-bys. The ci-nix gate is path-gated to nix/dependency changes and did trigger here, so the expensive gate had the right reach for this diff.

Why the red is infra, not code

labctl pr logs 258 cannot serve these logs at all (filed as #259 — the adapter 500s on attempt/2). Pulling the forge web routes directly, attempt/1 logs exist and contain no error whatsoever:

• runs/353 (native), 253 lines, last line at 02:43:47.958:
  > lab-web@0.1.0 test / > vitest run — the suite had not yet emitted a single result. Everything before it green: npm ci (0 vulnerabilities), eslint, prettier --check → "All matched files use Prettier code style!"
• runs/352 (nix), 170 lines, last line at 02:43:35.576:
  evaluating 'checks.x86_64-linux.nixos-container-closure' — evaluation proceeding normally, with ✅ nixosModules.default, ✅ nixosModules.lab, ✅ devShells.x86_64-linux.default, ✅ packages.x86_64-linux.{lab,labctl,web,default} already recorded.

Grepping both logs for error|failed|failure|panic|##[error] returns nothing.

Both logs simply stop, ~75 seconds into jobs later marked "Failing after 11m42s/11m43s" — i.e. log streaming died roughly 10 minutes before the jobs were reaped. The two stop within 12s of each other despite being structurally unrelated pipelines. attempt/2 logs 500 on both. And the forge was returning dial tcp 10.42.97.55:443: connect: connection refused and then 502 Bad Gateway to this lander during that same window.

That is a runner/forge outage, not a test or build failure.

What to do

Do not change the diff. There is no identified defect in it to fix.

1. Re-run both checks on this head (ci / native, ci-nix / flake-check).
2. If they go green, this is a clean PASS — approve and merge as-is.
3. If either goes red with an actual error this time, that error is the real finding: report it on #257 per its "report it here with the actual error rather than pinning around it" instruction. #257 flags the realistic breakage modes — nixos-container-closure toplevel and the lab derivation's go test checkPhase against moved git/tmux.

I could not settle this locally: this lander's container has no nix, go, or node, so neither gate is reproducible here.

[autoland] verdict: reject ## Verdict: FAIL — blocked on red checks that never produced a failure **Signal relied on:** `labctl pr checks 258 --wait` → aggregate **`failure`** (exit 2), both rows red: ``` ci / native (pull_request) failure Failing after 11m42s runs/353/jobs/0 ci-nix / flake-check (pull_request) failure Failing after 11m43s runs/352/jobs/0 ``` Nothing vouches for this head, so it cannot land. **But the red is not in this diff** — read the rest before touching a file. ## The content review is clean Diff is 3 files / 6 lines, and matches #257's stated scope exactly: - `flake.lock:5-12` — only the `nixpkgs` node moves (`d407951…` → `148bab9c…`, `lastModified`/`narHash`/`rev`). No other node, no hand-edit signature. - `docs/ops.md:86` — records the new rev, per that paragraph's own "Record pin changes here" instruction. - `.forgejo/workflows/ci.yml:15` and `:83` — the two comments citing the rev the pins were checked against now cite `148bab9…`. The pins themselves (`node-version: "24"`, `golangci-lint v2.12.2`) are untouched, which is correct per the issue's table. - Nothing under `internal/`, `cmd/`, or `web/`, as #257 requires. Conventions all met: Conventional Commits title (`chore(nix): …`), body carries `Closes #257`, diff scope matches the linked issue with no drive-bys. The `ci-nix` gate is path-gated to nix/dependency changes and **did** trigger here, so the expensive gate had the right reach for this diff. ## Why the red is infra, not code `labctl pr logs 258` cannot serve these logs at all (filed as #259 — the adapter 500s on `attempt/2`). Pulling the forge web routes directly, **`attempt/1` logs exist and contain no error whatsoever**: - `runs/353` (native), 253 lines, last line at `02:43:47.958`: `> lab-web@0.1.0 test` / `> vitest run` — the suite had not yet emitted a single result. Everything before it green: `npm ci` (0 vulnerabilities), `eslint`, `prettier --check` → *"All matched files use Prettier code style!"* - `runs/352` (nix), 170 lines, last line at `02:43:35.576`: `evaluating 'checks.x86_64-linux.nixos-container-closure'` — evaluation proceeding normally, with `✅ nixosModules.default`, `✅ nixosModules.lab`, `✅ devShells.x86_64-linux.default`, `✅ packages.x86_64-linux.{lab,labctl,web,default}` already recorded. Grepping both logs for `error|failed|failure|panic|##[error]` returns **nothing**. Both logs simply stop, ~75 seconds into jobs later marked *"Failing after 11m42s/11m43s"* — i.e. log streaming died roughly **10 minutes before** the jobs were reaped. The two stop within 12s of each other despite being structurally unrelated pipelines. `attempt/2` logs 500 on both. And the forge was returning `dial tcp 10.42.97.55:443: connect: connection refused` and then `502 Bad Gateway` to this lander during that same window. That is a runner/forge outage, not a test or build failure. ## What to do **Do not change the diff.** There is no identified defect in it to fix. 1. Re-run both checks on this head (`ci / native`, `ci-nix / flake-check`). 2. If they go green, this is a clean `PASS` — approve and merge as-is. 3. If either goes red *with an actual error this time*, that error is the real finding: report it on #257 per its "report it here with the actual error rather than pinning around it" instruction. #257 flags the realistic breakage modes — `nixos-container-closure` toplevel and the `lab` derivation's `go test` checkPhase against moved git/tmux. I could not settle this locally: this lander's container has no `nix`, `go`, or `node`, so neither gate is reproducible here.

dominik.polakovics referenced this pull request from a commit 2026-08-02 05:00:26 +02:00

chore(ci): retrigger checks after runner outage

dominik.polakovics added 1 commit 2026-08-02 05:00:26 +02:00

chore(ci): retrigger checks after runner outage ... 84f8fc58a3

Both PR checks (ci / native, ci-nix / flake-check) were reaped mid-run
on 2026-08-02 ~02:43Z when the runner/forge went down: attempt/1 logs
stop without any error (native mid-vitest-startup, nix mid-evaluation,
within 12s of each other) and attempt/2 served no logs at all. See the
rejection review on PR #258. Empty commit — the reviewed diff is
unchanged; this only re-fires the pull_request workflows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics commented 2026-08-02 05:22:17 +02:00

Author

Owner

Copy link

Fix round: no diff change — per the rejection review, both reds were a runner/forge outage (attempt/1 logs stop mid-run with zero error output, within 12s of each other; attempt/2 served no logs). The forge's rerun routes are session-auth only and labctl has no rerun command, so CI was retriggered with an empty commit (84f8fc5); the reviewed diff vs main is byte-identical to what was already reviewed clean.

Both checks are now green on this head: ci / native in 9m37s (run 355), ci-nix / flake-check in 21m8s (run 354).

Fix round: no diff change — per the rejection review, both reds were a runner/forge outage (attempt/1 logs stop mid-run with zero error output, within 12s of each other; attempt/2 served no logs). The forge's rerun routes are session-auth only and labctl has no rerun command, so CI was retriggered with an empty commit (`84f8fc5`); the reviewed diff vs main is byte-identical to what was already reviewed clean. Both checks are now green on this head: `ci / native` in 9m37s (run 355), `ci-nix / flake-check` in 21m8s (run 354).

dominik.polakovics commented 2026-08-02 05:22:21 +02:00

Author

Owner

Copy link

[autoland] verdict: fix-done

[autoland] verdict: fix-done

dominik.polakovics commented 2026-08-02 05:25:59 +02:00

Author

Owner

Copy link

[autoland] verdict: pass

[autoland] verdict: pass

dominik.polakovics merged commit 692d8bbf85 into main 2026-08-02 05:26:03 +02:00

dominik.polakovics referenced this pull request from a commit 2026-08-02 05:26:04 +02:00

Merge pull request 'chore(nix): nixpkgs d407951 → 148bab9c — go_1_26 1.26.4 → 1.26.5 (GO-2026-4970, GO-2026-5856)' (#258) from afk/257 into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is broken

  

chore

  

enhancement

New feature or improvement

  

needs-info

Waiting on reporter for more information

  

needs-triage

Maintainer needs to evaluate this issue

  

ready-for-agent

Fully specified, ready for an AFK agent

  

ready-for-human

Requires human implementation

  

wontfix

Will not be actioned

No labels

bug

chore

enhancement

needs-info

needs-triage

ready-for-agent

ready-for-human

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Cloonar/coding-lab!258

No description provided.