1this derivation will be built:2 /nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv3building '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv' on 'ssh-ng://nix@eliza'4building '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv'5treefmt-check> treefmt v2.5.0traversed 111 files6treefmt-check> emitted 100 files for processing7treefmt-check> formatted 100 files (6 changed) in 12.681s8treefmt-check> M README.md9treefmt-check> M docs/_static/field-lists.css10treefmt-check> M docs/guides/binary-caches.md11treefmt-check> M docs/guides/gitea.md12treefmt-check> M docs/guides/github.md13treefmt-check> M docs/guides/using.md14treefmt-check> diff --git a/README.md b/README.md15treefmt-check> index d262262..6dd1b01 10064416treefmt-check> --- a/README.md17treefmt-check> +++ b/README.md18treefmt-check> @@ -25,8 +25,7 @@ time.19treefmt-check> 20treefmt-check> ## Getting Started with Buildbot Setup21treefmt-check> 22treefmt-check> -To set up Buildbot using Buildbot-nix,23treefmt-check> -read the [documentation].24treefmt-check> +To set up Buildbot using Buildbot-nix, read the [documentation].25treefmt-check> 26treefmt-check> ## Incompatibilities with the lix overlay27treefmt-check> 28treefmt-check> @@ -80,4 +79,4 @@ We have a matrix channel at29treefmt-check> For commercial support, please contact [Mic92](https://github.com/Mic92/) at30treefmt-check> joerg@thalheim.io or reach out to [Numtide](https://numtide.com/contact/).31treefmt-check> 32treefmt-check> - [documentation]: https://buildbot-nix.readthedocs.io/en/stable/33treefmt-check> +[documentation]: https://buildbot-nix.readthedocs.io/en/stable/34treefmt-check> diff --git a/docs/_static/field-lists.css b/docs/_static/field-lists.css35treefmt-check> index 55afe4f..58974f2 10064436treefmt-check> --- a/docs/_static/field-lists.css37treefmt-check> +++ b/docs/_static/field-lists.css38treefmt-check> @@ -10,29 +10,29 @@ dl.field-list {39treefmt-check> }40treefmt-check> 41treefmt-check> dl.field-list > dt {42treefmt-check> - /*font-weight: bold;*/43treefmt-check> - word-break: break-word;44treefmt-check> - margin-top: 0em;45treefmt-check> - padding-left: 0.5em;46treefmt-check> - padding-right: 5px;47treefmt-check> - font-size: var(--font-size--normal) !important;48treefmt-check> + /*font-weight: bold;*/49treefmt-check> + word-break: break-word;50treefmt-check> + margin-top: 0em;51treefmt-check> + padding-left: 0.5em;52treefmt-check> + padding-right: 5px;53treefmt-check> + font-size: var(--font-size--normal) !important;54treefmt-check> }55treefmt-check> 56treefmt-check> dl.field-list > dd > :first-child {57treefmt-check> - margin-top: 0 !important;58treefmt-check> + margin-top: 0 !important;59treefmt-check> }60treefmt-check> 61treefmt-check> dl.field-list > dd > :last-child {62treefmt-check> - margin-bottom: 0 !important;63treefmt-check> + margin-bottom: 0 !important;64treefmt-check> }65treefmt-check> 66treefmt-check> dl.field-list > dd {67treefmt-check> - padding-left: 0.5em;68treefmt-check> - margin-top: 0em;69treefmt-check> - margin-left: 0em;70treefmt-check> - margin-bottom: .25em;71treefmt-check> + padding-left: 0.5em;72treefmt-check> + margin-top: 0em;73treefmt-check> + margin-left: 0em;74treefmt-check> + margin-bottom: 0.25em;75treefmt-check> }76treefmt-check> 77treefmt-check> dl.field-list > dd a {78treefmt-check> - overflow-wrap: anywhere;79treefmt-check> + overflow-wrap: anywhere;80treefmt-check> }81treefmt-check> diff --git a/docs/guides/binary-caches.md b/docs/guides/binary-caches.md82treefmt-check> index 3af9293..a9aea63 10064483treefmt-check> --- a/docs/guides/binary-caches.md84treefmt-check> +++ b/docs/guides/binary-caches.md85treefmt-check> @@ -24,4 +24,3 @@ integrate run a systemd service as described in86treefmt-check> [this example configuration](../../examples/attic-watch-store.nix). The systemd87treefmt-check> service watches for changes in the local buildbot-nix store and uploads the88treefmt-check> contents to the attic cache.89treefmt-check> -90treefmt-check> diff --git a/docs/guides/gitea.md b/docs/guides/gitea.md91treefmt-check> index 7315054..22d6bbd 10064492treefmt-check> --- a/docs/guides/gitea.md93treefmt-check> +++ b/docs/guides/gitea.md94treefmt-check> @@ -22,8 +22,10 @@ status updates, and secure authentication.95treefmt-check> 96treefmt-check> 1. **Create an OAuth2 Application**:97treefmt-check> - Navigate to one of these locations:98treefmt-check> - - {menuselection}`Site Administration --> Applications` (for admins, applies globally)99treefmt-check> - - {menuselection}`Organization Settings --> Applications` (for organization-wide access)100treefmt-check> + - {menuselection}`Site Administration --> Applications` (for admins,101treefmt-check> + applies globally)102treefmt-check> + - {menuselection}`Organization Settings --> Applications` (for103treefmt-check> + organization-wide access)104treefmt-check> - {menuselection}`User Settings --> Applications` (for personal use)105treefmt-check> 106treefmt-check> 2. **Configure the OAuth2 app**:107treefmt-check> diff --git a/docs/guides/github.md b/docs/guides/github.md108treefmt-check> index 073cc17..dbe1ad7 100644109treefmt-check> --- a/docs/guides/github.md110treefmt-check> +++ b/docs/guides/github.md111treefmt-check> @@ -69,8 +69,8 @@ definitions:112treefmt-check> ]113treefmt-check> ```114treefmt-check> 115treefmt-check> -- `name`: The worker name (matches {nix:option}`services.buildbot-nix.worker.name`, defaults116treefmt-check> - to hostname)117treefmt-check> +- `name`: The worker name (matches118treefmt-check> + {nix:option}`services.buildbot-nix.worker.name`, defaults to hostname)119treefmt-check> - `pass`: The password (must match120treefmt-check> {nix:option}`services.buildbot-nix.worker.workerPasswordFile` contents)121treefmt-check> - `cores`: Number of CPU cores (must match the actual core count of the worker122treefmt-check> @@ -99,34 +99,32 @@ For each repository you want to build:123treefmt-check> 124treefmt-check> ## How It Works125treefmt-check> 126treefmt-check> -Authentication:127treefmt-check> -: Uses GitHub App JWT tokens for API access and installation tokens for128treefmt-check> - repository-specific operations129treefmt-check> +Authentication: : Uses GitHub App JWT tokens for API access and installation130treefmt-check> +tokens for repository-specific operations131treefmt-check> 132treefmt-check> -Project Discovery:133treefmt-check> -: Automatically discovers repositories the app has access to, filtered by topic134treefmt-check> - if configured135treefmt-check> +Project Discovery: : Automatically discovers repositories the app has access to,136treefmt-check> +filtered by topic if configured137treefmt-check> 138treefmt-check> -Webhook Management:139treefmt-check> -: Automatically creates and manages webhooks for push and pull_request events140treefmt-check> +Webhook Management: : Automatically creates and manages webhooks for push and141treefmt-check> +pull_request events142treefmt-check> 143treefmt-check> -Status Updates:144treefmt-check> -: Reports build status back to GitHub commits and pull requests145treefmt-check> +Status Updates: : Reports build status back to GitHub commits and pull requests146treefmt-check> 147treefmt-check> -Access Control:148treefmt-check> -: - Admins: Configured users can reload projects and manage builds149treefmt-check> - - Organization members: Can restart their own builds150treefmt-check> +Access Control: : - Admins: Configured users can reload projects and manage151treefmt-check> +builds152treefmt-check> +153treefmt-check> +- Organization members: Can restart their own builds154treefmt-check> 155treefmt-check> ## Troubleshooting156treefmt-check> 157treefmt-check> -Projects not appearing:158treefmt-check> -: Check that:159treefmt-check> - - The GitHub App is installed for the repository160treefmt-check> - - The repository has the configured topic (if filtering by topic)161treefmt-check> - - Reload projects manually through the Buildbot UI162treefmt-check> +Projects not appearing: : Check that:163treefmt-check> +164treefmt-check> +- The GitHub App is installed for the repository165treefmt-check> +- The repository has the configured topic (if filtering by topic)166treefmt-check> +- Reload projects manually through the Buildbot UI167treefmt-check> 168treefmt-check> -Webhooks not created:169treefmt-check> -: Verify the app has webhook write permission for the repository170treefmt-check> +Webhooks not created: : Verify the app has webhook write permission for the171treefmt-check> +repository172treefmt-check> 173treefmt-check> -Authentication issues:174treefmt-check> -: Ensure the private key file is readable by the buildbot service175treefmt-check> +Authentication issues: : Ensure the private key file is readable by the buildbot176treefmt-check> +service177treefmt-check> diff --git a/docs/guides/using.md b/docs/guides/using.md178treefmt-check> index 2cd051e..c2fd3cd 100644179treefmt-check> --- a/docs/guides/using.md180treefmt-check> +++ b/docs/guides/using.md181treefmt-check> @@ -37,24 +37,20 @@ information natively as now.182treefmt-check> ### Public183treefmt-check> 184treefmt-check> For some actions a login is required. The authentication backend is set by the185treefmt-check> -{nix:option}`services.buildbot-nix.master.authBackend` NixOS option ("github", "gitea",186treefmt-check> -"oidc", or others).187treefmt-check> +{nix:option}`services.buildbot-nix.master.authBackend` NixOS option ("github",188treefmt-check> +"gitea", "oidc", or others).189treefmt-check> 190treefmt-check> -:::{note}191treefmt-check> -You can configure both GitHub and Gitea integrations simultaneously,192treefmt-check> +:::{note} You can configure both GitHub and Gitea integrations simultaneously,193treefmt-check> regardless of which authentication backend you choose. The auth backend only194treefmt-check> -determines how users log in to the Buildbot interface.195treefmt-check> -:::196treefmt-check> +determines how users log in to the Buildbot interface. :::197treefmt-check> 198treefmt-check> We have the following two roles:199treefmt-check> 200treefmt-check> -Admins:201treefmt-check> -: - The list of admin usernames is hard-coded in the NixOS configuration.202treefmt-check> -: - admins can reload the project list203treefmt-check> +Admins: : - The list of admin usernames is hard-coded in the NixOS204treefmt-check> +configuration. : - admins can reload the project list205treefmt-check> 206treefmt-check> -Organisation member:207treefmt-check> -: - All member of the organisation where this repository is located208treefmt-check> -: - They can restart builds209treefmt-check> +Organisation member: : - All member of the organisation where this repository is210treefmt-check> +located : - They can restart builds211treefmt-check> 212treefmt-check> #### GitHub Integration213treefmt-check> 214treefmt-check> @@ -83,17 +79,17 @@ See {doc}`oidc` for configuration details.215treefmt-check> ### Fully Private216treefmt-check> 217treefmt-check> To enable fully private mode, set218treefmt-check> -{nix:option}`services.buildbot-nix.master.accessMode.fullyPrivate` to an219treefmt-check> -attrset containing the required options for fully private use, refer to the220treefmt-check> -examples and module implementation (`nix/master.nix`).221treefmt-check> +{nix:option}`services.buildbot-nix.master.accessMode.fullyPrivate` to an attrset222treefmt-check> +containing the required options for fully private use, refer to the examples and223treefmt-check> +module implementation (`nix/master.nix`).224treefmt-check> 225treefmt-check> This access mode honors the `admins` option in addition to the226treefmt-check> {nix:option}`services.buildbot-nix.master.accessMode.fullyPrivate.organisations`227treefmt-check> option. To allow access from certain organisations, you must explicitly list228treefmt-check> them.229treefmt-check> 230treefmt-check> -If you've set {nix:option}`services.buildbot-nix.master.authBackend`231treefmt-check> -previously, unset it, or you will get an error about a conflicting definitions.232treefmt-check> +If you've set {nix:option}`services.buildbot-nix.master.authBackend` previously,233treefmt-check> +unset it, or you will get an error about a conflicting definitions.234treefmt-check> `fullyPrivate` requires the `authBackend` to be set to `basichttpauth` to235treefmt-check> function (this is handled by the module, which is why you can leave it unset).236treefmt-check> For a concrete example please refer to237treefmt-check> @@ -106,59 +102,42 @@ root of whichever branch it's currently evaluating, parse it as TOML and apply238treefmt-check> the configuration specified. The following table illustrates the supported239treefmt-check> options.240treefmt-check> 241treefmt-check> -:::{confval} lock_file242treefmt-check> -:type: `str`243treefmt-check> -:default: `flake.lock`244treefmt-check> +:::{confval} lock_file :type: `str` :default: `flake.lock`245treefmt-check> 246treefmt-check> Dictates which lock file `buildbot-nix` will use when evaluating your flake.247treefmt-check> 248treefmt-check> -:example:249treefmt-check> - have multiple lockfiles, one for nixpkgs-stable, one for nixpkgs-unstable or250treefmt-check> - by default pin an input to a private repo, but have a lockfile with that251treefmt-check> - private repo replaced by a public repo for CI252treefmt-check> -:::253treefmt-check> +:example: have multiple lockfiles, one for nixpkgs-stable, one for254treefmt-check> +nixpkgs-unstable or by default pin an input to a private repo, but have a255treefmt-check> +lockfile with that private repo replaced by a public repo for CI :::256treefmt-check> 257treefmt-check> -:::{confval} attribute258treefmt-check> -:type: `str`259treefmt-check> -:default: `checks`260treefmt-check> +:::{confval} attribute :type: `str` :default: `checks`261treefmt-check> 262treefmt-check> Which attribute in the flake to evaluate and build.263treefmt-check> 264treefmt-check> -:example: using a different attribute, like `hydraJobs`265treefmt-check> -:::266treefmt-check> +:example: using a different attribute, like `hydraJobs` :::267treefmt-check> 268treefmt-check> -:::{confval} flake_dir269treefmt-check> -:type: `str`270treefmt-check> -:default: `.`271treefmt-check> -Which directory the flake is located.272treefmt-check> +:::{confval} flake_dir :type: `str` :default: `.` Which directory the flake is273treefmt-check> +located.274treefmt-check> 275treefmt-check> -:example: using a different flake, like `./tests`276treefmt-check> -:::277treefmt-check> +:example: using a different flake, like `./tests` :::278treefmt-check> 279treefmt-check> -:::{confval} effects_on_pull_requests280treefmt-check> -:type: `bool`281treefmt-check> -:default: `false`282treefmt-check> +:::{confval} effects_on_pull_requests :type: `bool` :default: `false`283treefmt-check> 284treefmt-check> -Run hercules-ci effects on pull requests.285treefmt-check> -:::286treefmt-check> +Run hercules-ci effects on pull requests. :::287treefmt-check> 288treefmt-check> -:::{confval} effects_branches289treefmt-check> -:type: `list[str]`290treefmt-check> -:default: `[]`291treefmt-check> +:::{confval} effects_branches :type: `list[str]` :default: `[]`292treefmt-check> 293treefmt-check> Glob patterns for additional branches that run effects294treefmt-check> 295treefmt-check> -:example: `["staging", "release/*"]`296treefmt-check> -:::297treefmt-check> +:example: `["staging", "release/*"]` :::298treefmt-check> 299treefmt-check> By default, effects only run on the default branch. The300treefmt-check> -{confval}`effects_branches` and {confval}`effects_on_pull_requests` settings301treefmt-check> -are always read from the **default branch's** `buildbot-nix.toml` (via `git302treefmt-check> -show`) so that pull request authors cannot grant themselves effects access.303treefmt-check> -304treefmt-check> -:::{caution}305treefmt-check> -PR effects receive the same `effects_per_repo_secrets` as default-branch306treefmt-check> -effects. A malicious PR can modify the effect code to exfiltrate these secrets.307treefmt-check> -Only enable {confval}`effects_on_pull_requests` for repositories where you308treefmt-check> -trust all contributors, or where no secrets are configured.309treefmt-check> -:::310treefmt-check> +{confval}`effects_branches` and {confval}`effects_on_pull_requests` settings are311treefmt-check> +always read from the **default branch's** `buildbot-nix.toml` (via `git312treefmt-check> +show`)313treefmt-check> +so that pull request authors cannot grant themselves effects access.314treefmt-check> +315treefmt-check> +:::{caution} PR effects receive the same `effects_per_repo_secrets` as316treefmt-check> +default-branch effects. A malicious PR can modify the effect code to exfiltrate317treefmt-check> +these secrets. Only enable {confval}`effects_on_pull_requests` for repositories318treefmt-check> +where you trust all contributors, or where no secrets are configured. :::319error: build of '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv' on 'ssh-ng://nix@eliza' failed: Cannot build '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv'.320 Reason: builder failed with exit code 1.321 Output paths:322 /nix/store/863hybqzmc5v0nhfb7fhr0vj9iqjjaqp-treefmt-check323 Last 25 log lines:324 > 325 > -:example: `["staging", "release/*"]`326 > -:::327 > +:example: `["staging", "release/*"]` :::328 > 329 > By default, effects only run on the default branch. The330 > -{confval}`effects_branches` and {confval}`effects_on_pull_requests` settings331 > -are always read from the **default branch's** `buildbot-nix.toml` (via `git332 > -show`) so that pull request authors cannot grant themselves effects access.333 > -334 > -:::{caution}335 > -PR effects receive the same `effects_per_repo_secrets` as default-branch336 > -effects. A malicious PR can modify the effect code to exfiltrate these secrets.337 > -Only enable {confval}`effects_on_pull_requests` for repositories where you338 > -trust all contributors, or where no secrets are configured.339 > -:::340 > +{confval}`effects_branches` and {confval}`effects_on_pull_requests` settings are341 > +always read from the **default branch's** `buildbot-nix.toml` (via `git342 > +show`)343 > +so that pull request authors cannot grant themselves effects access.344 > +345 > +:::{caution} PR effects receive the same `effects_per_repo_secrets` as346 > +default-branch effects. A malicious PR can modify the effect code to exfiltrate347 > +these secrets. Only enable {confval}`effects_on_pull_requests` for repositories348 > +where you trust all contributors, or where no secrets are configured. :::349 For full logs, run:350 nix log /nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv351error: Cannot build '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv'.352 Reason: builder failed with exit code 1.353 Output paths:354 /nix/store/863hybqzmc5v0nhfb7fhr0vj9iqjjaqp-treefmt-check