Changelog

A leader can now be configured to build only some branches on a push, rather than only whether to build pushes at all. Set the push suite trigger of a forge to the branches to run-on and the ones to do-not-run-on.

The branches a test or a deployment runs on can now be named with a glob pattern. release/* matches one segment of a branch name, release/** matches any number of them, and ? matches a single character.

The leader now refuses to start when its JWK file or its session key file does not hold a key.

Test and deploy jobs now run with the CI environment variable set to true.

A cache download that does not finish now reads as failed in the build log, instead of as a completed download of the full size.

The leader now serves correctly when its read-only connection is pointed at a read replica. A token was rejected on the very request it was generated for, logging in straight after registering could fail, pages answered 404 for rows that existed, and a run status could go never announced to GitHub, GitLab or Codeberg because the job that announces it gave up rather than retrying. Signing in through GitLab or Codeberg could be turned away as a forged request, and linking a GitLab account already held by another account could merge the two when the leader meant to refuse. A read whose answer decides what gets written now goes to the primary, and a lookup that would turn an empty answer into a 404 is confirmed against the primary before it is believed.

The cache now serves correctly when its read-only connection is pointed at a read replica. Finishing an upload answered 404 while the replica was catching up, the collectors skipped everything the replica had not caught up with, and a store path fetched from an upstream cache could replace a locally held one with a redirect. A read whose answer decides what gets written now goes to the primary, and a miss on the replica is confirmed against the primary before it is believed.

Tests and deployments can now say which branches they do not run on.

branches = {
  run-on = ":any";
  do-not-run-on = ":default";
};

The cache no longer drops a store path when another path with identical contents is uploaded.

Thanks to Lucien Huber of alphaloop!

Streaming a run's logs no longer hangs when the run has no output yet.

A run that NixCI cancels is now reported to GitHub, GitLab and Codeberg as cancelled, instead of being left saying it is still running.

Waiting for a build now answers 402 instead of 408 when builds are not running for the repository.

NixCI now clones private repositories with the ssh key in a secret always called GIT_SSH_KEY. The git-ssh-key configuration option is gone.

The name is fixed because reading your configuration is the first thing a build does, and it has to clone the repository to do that, so a key named only in the configuration could never authenticate the clone that reads it. If you named a secret there, rename it to GIT_SSH_KEY; the configuration option itself needs no replacement, and a leftover git-ssh-key in your configuration is reported as an unrecognised option rather than failing the build.

There is now an API reference, generated from an OpenAPI document that you can point your own tooling at. It also shows how to start a build from a shell and wait for it to finish, which fails if the build does.

Workers can now build with Determinate Nix.

Code blocks in the documentation are now syntax highlighted, in the same colours as the build logs. Asking a page for text/markdown gets fenced blocks that name their language.

Evaluation, build, test, and deploy jobs now fetch only the commit they are building or running, not every commit it descends from. For a repository with a long history that is much less to download, and the fetch is the first thing every job does.

A new shallow-clone option in nix-ci.nix controls it. Set shallow-clone = false for a flake that reads self.revCount, which has no history to count when only one commit is fetched.

A test or deploy job that runs in-repo still fetches the whole history, because it clones the repository and a clone has no depth control.

A build that did not have to run now says it was already built, instead of showing zero seconds as though it had. It keeps the green check of a passing build but trades the elapsed time for a lightning bolt , because the result came back instantly from the cache.

Sped up configuration jobs by only fetching the configuration file instead of the entire repository using a specialised new tool: nix-ci-config.

Builds are now skipped when the same derivation has already been built, even after the evaluation job has completed. This should speed builds up even more under heavy load.

Evaluation jobs got about 30% faster thanks to a new tool: nix-ci-eval.

As part of this change, builds that are already known to be cached will now be skipped entirely. This brings the total worker time of the common case suite down by even more than 30%.

NixCI got a changelog, and this is its first entry.

Every change to NixCI gets an entry here from now on, so you can see what shipped without having to ask. Each entry is named for its version, like 26-07.1: a two-digit year, a month, and a counter that starts again each month.