Conversation
…ump action versions Pure version bumps, no behavioral changes to any job. - actions/checkout v4 (v3 in update-version.yml) -> v7 - cachix/install-nix-action v31.5.1 -> v31.11.0 - cachix/cachix-action v16 -> v17 - dcarbone/install-jq-action v3 -> v4 - workflow/nix-shell-action v3 -> v4.0.0 The checkout bump is the one that matters for the ongoing secretless-CI work. As of v6, persist-credentials writes the token to a separate file under $RUNNER_TEMP and wires it in via git includeIf, rather than dropping it into .git/config inside the workspace where every later step and build script in the job can read it. That directly reduces exposure of JENKINS_GITHUB_PAT in update-version.yml, which is the only place we persist a real PAT and then push with it. v7 rather than v6: v7 refuses fork-PR checkouts by default, but assertSafePrCheckout early-returns unless the event is pull_request_target or workflow_run. Every workflow here triggers on pull_request, push, or workflow_dispatch, so the guard never fires -- including the ui-tests checkout of rust-lang/rust, which is the only place we name a foreign repository. v7.0.1 also hardens the guard's ref trimming to ASCII-only. workflow/nix-shell-action is pinned to the exact tag because that repo publishes no v4 moving tag, unlike the others. dtolnay/rust-toolchain stays on @master: it ships no versioned releases, and the channel is read dynamically from rust-toolchain.toml. Note for deployment: checkout@v7, cachix-action@v17 and nix-shell-action@v4 are all node24, which requires Actions Runner >= v2.327.1. Most jobs here run on self-hosted runners (linux/normal, ARM64, MacM1). Runners auto-update by default, but any registered with --disableupdate will fail with an unhelpful runtime-not-found error. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…needed secrets Removes every secret that was not actually load-bearing, taking the repo from 6 secret references to 3. All three that remain are now confined to master.yml, on the push-to-master release path; test.yml, test-cachix-pin.yml and update-version.yml no longer reference any secret beyond the automatic GITHUB_TOKEN. - test-cachix-pin.yml: drop CACHIX_AUTH_TOKEN. check-cachix-pin.sh never reads it. The script's only network calls are bare curls to the pin API and to <hash>.narinfo, and both serve k-framework-binary without authentication (verified: HTTP 200 unauthenticated on both). The env var was inherited from master.yml, where kup publish shares the step and does need it. - update-version.yml: drop the cachix authToken. The job's only nix work is 'nix flake update', which resolves and locks inputs without building a derivation, so it has nothing to push. The step stays as a read-only substituter, matching the pattern test.yml already uses. - update-version.yml: replace the JENKINS_GITHUB_PAT checkout token with the automatic GITHUB_TOKEN plus 'permissions: contents: write', which is all the 'Push updates' step needs. The repo has no .gitmodules, so the 'submodules: recursive' input is a no-op and raises no auth concern. Caveat on the last one: pushes authenticated with GITHUB_TOKEN do not create new workflow runs. That is what we want for the self-loop, since this workflow both triggers on and pushes to _update-deps/runtimeverification/rv-nix-tools. But if that branch has an open PR, the Test workflow will no longer re-run on it after the flake update lands. Nothing in this repo's history shows such a PR, so this is untested against the real devops flow; revert to a PAT or swap in a GitHub App token if the downstream PR CI turns out to matter. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…b/scripts/check-cachix-pin.sh: drop deployment CI Deployment is out of scope for this version and will be restored separately. Removes every workflow that publishes, notifies, or pushes, leaving test.yml as the sole workflow. The repo now references no stored secret at all. - master.yml: all three jobs were deployment. update-deps dispatched runtimeverification/devops, nix-cache pushed to the k-framework cache, and nix-binary-cache ran kup publish against k-framework-binary. This file held all three remaining stored secrets. - test-cachix-pin.yml: workflow_dispatch-only verification that a release was published and pinned to cachix. Meaningless without the publish it verifies. - check-cachix-pin.sh: orphaned by the two removals above; nothing else referenced it. - update-version.yml: bumped the rv-nix-tools flake input and pushed. Not deployment as such, but not CI testing either, and it is driven by the same RV devops automation as master.yml's dispatch, so it belongs with that batch when it returns. Removing it also retires the untested GITHUB_TOKEN-push path noted in the previous commit rather than shipping it. install-yq.sh is kept; test.yml calls it in all three of its rustc jobs. deps/rv-nix-tools is kept: nothing in-tree reads it now, but it is the write target of the external devops automation and update-version.yml will need it again when restored. No effect on the nix build: nix/stable-mir-json-source/default.nix already filters .github/ out of the source. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Display name only; the job id stays ui-tests to match the lowercase-kebab convention of the other three. Also fixes the last step of that job, which was named 'Run smir integration tests' but runs 'make test-ui'. It was copy-pasted from the integration-tests job and made the log read as though the wrong suite was running. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ion Tests" Display name only. Completes the title-case pass over the four job names: Code Quality, Integration Tests, UI Tests, Nix Tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Code Quality, Integration Tests and UI Tests move from [self-hosted, linux, normal] to ubuntu-latest. Nix Tests stays self-hosted (see below). None of the three needs a big machine. run_ui_tests.sh is a serial loop over 2888 files, one stable_mir_json invocation at a time, so the self-hosted box's extra cores contribute nothing to the dominant phase; wall time is per-core-speed bound either way. Integration Tests is 29 programs. Code Quality is a build plus clippy, fmt and nixfmt, and it already installs its own Nix via install-nix-action, which is the standard GitHub-hosted path. Nothing in these jobs assumed a self-hosted host: every tool is installed in-job (yq via .github/scripts/install-yq.sh, the nightly via dtolnay/rust-toolchain, jq via install-jq-action), and ensure_rustc_commit.sh takes its regular-clone branch and finds the checkout already at the expected commit, so it never needs the fetch that fetch-depth: 1 would frustrate. Nix Tests is left alone deliberately. Its matrix includes the MacM1 self-hosted host, and it skips the Nix and Cachix install steps there because that host has Nix preinstalled; retargeting it means dropping those guards and installing Nix on a GitHub-hosted macOS runner. More importantly, dropping deployment CI removed the job that populated the k-framework cache with this repo's builds, so 'nix flake check' now rebuilds cold. The self-hosted runners still have a persistent /nix/store to absorb that; a GitHub-hosted runner would not, and the job's timeout-minutes: 20 would very likely be exceeded. Expected cost of the move: each of the three jobs now downloads the nightly toolchain (rust-toolchain.toml asks for llvm-tools, rustc-dev, rust-src and rust-analyzer) and builds from a cold cargo cache. Adding Swatinem/rust-cache would claw most of that back if the added minutes turn out to matter. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dkcumming
reviewed
Jul 27, 2026
dkcumming
left a comment
dkcumming
left a comment
Collaborator
There was a problem hiding this comment.
The nix job still relies on cachix access to K, so that will either need to be stripped or solved.
Only other comment is since so much is going in this PR, is there are point keeping deps/rv-nix-tools, I don't think it gets read or written after this change right?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This removes all uses of secrets from this repository CI, which makes it safe to run again.
This also removes: