Log from Radicle native CI

Table of contents

Request message

{
  "request": "trigger",
  "version": 1,
  "event_type": "push",
  "repository": {
    "id": "rad:z2ddH8djdXXq1eKuhAwnyAzWyaivR",
    "name": "infrastructure",
    "description": "Infrastructure configurations for orzklv's public servers.",
    "private": false,
    "default_branch": "main",
    "delegates": [
      "did:key:z6MkwPociLTRDKKW4EYFF8oP5N2r5FycoRMH1FZsxRvetBwy"
    ]
  },
  "pusher": {
    "id": "did:key:z6MkwPociLTRDKKW4EYFF8oP5N2r5FycoRMH1FZsxRvetBwy",
    "alias": "orzklv"
  },
  "before": "0abeb8dc70ac523548c4049de491df47cc0b841a",
  "after": "0abeb8dc70ac523548c4049de491df47cc0b841a",
  "branch": "main",
  "commits": [
    "0abeb8dc70ac523548c4049de491df47cc0b841a"
  ]
}

.radicle/native.yaml

shell: |
  nix flake check -L --show-trace

Run: git clone /var/lib/radicle/storage/z2ddH8djdXXq1eKuhAwnyAzWyaivR /var/lib/radicle-ci/adapters/native/native/86f77524-5b26-43fa-b1d1-10f6044f2288/src

Command arguments:

In directory: /run/radicle-ci-broker

Exit code: 0

Output (stdout and stderr):

Cloning into '/var/lib/radicle-ci/adapters/native/native/86f77524-5b26-43fa-b1d1-10f6044f2288/src'...
done.

Run: git config advice.detachedHead false

Command arguments:

In directory: /var/lib/radicle-ci/adapters/native/native/86f77524-5b26-43fa-b1d1-10f6044f2288/src

Exit code: 0

Run: git checkout 0abeb8dc70ac523548c4049de491df47cc0b841a

Command arguments:

In directory: /var/lib/radicle-ci/adapters/native/native/86f77524-5b26-43fa-b1d1-10f6044f2288/src

Exit code: 0

Output (stdout and stderr):

HEAD is now at 0abeb8dc refactor: remove unnecessary comments

Run: git show 0abeb8dc70ac523548c4049de491df47cc0b841a

Command arguments:

In directory: /var/lib/radicle-ci/adapters/native/native/86f77524-5b26-43fa-b1d1-10f6044f2288/src

Exit code: 0

Output (stdout and stderr):

commit 0abeb8dc70ac523548c4049de491df47cc0b841a
Author: Sokhibjon Orzikulov <sakhib@orzklv.uz>
Date:   Fri Oct 9 05:50:32 2026 +0500

    refactor: remove unnecessary comments

diff --git a/modules/radicle/default.nix b/modules/radicle/default.nix
index 707283c6..2c8e7be6 100644
--- a/modules/radicle/default.nix
+++ b/modules/radicle/default.nix
@@ -7,9 +7,6 @@
 let
   cfg = config.kolyma.radicle;
 
-  # cib signs job COBs with the node key, but unlike radicle-node it only takes the
-  # key's passphrase from $RAD_PASSPHRASE. The broker unit inherits radicle-node's
-  # credentials, so read it from the same credential, verbatim like radicle-node does.
   passing-cib = pkgs.writeShellScript "cib" ''
     if [ -n "''${CREDENTIALS_DIRECTORY:-}" ] && [ -r "$CREDENTIALS_DIRECTORY/dev.radicle.node.passphrase" ]; then
       IFS= read -r -d "" RAD_PASSPHRASE <"$CREDENTIALS_DIRECTORY/dev.radicle.node.passphrase" || true
@@ -27,8 +24,6 @@ let
     '';
   };
 
-  # CI jobs inherit the adapter's environment and their logs are published,
-  # so make sure the passphrase never reaches them.
   native-ci = pkgs.writeShellScriptBin "radicle-native-ci" ''
     unset RAD_PASSPHRASE
     exec ${lib.getExe pkgs.radicle-native-ci} "$@"
@@ -84,11 +79,7 @@ in
             "z6MkfsaxZRSU52oRQVS5uyfkEEkq2un656zDSBPik6jvJ9G3"
             "z6MkwPociLTRDKKW4EYFF8oP5N2r5FycoRMH1FZsxRvetBwy"
           ];
-          description = ''
-            Node IDs (`sudo rad-system self --nid`) whose pushes and patches trigger CI.
-            The native adapter runs jobs unsandboxed as the radicle user, next to
-            this node's key, so only list nodes you trust with that.
-          '';
+          description = "Node IDs (`sudo rad-system self --nid`) whose pushes and patches trigger CI.";
         };
 
         repositories = lib.mkOption {
@@ -251,7 +242,6 @@ in
           };
         };
 
-        # Status pages from the broker at /, per-run logs from the adapter at /logs/.
         ${cfg.domains.ci} = {
           forceSSL = true;
           enableACME = true;
@@ -262,8 +252,6 @@ in
       };
     };
 
-    # The broker's hardening sets UMask=0066, which would leave the report pages
-    # and run logs unreadable for nginx.
     systemd.services.radicle-ci-broker.serviceConfig.UMask = lib.mkForce "0022";
   };
 }

Run: bash -c set -xeuo pipefail nix flake check -L --show-trace

Command arguments:

In directory: /var/lib/radicle-ci/adapters/native/native/86f77524-5b26-43fa-b1d1-10f6044f2288/src

Exit code: 0

Output (stdout and stderr):

+ nix flake check -L --show-trace
GC Warning: Could not open /proc/stat
warning: ignoring untrusted flake configuration setting 'experimental-features'.
Pass '--accept-flake-config' to trust it
evaluating flake...
checking flake output 'hydraJobs'...
checking Hydra job 'hydraJobs'...
checking Hydra job 'hydraJobs.Varlam'...
checking derivation hydraJobs.Varlam...
derivation evaluated to /nix/store/jpxwxwckzsxjfw71nwfrcphmlmic36wa-nixos-system-Varlam-26.05.20261008.7c8764b.drv
checking flake output 'lib'...
checking flake output 'overlays'...
checking overlay 'overlays.modifications'...
checking overlay 'overlays.unstable-packages'...
checking overlay 'overlays.additional-packages'...
checking flake output 'checks'...
checking derivation checks.x86_64-linux.pre-commit-check...
derivation evaluated to /nix/store/vjbfh38aizz8in45zjkhz14f7gh91swl-pre-commit-run.drv
checking flake output 'formatter'...
checking derivation formatter.x86_64-linux...
derivation evaluated to /nix/store/c58lfjs7qhwz62dsq0pv4i8d87fx6ng7-pre-commit-run.drv
checking flake output 'devShells'...
checking derivation devShells.x86_64-linux.default...
derivation evaluated to /nix/store/7x0xbxyfpdh0kkpkf4qhdr2aw5wm90fw-instances.drv
checking flake output 'nixosModules'...
checking NixOS module 'nixosModules.minecraft'...
checking NixOS module 'nixosModules.users'...
checking NixOS module 'nixosModules.base'...
checking NixOS module 'nixosModules.bind'...
checking NixOS module 'nixosModules.postfix'...
checking NixOS module 'nixosModules.nginx'...
checking NixOS module 'nixosModules.navidrome'...
checking NixOS module 'nixosModules.extra'...
checking NixOS module 'nixosModules.radicle'...
checking NixOS module 'nixosModules.tuwunel'...
checking NixOS module 'nixosModules.apps'...
checking NixOS module 'nixosModules.runner'...
checking flake output 'nixosConfigurations'...
checking NixOS configuration 'nixosConfigurations.Varlam'...
running 2 flake checks...
copying path '/nix/store/9x7fsnlpdiw59hd39k35x5qxn4vya7ks-deadnix-1.3.2' from 'https://cache.nixos.org'...
copying path '/nix/store/b81mhbpnw8rmg130xkmydns1sf2rzn26-nixfmt-rs-0.4.1' from 'https://cache.nixos.org'...
copying path '/nix/store/a29s5apc8g2623r4pcykd2gkwysxkywa-statix-0-unstable-2026-05-14' from 'https://cache.nixos.org'...
copying path '/nix/store/2gqnnd91l2dr402mp8qjlnd51m5hl8xw-python3.13-iniconfig-2.3.0' from 'https://cache.nixos.org'...
copying path '/nix/store/671dh91zx227fz6a3q3fp086y2w19r2z-python3.13-packaging-26.1' from 'https://cache.nixos.org'...
copying path '/nix/store/sjkidxh4f9swj98nf83cp1zx5g5ban4a-python3.13-cfgv-3.5.0' from 'https://cache.nixos.org'...
copying path '/nix/store/j64g1gk2xnm1spx0fr0yhajm7zxhzl23-python3.13-nodeenv-1.10.0' from 'https://cache.nixos.org'...
copying path '/nix/store/gy89vh5f66jx17kjnml65xbjk6yj9gf2-python3.13-platformdirs-4.5.1' from 'https://cache.nixos.org'...
copying path '/nix/store/ac2lvnxi0hlhfb0krwap57c5rdrddjxb-python3.13-distlib-0.4.0' from 'https://cache.nixos.org'...
copying path '/nix/store/l7jyqazbfjsspcvx54jggls1cz2w92y1-python3.13-filelock-3.20.3' from 'https://cache.nixos.org'...
copying path '/nix/store/g6abir4kxzaz3k017zp624h7h99na6vl-python3.13-pycparser-3.00' from 'https://cache.nixos.org'...
copying path '/nix/store/k0cq9kxpwnwczb2715h13cs0jgk7ph20-python3.13-pluggy-1.6.0' from 'https://cache.nixos.org'...
copying path '/nix/store/rsym64b3pighdi8znii56hgs0ingg8r3-python3.13-toml-0.10.2' from 'https://cache.nixos.org'...
copying path '/nix/store/7yavjw7rxcjq319h0vcsbccdfpjr4yh6-python3.13-cffi-2.0.0' from 'https://cache.nixos.org'...
copying path '/nix/store/8rq2p4mj679q96bvisvlkddlkg0i46ka-python3.13-pytest-9.0.3' from 'https://cache.nixos.org'...
copying path '/nix/store/xyf0nc67ixmpvv136q61zhk98angy88s-python3.13-virtualenv-20.36.1' from 'https://cache.nixos.org'...
copying path '/nix/store/kmlnxbf7yb7c778fzf4w2avz24awvzqv-python3.13-ukkonen-1.1.0' from 'https://cache.nixos.org'...
copying path '/nix/store/xpiph0gqq6400n968l0fdrr23bphcng4-pytest-check-hook' from 'https://cache.nixos.org'...
copying path '/nix/store/ff2p10d03pa2sx0bk0pa0zxjwkdfjcmy-python3.13-identify-2.6.19' from 'https://cache.nixos.org'...
copying path '/nix/store/9r9qalggp280yxqdia78l5ka7faabbvz-pre-commit-4.5.1' from 'https://cache.nixos.org'...
building '/nix/store/fcj100pzyc25wylxw037b08ny43hiha3-pre-commit-config.json.drv'...
pre-commit-config.json> Sourcing pytest-check-hook
pre-commit-config.json> Using pytestCheckPhase
building '/nix/store/vjbfh38aizz8in45zjkhz14f7gh91swl-pre-commit-run.drv'...
pre-commit-run> Sourcing pytest-check-hook
pre-commit-run> Using pytestCheckPhase
pre-commit-run> Running phase: unpackPhase
pre-commit-run> unpacking source archive /nix/store/mpl66qy1gzmkzcyc3byygj3i4bqk4vfc-ndlx1v8i3pfkrr69bgnqdi3k1kjm0pa5-source
pre-commit-run> source root is ndlx1v8i3pfkrr69bgnqdi3k1kjm0pa5-source
pre-commit-run> Running phase: patchPhase
pre-commit-run> Running phase: updateAutotoolsGnuConfigScriptsPhase
pre-commit-run> Running phase: configurePhase
pre-commit-run> no configure script, doing nothing
pre-commit-run> Running phase: buildPhase
pre-commit-run> Running: $ pre-commit run --all-files
pre-commit-run> deadnix..................................................................Passed
pre-commit-run> nixfmt...................................................................Passed
pre-commit-run> statix...................................................................Passed
all checks passed!
warning: The check omitted these incompatible systems: aarch64-darwin
Use '--all-systems' to check all.