ci: move the nixpkgs auto-update from GitHub Actions to Crow CI #4

Merged

Alper merged 1 commit from Alpers-Ai-Agent/MyServers:agent/crow-auto-update into main

2026-11-01 18:06:39 +03:00

Alpers-Ai-Agent commented

2026-11-01 17:54:29 +03:00

Contributor

What

Ports the daily nixpkgs auto-update from GitHub Actions to Crow CI, per the Forgejo-canonical plan (GitHub Actions are being retired as they get ported to Crow).

Adds .crow.yaml: cron + manual pipeline update-nixpkgs, behavior-identical to the old workflow — nix flake update nixpkgs nixpkgs-unstable nixos-raspberrypi, commit flake.lock to main as Server Updater <server-updater@alper-celik.dev> with the same update nixpkgs message, push to main. From there the existing flow takes over unchanged: Forgejo push-mirror → GitHub main → auto-deploy.yml.
Removes .github/workflows/auto-update.yml (in the same commit, so there is no double-update window). auto-deploy.yml and update-dns*.yml stay.

Pipeline choices

Image docker.io/nixos/nix:2.35.4 (multiarch amd64+arm64, verified on the registry) — nix flake update needs no builds, only lockfile + fetches.
labels: pool: local — the job routes to the local arm64 agent on hetzner-server-1, never the EC2 autoscaler pool (no cost for a lockfile bump).
Push auth via a repo secret, not netrc: Crow only injects netrc credentials into trusted clone plugins (repo-settings docs), so a direct git push from a normal step cannot use them. The push URL is built from CI_REPO_CLONE_URL, so a future domain move doesn't touch the file.
Manual hand-trigger is supported: the pipeline also fires on the manual event, gated to branch: main so a run from another branch cannot push that branch to main (the old workflow_dispatch equivalent, with the guard it lacked).
No GITHUB_TOKEN equivalent for nix fetches yet — three inputs resolve a handful of api.github.com calls at 01:30, well inside the unauthenticated rate limit. If a rate-limit 403 ever shows up in the log, add a github_token secret and extend NIX_CONFIG with access-tokens.

One-time setup (Crow UI, ci.auth.how) — needed before the first run

Enable Alper/MyServers in Crow if not already.
Repo Secrets: add forgejo_token = a Forgejo PAT with push access to main (Forgejo → Settings → Applications → token, scope repo write).
Repo Cron: name update-nixpkgs, schedule 30 22 * * *, branch main (same 01:30 UTC+3 cadence as the old workflow; Crow interprets the schedule in the server's timezone — if the first run lands at the wrong wall-clock time, shift the schedule accordingly).
Trigger the first run by hand — via the cron's manual-trigger button or the repo's "Run pipeline" — and expect the update nixpkgs commit on Forgejo main.

Validation

.crow.yaml parses clean (yq); no other Crow pipeline files existed.
Diff is exactly: new .crow.yaml, deleted .github/workflows/auto-update.yml.

## What Ports the daily nixpkgs auto-update from GitHub Actions to Crow CI, per the Forgejo-canonical plan (GitHub Actions are being retired as they get ported to Crow). - **Adds** `.crow.yaml`: cron + manual pipeline `update-nixpkgs`, behavior-identical to the old workflow — `nix flake update nixpkgs nixpkgs-unstable nixos-raspberrypi`, commit `flake.lock` to main as `Server Updater <server-updater@alper-celik.dev>` with the same `update nixpkgs` message, push to main. From there the existing flow takes over unchanged: Forgejo push-mirror → GitHub main → `auto-deploy.yml`. - **Removes** `.github/workflows/auto-update.yml` (in the same commit, so there is no double-update window). `auto-deploy.yml` and `update-dns*.yml` stay. ## Pipeline choices - Image `docker.io/nixos/nix:2.35.4` (multiarch amd64+arm64, verified on the registry) — `nix flake update` needs no builds, only lockfile + fetches. - `labels: pool: local` — the job routes to the local arm64 agent on hetzner-server-1, never the EC2 autoscaler pool (no cost for a lockfile bump). - **Push auth via a repo secret, not netrc:** Crow only injects netrc credentials into trusted clone plugins (repo-settings docs), so a direct `git push` from a normal step cannot use them. The push URL is built from `CI_REPO_CLONE_URL`, so a future domain move doesn't touch the file. - Manual hand-trigger is supported: the pipeline also fires on the `manual` event, gated to `branch: main` so a run from another branch cannot push that branch to main (the old workflow_dispatch equivalent, with the guard it lacked). - No `GITHUB_TOKEN` equivalent for nix fetches yet — three inputs resolve a handful of api.github.com calls at 01:30, well inside the unauthenticated rate limit. If a rate-limit 403 ever shows up in the log, add a `github_token` secret and extend `NIX_CONFIG` with `access-tokens`. ## One-time setup (Crow UI, ci.auth.how) — needed before the first run 1. Enable `Alper/MyServers` in Crow if not already. 2. Repo **Secrets**: add `forgejo_token` = a Forgejo PAT with push access to main (Forgejo → Settings → Applications → token, scope repo write). 3. Repo **Cron**: name `update-nixpkgs`, schedule `30 22 * * *`, branch `main` (same 01:30 UTC+3 cadence as the old workflow; Crow interprets the schedule in the server's timezone — if the first run lands at the wrong wall-clock time, shift the schedule accordingly). 4. Trigger the first run by hand — via the cron's manual-trigger button or the repo's "Run pipeline" — and expect the `update nixpkgs` commit on Forgejo main. ## Validation - `.crow.yaml` parses clean (yq); no other Crow pipeline files existed. - Diff is exactly: new `.crow.yaml`, deleted `.github/workflows/auto-update.yml`.

Alpers-Ai-Agent added 1 commit

2026-11-01 17:54:29 +03:00

ci: move the nixpkgs auto-update from GitHub Actions to Crow CI fb39a35cfa

Same cadence (30 22 * * *) and same result (flake.lock bump on main as Server Updater). Runs on the local agent pool; pushes with a forgejo_token repo secret because Crow only gives netrc credentials to trusted clone plugins. Removes .github/workflows/auto-update.yml.