feat: generic nix native-module builder for cachix - #3151
Conversation
❌ 2 Tests Failed:
View the full list of 2 ❄️ flaky test(s)
To view more test analytics, go to the Test Analytics Dashboard |
The cmu-nav-natives-marker job was a hand-rolled hashFiles cache layered on top of Cachix's own content-addressing. Its key drifted whenever `nix build` dropped a `result` symlink into the hashed tree, so the marker never hit and the privileged Cachix-deploy job rebuilt + re-pushed on every unrelated PR (#2733). Nix already computes each module's store path purely from its inputs, so an unchanged module substitutes from Cachix (no compile) and pushes nothing. Collapse marker + cmu-nav-natives into one `cachix-build` job running bin/build-native-modules.
c0c9441 to
0aed792
Compare
Greptile SummaryIntroduces a generic Nix native-module builder and updates CI to build, verify, publish, and consume native artifacts through Cachix.
Confidence Score: 5/5The PR appears safe to merge because no new blocking failure eligible for this follow-up review remains. No blocking failure remains within the scope of the displayed previous review threads. Files Needing Attention: No files require blocking changes.
What T-Rex did
Important Files Changed
Reviews (9): Last reviewed commit: "Merge branch 'main' into jeff/feat/cachi..." | Re-trigger Greptile |
The rust job now builds crates the same way they ship: crates with a flake run fmt/clippy/test inside `nix develop path:.` (so tests get any flake-provided deps), flakeless crates keep the plain toolchain, and the PyO3 extension crates are auto-detected (extension-module in Cargo.toml) and maturin-built only so pytest can import them. Adds a read-only Cachix substituter (no auth token, stays unprivileged) + fetch-depth: 0 for ray_tracing's git+file self-reference. Also fixes two latent module-flake breakages the generic builder now exercises: pointlio switches its fast-lio input from git+ssh to github (public repo, no runner ssh key), and ray_tracing links its macOS pyo3 cdylib with -undefined dynamic_lookup. Both rust flakes gain a toolchain-only devShells.default so `nix develop` skips the heavy src derivation (virtual_mid360's relative path: input can't resolve in the store otherwise).
The per-module stamp tried to skip unchanged rebuilds by comparing a timestamp against the newest file under build_dir, but that scan misses deleted/renamed inputs and any input outside build_dir (shared rust crates, common lidar headers, flake inputs) — so it could report a module current and reuse a stale executable. It also never helped on self-hosted, where `git clean -ffdx` wipes the untracked stamp every run. Nix already content-hashes all inputs and Cachix makes an unchanged closure near-instant, so just run the build unconditionally.
Co-authored-by: Sam Bull <aa6bs0@sambull.org>
Fix cachix, simplify CI
Which required a couple other things
ref DIM-1285