Build native releases and images through a single Nix flake - #299
Open
jgoux wants to merge 17 commits into
Open
Conversation
jgoux
marked this pull request as ready for review
September 5, 2026 03:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This migrates native service builds and image assembly to a single root Nix flake. Release jobs previously selected between host installers, copied upstream overlays, and several Nix invocation paths. They now resolve the requested source and dependency hashes into an explicit release input, build a portable runtime, and package the audited bytes with pinned archive tools and dockerTools.
The hourly poller, release floors, exact-version selection, and automatic native-package/image publication remain intact. New upstream releases do not require edits to the repository lock. Postgres and Edge Runtime retain their selected upstream release's own dependency graph; verified upstream archives and mirrored images retain their existing provenance paths.
The migration removes host Go/npm installers, duplicated Nix pins, copied overlays, Docker build runners, and slim Dockerfiles. Studio uses the standard nixpkgs pnpm fetcher and configuration hook. Runtime identity, working directories, entrypoints, volume permissions, and platform floors remain part of the validation contract.
Service artifacts also own Realtime, Analytics, Storage, and Pooler preparation, Pooler tenant provisioning, and PostgreSQL first boot. Native services and derived images use the same launchers. PostgreSQL bootstraps through a private socket and a directly owned temporary server, preserves existing volumes, and rejects incomplete initialization. Ports, credentials, and project configuration remain in the CLI stack rewrite.
Validation: repository checks, host fixture suites, shell syntax/ShellCheck, and pure flake evaluation pass. All 15 selected release validations pass across Linux amd64, Linux arm64, and macOS arm64, covering 13 services, PostgreSQL 15 and 17, and two Studio versions. Validation-only runs build, audit, archive, and smoke without replacing published assets or images. A fresh poller dry run found no unpublished backlog among 155 eligible versions.
Same-version Linux ARM64 comparisons: compressed images decreased by 4.4 MiB for PostgreSQL 17, 3.2 MiB each for Storage and PgMeta, and 8.7 MiB for Studio. Native archives for the first three increased by 1.1–3.0 MiB with bundled glibc; Studio's archive decreased by 0.5 MiB. Parallel-stack memory capacity remains unmeasured.
Successful release-validation runs
Repository checks
Service preparation validation
The eight selected releases were replaced from this branch after passing all three native targets and both Linux images. Each release has verified archive checksums, manifests, and SBOMs; CLI PR #6440 pins the published multi-architecture image digests. PostgreSQL coverage includes existing volumes, backup restoration, restart behavior, and failed initialization; host fixtures verify cancellation and process cleanup.
Supersedes #298