# weblib-ci

The CI scripts shared by [cfbypass], [weblib-archive], [weblib-fs] and
[weblib-viewer]. Split out per weblib-archive#44, where they had been
hand-copied into each repo and had already drifted once.

**Public deliberately.** Nothing here is a secret or specific to the archive's
contents: a nixpkgs-pinning wrapper, a log poster and a label reconciler.
Public means a consumer needs no deploy key, no ssh setup and no secret to
fetch it — which was measured to be the difference between one step and three.

## What is here

| file | what it does |
|---|---|
| `with-nixpkgs.sh` | Runs a command with one nixpkgs package on PATH, pinned to the *consuming* repo's `flake.lock`. Avoids `nix shell nixpkgs#x`, which re-resolves the registry and refetches a channel tarball whenever the branch moves. |
| `report_job_log.py` | Posts the tail of a build log as a PR comment. Exists because `actions/jobs/{id}/logs` returns 500 for every id on Gitea 1.25.2, so a red job otherwise says only that it failed. |
| `sync_blocked_label.py` | Keeps `Status/Blocked` in step with Gitea's dependency graph. |

All three are standard library / plain bash only. They are *run*, not built, so
this repo has no flake.

## Using it

`with-nixpkgs.sh` reads the **consuming** repo's `flake.lock` relative to the
working directory, so it keeps working from a subdirectory.

```yaml
- uses: actions/checkout@v4
- name: fetch the shared CI tools
  run: git clone --depth 1 https://git.chaosbit.de/weblib/weblib-ci.git .ci
- run: bash .ci/with-nixpkgs.sh python3 python3 .ci/report_job_log.py /tmp/build.log
```

No credentials: the repo is public, which is the whole point of it being so.

### Why not `uses:`

`uses:` pointing at a repo on this instance was measured on weblib-archive#44
and did not work, in either the bare `weblib/weblib-ci@main` form or with a
full URL — while a plain clone with the same access did. `action.yml` is kept
here so the question can be re-checked cheaply if the instance changes; the
README records the answer so nobody has to re-derive it.

### Why not a flake input

These are scripts a workflow runs, not derivations. A flake input would cost a
`flake.lock` bump in four repos every time one changes, and buys nothing.

[cfbypass]: https://git.chaosbit.de/weblib/cfbypass
[weblib-archive]: https://git.chaosbit.de/weblib/weblib-archive
[weblib-fs]: https://git.chaosbit.de/weblib/weblib-fs
[weblib-viewer]: https://git.chaosbit.de/weblib/weblib-viewer