···371 </listitem>
372 <listitem>
373 <para>
0000000000374 A new module was added for the Saleae Logic device family,
375 providing the options
376 <literal>hardware.saleae-logic.enable</literal> and
···371 </listitem>
372 <listitem>
373 <para>
374+ <literal>github-runner</literal> gained support for ephemeral
375+ runners and registrations using a personal access token (PAT)
376+ instead of a registration token. See
377+ <literal>services.github-runner.ephemeral</literal> and
378+ <literal>services.github-runner.tokenFile</literal> for
379+ details.
380+ </para>
381+ </listitem>
382+ <listitem>
383+ <para>
384 A new module was added for the Saleae Logic device family,
385 providing the options
386 <literal>hardware.saleae-logic.enable</literal> and
+2
nixos/doc/manual/release-notes/rl-2211.section.md
···137138- The `xplr` package has been updated from 0.18.0 to 0.19.0, which brings some breaking changes. See the [upstream release notes](https://github.com/sayanarijit/xplr/releases/tag/v0.19.0) for more details.
13900140- A new module was added for the Saleae Logic device family, providing the options `hardware.saleae-logic.enable` and `hardware.saleae-logic.package`.
141142- The Redis module now disables RDB persistence when `services.redis.servers.<name>.save = []` instead of using the Redis default.
···137138- The `xplr` package has been updated from 0.18.0 to 0.19.0, which brings some breaking changes. See the [upstream release notes](https://github.com/sayanarijit/xplr/releases/tag/v0.19.0) for more details.
139140+- `github-runner` gained support for ephemeral runners and registrations using a personal access token (PAT) instead of a registration token. See `services.github-runner.ephemeral` and `services.github-runner.tokenFile` for details.
141+142- A new module was added for the Saleae Logic device family, providing the options `hardware.saleae-logic.enable` and `hardware.saleae-logic.package`.
143144- The Redis module now disables RDB persistence when `services.redis.servers.<name>.save = []` instead of using the Redis default.
···48 tokenFile = mkOption {
49 type = types.path;
50 description = lib.mdDoc ''
51- The full path to a file which contains the runner registration token.
052 The file should contain exactly one line with the token without any newline.
53- The token can be used to re-register a runner of the same name but is time-limited.
00005455 Changing this option or the file's content triggers a new runner registration.
56 '';
···117 default = pkgs.github-runner;
118 defaultText = literalExpression "pkgs.github-runner";
119 };
000000000000000000120 };
121122 config = mkIf cfg.enable {
···136137 environment = {
138 HOME = runtimeDir;
139- RUNNER_ROOT = runtimeDir;
140 };
141142 path = (with pkgs; [
···150 ] ++ cfg.extraPackages;
151152 serviceConfig = rec {
153- ExecStart = "${cfg.package}/bin/runsvc.sh";
154155 # Does the following, sequentially:
156 # - If the module configuration or the token has changed, purge the state directory,
···178 ${lines}
179 '';
180 currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
181- runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" ] cfg;
182 newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
183 newConfigTokenFilename = ".new-token";
184 runnerCredFiles = [
···188 ];
189 unconfigureRunner = writeScript "unconfigure" ''
190 differs=
191- # Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
192- ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
193- # Also trigger a registration if the token content changed
194- ${pkgs.diffutils}/bin/diff -q \
195- "$STATE_DIRECTORY"/${currentConfigTokenFilename} \
196- ${escapeShellArg cfg.tokenFile} \
197- >/dev/null 2>&1 || differs=1
000000198199 if [[ -n "$differs" ]]; then
200 echo "Config has changed, removing old runner state."
201- echo "The old runner will still appear in the GitHub Actions UI." \
0202 "You have to remove it manually."
203 find "$STATE_DIRECTORY/" -mindepth 1 -delete
204···212 if [[ -e "$STATE_DIRECTORY/${newConfigTokenFilename}" ]]; then
213 echo "Configuring GitHub Actions Runner"
214215- token=$(< "$STATE_DIRECTORY"/${newConfigTokenFilename})
216- RUNNER_ROOT="$STATE_DIRECTORY" ${cfg.package}/bin/config.sh \
217- --unattended \
218- --disableupdate \
219- --work "$RUNTIME_DIRECTORY" \
220- --url ${escapeShellArg cfg.url} \
221- --token "$token" \
222- --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} \
223- --name ${escapeShellArg cfg.name} \
224- ${optionalString cfg.replace "--replace"} \
225 ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
0000000000000226227 # Move the automatically created _diag dir to the logs dir
228 mkdir -p "$STATE_DIRECTORY/_diag"
···250 setupRuntimeDir
251 ];
2520000253 # Contains _diag
254 LogsDirectory = [ systemdDir ];
255 # Default RUNNER_ROOT which contains ephemeral Runner data
···269 # By default, use a dynamically allocated user
270 DynamicUser = true;
271272- KillMode = "process";
273- KillSignal = "SIGTERM";
274275 # Hardening (may overlap with DynamicUser=)
276 # The following options are only for optimizing:
···48 tokenFile = mkOption {
49 type = types.path;
50 description = lib.mdDoc ''
51+ The full path to a file which contains either a runner registration token or a
52+ personal access token (PAT).
53 The file should contain exactly one line with the token without any newline.
54+ If a registration token is given, it can be used to re-register a runner of the same
55+ name but is time-limited. If the file contains a PAT, the service creates a new
56+ registration token on startup as needed. Make sure the PAT has a scope of
57+ `admin:org` for organization-wide registrations or a scope of
58+ `repo` for a single repository.
5960 Changing this option or the file's content triggers a new runner registration.
61 '';
···122 default = pkgs.github-runner;
123 defaultText = literalExpression "pkgs.github-runner";
124 };
125+126+ ephemeral = mkOption {
127+ type = types.bool;
128+ description = lib.mdDoc ''
129+ If enabled, causes the following behavior:
130+131+ - Passes the `--ephemeral` flag to the runner configuration script
132+ - De-registers and stops the runner with GitHub after it has processed one job
133+ - On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
134+ - Restarts the service after its successful exit
135+ - On start, wipes the state directory and configures a new runner
136+137+ You should only enable this option if `tokenFile` points to a file which contains a
138+ personal access token (PAT). If you're using the option with a registration token, restarting the
139+ service will fail as soon as the registration token expired.
140+ '';
141+ default = false;
142+ };
143 };
144145 config = mkIf cfg.enable {
···159160 environment = {
161 HOME = runtimeDir;
162+ RUNNER_ROOT = stateDir;
163 };
164165 path = (with pkgs; [
···173 ] ++ cfg.extraPackages;
174175 serviceConfig = rec {
176+ ExecStart = "${cfg.package}/bin/Runner.Listener run --startuptype service";
177178 # Does the following, sequentially:
179 # - If the module configuration or the token has changed, purge the state directory,
···201 ${lines}
202 '';
203 currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
204+ runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" ] cfg;
205 newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
206 newConfigTokenFilename = ".new-token";
207 runnerCredFiles = [
···211 ];
212 unconfigureRunner = writeScript "unconfigure" ''
213 differs=
214+215+ if [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
216+ # State directory is not empty
217+ # Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
218+ ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
219+ # Also trigger a registration if the token content changed
220+ ${pkgs.diffutils}/bin/diff -q \
221+ "$STATE_DIRECTORY"/${currentConfigTokenFilename} \
222+ ${escapeShellArg cfg.tokenFile} \
223+ >/dev/null 2>&1 || differs=1
224+ # If .credentials does not exist, assume a previous run de-registered the runner on stop (ephemeral mode)
225+ [[ ! -f "$STATE_DIRECTORY/.credentials" ]] && differs=1
226+ fi
227228 if [[ -n "$differs" ]]; then
229 echo "Config has changed, removing old runner state."
230+ # In ephemeral mode, the runner deletes the `.credentials` file after de-registering it with GitHub
231+ [[ -f "$STATE_DIRECTORY/.credentials" ]] && echo "The old runner will still appear in the GitHub Actions UI." \
232 "You have to remove it manually."
233 find "$STATE_DIRECTORY/" -mindepth 1 -delete
234···242 if [[ -e "$STATE_DIRECTORY/${newConfigTokenFilename}" ]]; then
243 echo "Configuring GitHub Actions Runner"
244245+ args=(
246+ --unattended
247+ --disableupdate
248+ --work "$RUNTIME_DIRECTORY"
249+ --url ${escapeShellArg cfg.url}
250+ --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)}
251+ --name ${escapeShellArg cfg.name}
252+ ${optionalString cfg.replace "--replace"}
00253 ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
254+ ${optionalString cfg.ephemeral "--ephemeral"}
255+ )
256+257+ # If the token file contains a PAT (i.e., it starts with "ghp_"), we have to use the --pat option,
258+ # if it is not a PAT, we assume it contains a registration token and use the --token option
259+ token=$(<"$STATE_DIRECTORY/${newConfigTokenFilename}")
260+ if [[ "$token" =~ ^ghp_* ]]; then
261+ args+=(--pat "$token")
262+ else
263+ args+=(--token "$token")
264+ fi
265+266+ ${cfg.package}/bin/config.sh "''${args[@]}"
267268 # Move the automatically created _diag dir to the logs dir
269 mkdir -p "$STATE_DIRECTORY/_diag"
···291 setupRuntimeDir
292 ];
293294+ # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
295+ # to trigger a fresh registration.
296+ Restart = if cfg.ephemeral then "on-success" else "no";
297+298 # Contains _diag
299 LogsDirectory = [ systemdDir ];
300 # Default RUNNER_ROOT which contains ephemeral Runner data
···314 # By default, use a dynamically allocated user
315 DynamicUser = true;
316317+ KillSignal = "SIGINT";
0318319 # Hardening (may overlap with DynamicUser=)
320 # The following options are only for optimizing:
···5 /* Do not use "dev" as a version. If you do, Tilt will consider itself
6 running in development environment and try to serve assets from the
7 source tree, which is not there once build completes. */
8- version = "0.30.6";
910 src = fetchFromGitHub {
11 owner = "tilt-dev";
12 repo = pname;
13 rev = "v${version}";
14- sha256 = "sha256-i4i406Ys3MY77t4oN+kIeWopdjtfysm4xDFkTpuo+X0=";
15 };
16 vendorSha256 = null;
17
···5 /* Do not use "dev" as a version. If you do, Tilt will consider itself
6 running in development environment and try to serve assets from the
7 source tree, which is not there once build completes. */
8+ version = "0.30.7";
910 src = fetchFromGitHub {
11 owner = "tilt-dev";
12 repo = pname;
13 rev = "v${version}";
14+ sha256 = "sha256-zYP9bn3wC5FJwCdDJEBunaEHoFhRKlH7Mec/Stvp76A=";
15 };
16 vendorSha256 = null;
17
···74 # Can be removed with the next release
75 substituteInPlace pyproject.toml \
76 --replace '"hurry.filesize" = "^0.9"' "" \
77- --replace 'vt-py = ">=0.6.1,<0.8.0"' 'vt-py = ">=0.6.1"'
078 '';
7980 pythonImportsCheck = [
···74 # Can be removed with the next release
75 substituteInPlace pyproject.toml \
76 --replace '"hurry.filesize" = "^0.9"' "" \
77+ --replace 'vt-py = ">=0.6.1,<0.8.0"' 'vt-py = ">=0.6.1"' \
78+ --replace 'backoff = "^1.10.0"' 'backoff = ">=1.10.0"'
79 '';
8081 pythonImportsCheck = [
+8-3
pkgs/tools/security/maigret/default.nix
···63 postPatch = ''
64 # Remove all version pinning
65 sed -i -e "s/==[0-9.]*//" requirements.txt
066 # We are not build for Python < 3.7
67- sed -i -e '/future-annotations/d' requirements.txt
68- # We can't work with dummy packages
69- sed -i -e 's/bs4/beautifulsoup4/g' requirements.txt
70 '';
000007172 disabledTests = [
73 # Tests require network access
···63 postPatch = ''
64 # Remove all version pinning
65 sed -i -e "s/==[0-9.]*//" requirements.txt
66+67 # We are not build for Python < 3.7
68+ substituteInPlace requirements.txt \
69+ --replace "future-annotations" ""
070 '';
71+72+ pytestFlagsArray = [
73+ # DeprecationWarning: There is no current event loop
74+ "-W ignore::DeprecationWarning"
75+ ];
7677 disabledTests = [
78 # Tests require network access