fix(ci): clean /homeless-shelter between Renovate's Nix builds - #1085
Merged
Conversation
Renovate's post-upgrade tasks fail intermittently with: error: home directory '/homeless-shelter' exists; please remove it to assure purity of builds without sandboxing Renovate then abandons its artifact updates, so a dependency bump lands with go.mod and go.sum updated but gomod2nix.toml stale, and an "Artifact update problem" comment appears on the PR. Nix can't sandbox builds in this container, so it sets HOME=/homeless-shelter and treats that path staying absent as a purity check. Any Go build writes to $HOME, creating the directory, and nothing removes it, so every build after it fails. It only bites when the caches are missing something: most dependency bumps rebuild only the leaf app derivation, which runs no Go compiler. This commit adds a post-build hook that deletes /homeless-shelter after every build. It also sets max-jobs = 1, since with parallel builds one can create the directory while another is starting, before the hook has run. Related to crossplane/crossplane#7390. Signed-off-by: Jared Watts <jbw976@gmail.com>
Contributor
📝 WalkthroughWalkthroughThe Renovate entrypoint now creates a ChangesNix Renovate configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related issues
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/renovate-entrypoint.sh:
- Around line 34-38: Update the Renovate startup flow in
.github/renovate-entrypoint.sh to invoke
/usr/local/bin/nix-clean-homeless-shelter once before running renovate. Keep the
existing max-jobs and post-build-hook configuration unchanged, ensuring stale
/homeless-shelter state is cleared before the first build.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8a3e1a2a-e7e7-4e00-b72b-3d240f1e94af
📒 Files selected for processing (1)
.github/renovate-entrypoint.sh
5 tasks
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of your changes
This PR sets out to solve the same problem as crossplane/crossplane#7652, where our Renovate job fails intermittently with
error: home directory '/homeless-shelter' exists, as in this example.In crossplane/crossplane the fix has to prevent creation of the dir rather than cleaning it up afterwards, but we need a different fix here because the builds that create the directory (e.g.,
pkgs.gomod2nix) come from our dependencies rather than our own Nix code, so we have nowhere to set a writeableHOMEhere.This PR adds a
post-build-hookthat deletes/homeless-shelterafter each build, and setsmax-jobs = 1so no new build starts before we can clean it up.Only
mainneeds this since all Renovate runs use the entrypoint from main, regardless of the branch they target.Related to crossplane/crossplane#7390
How has this code been tested
I reproduced the failure and the fix in
ghcr.io/renovatebot/renovate:43, the same image the Renovate action uses.On the current code and with gomod2nix's derivations missing from the caches, several of them build in parallel. One creates
/homeless-shelterby writing to$HOME, and the next build to start then fails the purity check, which abortsnix run .#tidy. The directory is left behind, sonix run .#generateafterwards fails right away.With this change, in the same container using our updated entrypoint, both commands complete and the
/homeless-shelterdirectory does not cause any issues ✅When this is merged, I will run the Renovate action to verify the full flow there too.
I have:
./nix.sh flake checkto ensure this PR is ready for review.Added or updated unit tests.Linked a PR or a docs tracking issue to document this change.Addedbackport release-x.ylabels to auto-backport this PR.Need help with this checklist? See the cheat sheet.