OpenAI Coding Assistant
527d989a01
Refresh system/tool pins, install official Element Nightly, expand development tools, and finish desktop workflows with a shared charcoal/gold design. Retain host-specific updates and NixOS recovery generations.
87 lines
3.3 KiB
Bash
87 lines
3.3 KiB
Bash
# Host and activation policy come from the host's systemd unit, never inference
|
|
# from a login name. Physical builds are staged for next boot; EC2 switches live.
|
|
repo=${NIXOS_CONFIG_REPO:?Set NIXOS_CONFIG_REPO}
|
|
host=${NIXOS_UPDATE_HOST:?Set NIXOS_UPDATE_HOST}
|
|
mode=${NIXOS_UPDATE_MODE:?Set NIXOS_UPDATE_MODE}
|
|
case "$host:$mode" in
|
|
dev:switch|nixos:boot) ;;
|
|
*) echo "Refusing unsupported update target/policy: $host:$mode" >&2; exit 2 ;;
|
|
esac
|
|
state=${CACHE_DIRECTORY:-/var/cache/nixos-update}
|
|
mkdir -p "$state"
|
|
exec 9>"$state/lock"
|
|
flock -n 9 || exit 0
|
|
|
|
cd "$repo"
|
|
if [ -n "$(git status --porcelain)" ]; then
|
|
echo 'Skipping automatic update: the configuration has local changes.'
|
|
exit 0
|
|
fi
|
|
baseline=$(git rev-parse HEAD)
|
|
if ! branch=$(git symbolic-ref -q HEAD); then
|
|
echo 'Skipping automatic update: checkout is detached.'
|
|
exit 0
|
|
fi
|
|
work=$(mktemp -d "$state/work.XXXXXXXX")
|
|
cleanup() {
|
|
git -C "$repo" worktree remove --force "$work" >/dev/null 2>&1 || true
|
|
rm -rf -- "$work"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
git worktree add --detach "$work" "$baseline"
|
|
cd "$work"
|
|
# Advance package inputs to newest resolving branch heads. Neovim stays pinned.
|
|
nix flake update nixpkgs home-manager nixpkgs-latest
|
|
if git diff --quiet -- flake.lock; then
|
|
echo 'Package inputs are already current.'
|
|
exit 0
|
|
fi
|
|
nix flake check --no-build --no-update-lock-file
|
|
nix build .#checks.x86_64-linux.updates .#checks.x86_64-linux.desktop-config \
|
|
.#checks.x86_64-linux.physical-config .#checks.x86_64-linux.tools \
|
|
.#checks.x86_64-linux.desktop-actions \
|
|
--no-update-lock-file --no-link
|
|
git add flake.lock
|
|
git -c user.name='NixOS Updater' -c user.email='nixos-updater@localhost' \
|
|
commit -m 'chore: update NixOS package inputs'
|
|
built=$(nix build ".#nixosConfigurations.$host.config.system.build.toplevel" \
|
|
--no-update-lock-file --no-link --print-out-paths)
|
|
candidate=$(git rev-parse HEAD)
|
|
|
|
# Never overwrite work started while the candidate was building.
|
|
cd "$repo"
|
|
unchanged() {
|
|
[ "$(git rev-parse HEAD)" = "$baseline" ] &&
|
|
[ "$(git symbolic-ref -q HEAD)" = "$branch" ] &&
|
|
[ -z "$(git status --porcelain)" ]
|
|
}
|
|
if ! unchanged; then
|
|
echo 'Configuration changed during the build; leaving it untouched.'
|
|
exit 0
|
|
fi
|
|
if [ "$mode" = boot ]; then
|
|
# Preserve an already staged generation on failure, not just the running one.
|
|
previous=$(readlink -f /nix/var/nix/profiles/system)
|
|
else
|
|
previous=$(readlink -f /run/current-system)
|
|
fi
|
|
sudo "$built/sw/bin/nixos-rebuild" dry-activate --no-reexec --store-path "$built"
|
|
if ! unchanged; then
|
|
echo 'Configuration changed during dry activation; leaving it untouched.'
|
|
exit 0
|
|
fi
|
|
git merge --ff-only "$candidate"
|
|
if ! sudo "$built/sw/bin/nixos-rebuild" "$mode" --no-reexec --store-path "$built"; then
|
|
echo 'Activation failed; restoring the previous system/profile. See the journal.' >&2
|
|
sudo "$previous/sw/bin/nixos-rebuild" "$mode" --no-reexec --store-path "$previous"
|
|
if [ "$(git rev-parse HEAD)" = "$candidate" ] && [ -z "$(git status --porcelain)" ]; then
|
|
git -c user.name='NixOS Updater' -c user.email='nixos-updater@localhost' \
|
|
revert --no-edit "$candidate"
|
|
fi
|
|
exit 1
|
|
fi
|
|
printf '%s %s %s\n' "$(date -Is)" "$candidate" "$built" > "$state/last-success"
|
|
echo "Updated $host ($mode): $built"
|
|
# No forced reboot or garbage collection: recovery generations are retained.
|