ci: add test-demo workflow

[imincik]

No description provided.

[imincik]

Unrelated error messages

 fatal: cannot change to '/home/runner/.cache/nix/gitv3/0glrjg6yk3b68jqm6lz05qsv63iapg08p0aa3qx725qw1ygh94va': No such file or directory
warning: could not update cached head 'refs/heads/canon' for 'https://code.tvl.fyi/depot.git:/nix/yants.git'

[eljamm]

Static analysis for the workflow using zizmor:

$ zizmor .github/workflows/test-demo.yaml
6 findings (4 suppressed): 0 unknown, 0 informational, 0 low, 2 medium, 0 high

[eljamm]

See zizmor - artipacked audit rule

Suggested change

	- uses: 'actions/checkout@v4'
	- uses: 'actions/checkout@v4'
	with: { persist-credentials: false }

[eljamm]

See zizmor - excessive permissions audit rule

Suggested change

	permissions: {}

[imincik]

Just found

root@debian-sid:~# cat /etc/nix/nix.conf
# see https://nixos.org/manual/nix/stable/command-ref/conf-file

sandbox = true

[imincik]

Debian 12 (latest stable), Ubuntu 24.04 (latest LTS) and Ubuntu 24.10 (latest release) is failing on

error: path '/nix/store/m0qqag8jp56zydqjzh5vva1p2azh1g5x-linux-6.12.21-modules-shrunk/lib' is not in the Nix store

which is discussed here and here and might be caused by NixOS/nixpkgs#372931 .

[imincik]

Debian 12 (latest stable), Ubuntu 24.04 (latest LTS) and Ubuntu 24.10 (latest release) is failing on

error: path '/nix/store/m0qqag8jp56zydqjzh5vva1p2azh1g5x-linux-6.12.21-modules-shrunk/lib' is not in the Nix store

which is discussed here and here and might be caused by NixOS/nixpkgs#372931 .

The issue narrowed down to

nix-build /nix/store/gzzg57bkfsqvb69spv9j4qmgwmkkbcpj-closure-info.drv
this derivation will be built:
  /nix/store/gzzg57bkfsqvb69spv9j4qmgwmkkbcpj-closure-info.drv
error: path '/nix/store/m0qqag8jp56zydqjzh5vva1p2azh1g5x-linux-6.12.21-modules-shrunk/lib' is not in the Nix store

[imincik]

cat /nix/store/gzzg57bkfsqvb69spv9j4qmgwmkkbcpj-closure-info.drv
Derive([("out","/nix/store/3d4iddj5qmyck5gx58vqckli4yjjcg03-closure-info","","")],[("/nix/store/5h55gpcb1nljrqg6hzrp7bblgjk47h1s-coreutils-9.6.drv",["out"]),("/nix/store/94kf0r3wdw62kv8ygd3wf825jpyhnnc0-kmod-debian-aliases.conf-30+20230601-2.drv",["out"]),("/nix/store/a8g13ahvrlswraapvs08155jcbz80lv5-kmod-blacklist-31+20240202-2ubuntu8.drv",["out"]),("/nix/store/bhpkj057a27dxlq3ybdb5gg19l1zgwah-linux-6.12.21-modules-shrunk.drv",["out"]),("/nix/store/cfp8jh04f3jfdcjskw2p64ri3w6njndm-bash-5.2p37.drv",["out"]),("/nix/store/kkw5pkfm08wlv1558pgbca73rlgc78kx-jq-1.7.1.drv",["dev"]),("/nix/store/m0xmpjrzm5f44y1pncswxb2lfh5f5z0k-etc-modprobe.d-nixos.conf.drv",["out"]),("/nix/store/nh9lrra397qw7kld9q22sxs16pim2br6-stage-1-init.sh.drv",["out"]),("/nix/store/qajidah6nnj7y6gy8k47bi5201pqqkxi-stdenv-linux.drv",["out"])],["/nix/store/shkw4qm9qcw5sc5n1k5jznc83ny02r39-default-builder.sh","/nix/store/vj1c3wf9c11a0qs6p3ymfvrnsdgsdcbq-source-stdenv.sh"],"x86_64-linux","/nix/store/58br4vk3q5akf4g8lx0pqzfhn47k3j8d-bash-5.2p37/bin/bash",["-e","/nix/store/vj1c3wf9c11a0qs6p3ymfvrnsdgsdcbq-source-stdenv.sh","/nix/store/shkw4qm9qcw5sc5n1k5jznc83ny02r39-default-builder.sh"],[("__json","{\"buildCommand\":\"out=${outputs[out]}\\n\\nmkdir $out\\n\\nif [[ -n \\\"$empty\\\" ]]; then\\n  echo 0 > $out/total-nar-size\\n  touch $out/registration $out/store-paths\\nelse\\n  jq -r \\\".closure | map(.narSize) | add\\\" < \\\"$NIX_ATTRS_JSON_FILE\\\" > $out/total-nar-size\\n  jq -r '.closure | map([.path, .narHash, .narSize, \\\"\\\", (.references | length)] + .references) | add | map(\\\"\\\\(.)\\\\n\\\") | add' < \\\"$NIX_ATTRS_JSON_FILE\\\" | head -n -1 > $out/registration\\n  jq -r '.closure[].path' < \\\"$NIX_ATTRS_JSON_FILE\\\" > $out/store-paths\\nfi\\n\\n\",\"buildInputs\":[],\"builder\":\"/nix/store/58br4vk3q5akf4g8lx0pqzfhn47k3j8d-bash-5.2p37/bin/bash\",\"cmakeFlags\":[],\"configureFlags\":[],\"depsBuildBuild\":[],\"depsBuildBuildPropagated\":[],\"depsBuildTarget\":[],\"depsBuildTargetPropagated\":[],\"depsHostHost\":[],\"depsHostHostPropagated\":[],\"depsTargetTarget\":[],\"depsTargetTargetPropagated\":[],\"doCheck\":false,\"doInstallCheck\":false,\"empty\":false,\"env\":{},\"exportReferencesGraph\":{\"closure\":[\"/nix/store/lwppsfyv2zhhl1jf5k84spqbjfph7sp9-stage-1-init.sh\",\"/nix/store/m0qqag8jp56zydqjzh5vva1p2azh1g5x-linux-6.12.21-modules-shrunk/lib\",\"/nix/store/pfsx0ck1r306zhww6kalw527mf2c6d9v-kmod-blacklist-31+20240202-2ubuntu8/modprobe.conf\",\"/nix/store/pg53dimlhgpjhz8zwvvd8pw0sakck2kl-etc-modprobe.d-nixos.conf\",\"/nix/store/p4qnadn8aqc38wwfrsr3i68cdz357xlk-kmod-debian-aliases.conf-30+20230601-2\"]},\"mesonFlags\":[],\"name\":\"closure-info\",\"nativeBuildInputs\":[\"/nix/store/yh6qg1nsi5h2xblcr67030pz58fsaxx3-coreutils-9.6\",\"/nix/store/ld8ys81ch5fj94j0jrwbkgwwjxmbwdxh-jq-1.7.1-dev\"],\"outputChecks\":{\"out\":{}},\"outputs\":[\"out\"],\"patches\":[],\"preferLocalBuild\":true,\"propagatedBuildInputs\":[],\"propagatedNativeBuildInputs\":[],\"stdenv\":\"/nix/store/76dr5bsqnfxzfljs3q9nwhw5ri52z7gx-stdenv-linux\",\"strictDeps\":false,\"system\":\"x86_64-linux\"}"),("out","/nix/store/3d4iddj5qmyck5gx58vqckli4yjjcg03-closure-info")])

[imincik]

/nix/store/gzzg57bkfsqvb69spv9j4qmgwmkkbcpj-closure-info.drv is triggered by
/nix/store/7slj9692g2lpxg493a2nm91qr18kwy59-initrd-linux-6.12.21.drv .

[imincik]

Found the issue. Older Nix versions are containing this regression.

Confirmed on Debian 12:

# test.nix

let
  pkgs = import (builtins.fetchTarball "https://github.com/nixos/nixpkgs/archive/nixos-unstable.tar.gz") {};
  foo = pkgs.runCommand "foo" {} ''
    mkdir -p $out/hi
  '';
  bar = pkgs.closureInfo {
    rootPaths = [ "${foo}/hi" ];
  };
in bar

nix-build test.nix

these 2 derivations will be built:
  /nix/store/6j38j4jw7hc85ivfm8lqzd68rs648lks-foo.drv
  /nix/store/7pvpmra0wr45gfwk4nlm9l1zs964rp9n-closure-info.drv
building '/nix/store/6j38j4jw7hc85ivfm8lqzd68rs648lks-foo.drv'...
error: path '/nix/store/0sqhavfz16amb1bl97gpgc9ivddcafv6-foo/hi' is not in the Nix store

[fricklerhandwerk]

Can we get a newer Nix package on Debian? Or simply skip Debian for now and leave a TODO to pick up once their next stable release is out?

[imincik]

Can we get a newer Nix package on Debian? Or simply skip Debian for now and leave a TODO to pick up once their next stable release is out?

The issue is that it fails on Ubuntu LTS and on latest Ubuntu (non LTS) as well.

[eljamm]

This might be a bit too much, but can't we run a more recent Nix version using the Nix installed on those distros?

[imincik]

This might be a bit too much, but can't we run a more recent Nix version using the Nix installed on those distros?

Not sure if I understand. What exactly do you mean ?

[eljamm]

The issue is with old Nix versions, right? What if we use those to install/use a more recent Nix, say nixVersions.latest. That should be possible, right?

[imincik]

Looks like the regression patch was backported to multiple Nix versions .

[imincik]

The issue is with old Nix versions, right? What if we use those to install/use a more recent Nix, say nixVersions.latest. That should be possible, right?

No, you can't change Nix version installed by Debian/Ubuntu that way.