fix(ci): separate Nix cache population from branch checks by alangou · Pull Request #4603 · NVIDIA/OpenShell

alangou · 2026-10-15T15:41:16Z

Summary

Make shared Nix setup read-only and move Cachix population into a dedicated workflow that runs from main. Branch, release, and scan jobs continue to use the cache without receiving its write credential.

Related Issue

Internal tracking: 041 (private review).

Changes

Remove Cachix write-token inputs and forwarding from shared CI workflows
Add a main-only cache population workflow using the protected cachix-write environment
Document the required environment and credential migration in CI.md
Add regression coverage for credential placement, checkout ordering, and immutable action references
Update the GitHub Actions monitoring skill for the new workflow

Before enabling cache writes, complete the cachix-write environment setup and remove the legacy repository credential as documented in CI.md.

Testing

mise run --skip-tools test:cachix-isolation (8 passed)
Ruff check and format validation
ty check tasks/scripts/check_cachix_isolation_test.py
Actionlint on all changed workflows
Zizmor on the cache writer and shared Nix action
E2E tests added/updated (not applicable to workflow credential wiring)

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated (CI.md)

copy-pr-bot · 2026-10-15T15:41:20Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

github-actions · 2026-10-15T15:41:53Z

Label test:e2e applied, but pull-request/4603 does not exist yet. A maintainer needs to comment /ok to test 0406970d0e13aef8e8a982a24642cae5117697c9 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

github-actions · 2026-10-15T16:29:32Z

🌿 Preview your docs: https://nvidia-preview-pr-4603.docs.buildwithfern.com/openshell

alangou · 2026-10-15T16:32:05Z

/ok to test b703ae1

github-actions · 2026-10-15T16:32:29Z

Label test:e2e applied for b703ae1. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

alangou · 2026-10-15T16:32:45Z

gator-agent

PR Review Status

The initial independent code review found no blocking defects in the Cachix credential isolation changes. Required CI is now running on the current-head mirror after /ok to test and re-applying test:e2e.

@SDAChess, I checked your questions about the regression test and the length of the CI documentation. The test guards credential placement and step ordering; the documentation explains the external environment restrictions that YAML cannot enforce. Those comments remain open for discussion with the author; Gator has not resolved your threads.

Blocking findings: None.

Carried findings: None.

Gator metadata

Validation: Focused CI credential isolation improvement; author has verified repository admin access.
Docs: CI.md documents cache setup and credential migration; no direct product UX change requires Fern updates.
Checks: DCO, PR acceptance, Trivy Changes, and workflow reports pass. Branch Checks and Helm Lint are running; maintainer approval is outstanding.
E2E: test:e2e is applied; Branch E2E Checks is running on the current head.
Head SHA: b703ae1afc98243c15867ccb8f6665ba3967b549
Base SHA: 2804f68501fc74da71ff3783b7074682a7a3e276
Merge base SHA: c06ba109c63ccc9cdab5c1ad604f208ef5c2f1d7
Patch ID: 21307b1079aaee078244d43df59874e5d3fdd986
Gator payload: 12
Review mode: initial
Previous reviewed SHA: none
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

alangou · 2026-10-15T16:49:40Z

/ok to test 5939f69

alangou · 2026-10-15T16:50:20Z

gator-agent

PR Review Status

The independent follow-up review found no blocking issues in the documentation-only changes since the previous review. @alangou, I checked your update about shortening the CI guidance: it retains the credential migration, protected environment, and read-only cache requirements; the regression test remains in place as you described.

I refreshed the test mirror for the latest head. Branch Checks and Helm Lint are queued, and the current-head E2E run is pending; required checks must finish before the maintainer handoff.

Blocking findings: None.

Carried findings: None.

Gator metadata

Validation: Focused CI credential isolation improvement; author has verified repository admin access.
Docs: CI.md retains cache setup and credential migration guidance; this follow-up has no direct product UX change.
Checks: DCO and PR acceptance pass; Branch Checks, Helm Lint, and Trivy Changes are pending.
E2E: test:e2e remains applied; current-head Branch E2E Checks run 38772238321 is pending.
Head SHA: 5939f69dbd3f8e540c77f5d34f7ec40cd2a95782
Base SHA: 2804f68501fc74da71ff3783b7074682a7a3e276
Merge base SHA: c06ba109c63ccc9cdab5c1ad604f208ef5c2f1d7
Patch ID: dda3ae60442cd8cb26d9759ec70c2c80aef08992
Gator payload: 12
Review mode: follow_up
Previous reviewed SHA: b703ae1afc98243c15867ccb8f6665ba3967b549
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

alangou · 2026-10-15T17:07:30Z

/ok to test 910a024

github-actions · 2026-10-15T17:07:54Z

Label test:e2e applied for 910a024. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

alangou · 2026-10-15T17:08:03Z

gator-agent

PR Review Status

The independent follow-up review found no blocking issues in the removal of the Cachix isolation checker and its CI, task, and documentation references. @alangou, I checked your latest test-removal commit: it leaves the credential isolation workflow unchanged and removes the associated task references consistently.

The test mirror now matches the latest head, and I re-applied test:e2e. PR Issue Acceptance failed with GitHub “Service Unavailable”; the author's repository admin permission is verified, so this is an infrastructure failure rather than a missing accepted-issue requirement.

Action required: A maintainer must re-run failed jobs in PR Issue Acceptance. Workflow reruns have not been explicitly authorized for this watcher.

Blocking findings: None.

Carried findings: None.

Gator metadata

Validation: Focused CI credential isolation improvement; author has verified repository admin access.
Docs: CI.md retains environment restrictions and credential migration; this delta has no direct product UX changes requiring Fern updates.
Checks: DCO, Trivy Changes, Actionlint, and Zizmor pass. PR Issue Acceptance failed with a service-unavailable API error. Branch Checks and Helm Lint await current-head execution.
E2E: test:e2e applied and current-head mirror confirmed; dispatch confirmation remains pending.
Head SHA: 910a024e68f57a00fde34ebe51b1c3729f4d3b9c
Base SHA: 2804f68501fc74da71ff3783b7074682a7a3e276
Merge base SHA: c06ba109c63ccc9cdab5c1ad604f208ef5c2f1d7
Patch ID: f07ab6764f01140e5997716483584a4b92639cae
Gator payload: 12
Review mode: follow_up
Previous reviewed SHA: 5939f69dbd3f8e540c77f5d34f7ec40cd2a95782
Review budget exhausted: no
Maintainer decision required: no — no review convergence decision is needed.
Next state: gator:blocked
Blocked reason: ci_infrastructure_rerun_required

Make shared Nix setup read-only and populate the cache from main in a dedicated environment. Remove write-token forwarding from reusable workflows and cover the boundary with regression tests. Requires revoking the legacy token and provisioning cachix-write as documented in CI.md. Signed-off-by: Adrien Langou <alangou@nvidia.com>

Preserve action order and multiplicity when checking the credential-bearing cache writer. Require immutable action revisions and cover candidate checkout/restore and reordered-step regressions. Signed-off-by: Adrien Langou <alangou@nvidia.com>

Signed-off-by: Adrien Langou <alangou@nvidia.com>

alangou · 2026-10-16T13:42:38Z

/ok to test 42df333

alangou · 2026-10-16T13:53:44Z

gator-agent

PR Review Status

The independent critical-only follow-up found no new Critical defects in the author-only delta after the rebase. The release workflow changes consistently remove cache write-token forwarding; no prior Gator findings remain open.

@alangou, I checked your latest mirror refresh: it matches this head, PR Issue Acceptance now passes, and Branch Checks and the required E2E suite are running. The earlier CI infrastructure blocker has cleared. Maintainer approval remains outstanding after the required checks finish.

Blocking findings: None.

Carried findings: None.

Gator metadata

Validation: Focused CI credential isolation improvement; author has verified repository admin permission.
Docs: CI.md retains protected-environment setup and credential migration guidance; no direct product UX changes require Fern updates.
Checks: DCO, PR Issue Acceptance, Helm Lint, Trivy Changes, Actionlint, and workflow security reports pass. Branch Checks is running; maintainer approval is outstanding.
E2E: test:e2e remains applied; current-head Branch E2E Checks run 38909963812 is in progress.
Head SHA: 42df33353c39dd1e2726c13a25abe2ec8edcde9f
Base SHA: a4c848adbddd0b4732fd70ddcf8a563a5b1e9317
Merge base SHA: a4c848adbddd0b4732fd70ddcf8a563a5b1e9317
Patch ID: 96d9b9db1da28bf330e449275a5fe192ebe0b2b7
Gator payload: 12
Review mode: critical_only
Previous reviewed SHA: 910a024e68f57a00fde34ebe51b1c3729f4d3b9c
Review budget exhausted: yes
Maintainer decision required: no — no unresolved obligation or qualifying scope growth requires a convergence decision.
Next state: gator:watch-pipeline

alangou requested review from a team, derekwaynecarr, mrunalp and sjenning as code owners October 15, 2026 15:41

alangou added test:e2e Requires end-to-end coverage gator:in-review Gator is reviewing or awaiting PR review feedback labels Oct 15, 2026

SDAChess previously approved these changes Oct 15, 2026

View reviewed changes

Comment thread tasks/scripts/check_cachix_isolation_test.py Outdated

Comment thread CI.md Outdated

alangou dismissed SDAChess’s stale review via b703ae1 October 15, 2026 16:28

alangou force-pushed the fix/041-ci-cache-isolation/alangou branch from 0406970 to b703ae1 Compare October 15, 2026 16:28

alangou added test:e2e Requires end-to-end coverage and removed test:e2e Requires end-to-end coverage labels Oct 15, 2026

alangou added gator:watch-pipeline Gator is monitoring PR CI/CD status and removed gator:in-review Gator is reviewing or awaiting PR review feedback labels Oct 15, 2026

alangou added test:e2e Requires end-to-end coverage and removed test:e2e Requires end-to-end coverage labels Oct 15, 2026

alangou added gator:blocked Gator is blocked by process or repository gates and removed gator:watch-pipeline Gator is monitoring PR CI/CD status labels Oct 15, 2026

SDAChess previously approved these changes Oct 15, 2026

View reviewed changes

alangou removed the gator:blocked Gator is blocked by process or repository gates label Oct 15, 2026

alangou added gator:watch-pipeline Gator is monitoring PR CI/CD status gator:merge-ready gator:blocked Gator is blocked by process or repository gates and removed gator:watch-pipeline Gator is monitoring PR CI/CD status gator:merge-ready labels Oct 15, 2026

alangou added 4 commits October 16, 2026 15:39

docs(ci): condense Nix cache setup guidance

206d0d6

Signed-off-by: Adrien Langou <alangou@nvidia.com>

test(ci): remove Cachix isolation checker

42df333

Signed-off-by: Adrien Langou <alangou@nvidia.com>

alangou dismissed SDAChess’s stale review via 42df333 October 16, 2026 13:41

alangou force-pushed the fix/041-ci-cache-isolation/alangou branch from 910a024 to 42df333 Compare October 16, 2026 13:41

Conversation

alangou commented Oct 15, 2026

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

alangou commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

alangou commented Oct 15, 2026

PR Review Status

Uh oh!

alangou commented Oct 15, 2026

Uh oh!

alangou commented Oct 15, 2026

PR Review Status

Uh oh!

alangou commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

alangou commented Oct 15, 2026

PR Review Status

Uh oh!

alangou commented Oct 16, 2026

Uh oh!

alangou commented Oct 16, 2026

PR Review Status

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants