The deploy-openclaw job required a CONFIG_REPO_TOKEN secret that
was never configured, causing it to fail on every CI run.
Tag updates for the openclaw HelmRelease are now handled by
Renovate, which detects new images in registry.johnogle.info
and opens PRs against k3s-cluster-config to update manifests.
The build-and-push-openclaw job remains: it builds the thin
Docker image and pushes it to the registry.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Strips runtime packages (nodejs_22, kubectl, jq, git, emacs, tsx, tea, pythonEnv, qmd) from the Docker image contents, reducing image size from ~2.7GB to ~1.5GB.
Key changes:
- Removed 9 runtime packages from contents (moved to openclaw-runtime-closure)
- Removed pythonEnv let binding and qmd parameter (no longer needed in image)
- Added OPENCLAW_RUNTIME_CLOSURE env var (bakes closure path for init container)
- Added runtime closure bin dir to PATH (resolves after PVC population)
- Added curl to contents (needed by init container for Harmonia health checks)
- CI: added openclaw-runtime-closure to build-and-cache PACKAGES array
- CI: added second sed command for CronJob image tag update
- CI: removed inherit qmd from openclaw-image callPackage (qmd now in runtime closure)
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
The sed pattern on the store path basename gave 'tar.gz' because
buildLayeredImage outputs 'openclaw.tar.gz'. Use imageTag attribute
which returns the actual tag (e.g., '2026.4.14').
- Add specialArgs to nix-deck (was missing nixpkgs-unstable, causing
infinite recursion when roles/local-inference evaluated it)
- Move local-inference import out of roles/default.nix: its module-level
disabledModules/imports conflict with nix-deck's unstable-based nixpkgs
- Import local-inference directly in zix790prors (the only machine that
enables it)
- Add custom-qmd and custom-opencode to CI build-and-cache packages
Includes the Wayland screen sharing patch (from ash/talk-desktop-wayland-screenshare)
and adds custom-nextcloud-talk-desktop to CI build-and-cache pipeline.
Extract shared package definition, add to flake packages output
and CI workflow so perles gets built and cached by Harmonia.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Kernel and qt5webengine builds are memory-intensive. Limiting to
2 parallel jobs prevents swapping on john-endesktop.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Stremio uses qt5webengine, so it benefits from the separate
nixpkgs-qt input to avoid rebuild churn.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The Steam Deck (nix-deck) kernel from Jovian-NixOS is expensive to
build. Pre-building it in CI saves significant time on updates.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- PRs: Fast flake check with clear status
- Main: check → build-and-cache (build only starts if check passes)
- Clearer failure attribution and status badges
Tradeoff: 2x nix-setup on main pushes, but better job structure.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
nix build outputs progress info to stdout along with the store path.
Filter to only the /nix/store/ line to get the actual path.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Merge check and build-and-cache into one job to eliminate redundant
nix-setup step. Saves ~1m43s per run.
- PRs: checkout → nix-setup → flake check
- Main pushes: same + build/sign/cache all packages
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add packages/beads and packages/gastown with shared definitions
- Expose custom-beads and custom-gastown in flake packages output
- Consolidate CI from matrix (8 parallel jobs) to single job with loop
- Saves ~12 minutes of redundant nix-setup time per run
- Uses ::group:: for collapsible log sections per package
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add packages output with:
- custom-* packages from packages/
- qt-pinned-jellyfin-media-player
Update CI to use hyphenated names (flake attrs can't have dots)
Focus on packages that actually need caching:
- custom.* packages from packages/
- qt-pinned.jellyfin-media-player (qt5webengine)
Avoids unrelated build failures (steam) and is much faster.
- Build all 6 machines (nix-book, boxy, zix790prors, nix-deck, john-endesktop, live-usb) in parallel matrix
- Only runs on push to main after check passes
- Signs closures with NIX_SIGNING_KEY secret
- Pushes to cache via SSH using CACHE_SSH_KEY, CACHE_HOST, CACHE_USER secrets
- Skips Darwin as no builder available
Required Gitea secrets:
- NIX_SIGNING_KEY: Cache signing private key
- CACHE_SSH_KEY: SSH key for cache server access
- CACHE_HOST: Cache server hostname
- CACHE_USER: SSH user for cache server
Closes: x-iyz0w
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Uses johno/gitea-actions/nix-setup composite action for:
- Nix installation via DeterminateSystems/nix-installer-action
- Nix store caching via actions/cache@v4
- Per-repo cache isolation based on flake.lock hash
