feat(pi): deploy on CI green instead of waiting for nightly#482
Open
etrobert-bot wants to merge 2 commits into
Open
feat(pi): deploy on CI green instead of waiting for nightly#482etrobert-bot wants to merge 2 commits into
etrobert-bot wants to merge 2 commits into
Conversation
Add a deploy-pi job to the build workflow that runs `nixos-rebuild switch --flake .#pi --target-host root@pi` from tower's self-hosted runner once all-builds passes. Gating on all-builds keeps the invariant that we never deploy raw main: the aarch64 closure is already in Cachix, pushed by tower's post-build hook during CI. The deploy key is scoped to main via the pi-deploy environment (deployment-branch policy) and pinned to tower's addresses via `from=` in pi's authorized_keys, so an exfiltrated key is useless off tower. The nightly system.autoUpgrade stays as the offline-catch-up backstop. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #481
Candidate B (CI push) of the two implementations #481 calls for — to be compared against candidate A (#483); the loser does not merge.
Adds a
deploy-pijob to.github/workflows/build.ymlthat runsnixos-rebuild switch --flake .#pi --target-host root@100.68.23.44fromtower's self-hosted runner once
all-buildspasses. Eval/build happen ontower (substituting the aarch64 closure that CI already pushed to Cachix); pi
only receives store paths and activates.
Design
needs: all-builds— default success semantics mean the deploynever runs unless every host build passed, so we never deploy raw
main.if: github.event_name == 'push'limits it to merges (skipped on PRs).root@pi.PermitRootLogin = "prohibit-password"(NixOSdefault) allows key-only root login and
nixos-rebuild switchneeds root onthe target, so no
--use-remote-sudo.tower:/home/soft/.ssh/pi-deploy,exposed to CI through the
pi-deployenvironment secretPI_DEPLOY_SSH_KEY(deployment-branch policy restricted to
main, so PR/branch runs can't readit). Public key is pinned in pi's
authorized_keyswithfrom="100.103.91.42,192.168.0.10"(tower's Tailscale + LAN addresses), soan exfiltrated key is useless off tower.
system.autoUpgradeis unchanged — it catches pi upif it was offline when a deploy fired.
Manual setup (create the environment + secret) is required before this deploys;
steps are documented for the repo owner.
🤖 Generated with Claude Code