Name the input whose development home has no ref #15

Merged

larandar merged 1 commit from agent.teyla/fastlane-ref-probe into main

2026-08-10 17:42:00 +00:00

AGit

agent.teyla commented

2026-08-10 08:16:54 +00:00

Contributor

Closes #14.

assemble appends ?ref={{ref}} to every manifest input unconditionally, so the manifest silently assumes every listed repo carries a fastlane branch. Some repos are main-only by design, so the rule is really "leave those out" — an implicit rule, written nowhere, enforced by nothing, and when broken the failure names nothing useful:

error: Failed to fetch git repository '…'
       … while updating the flake input 'jostoph-rs'

It fails the whole evaluation, in every repo declaring the input, mentioning neither fastlane nor this file nor the missing branch. This makes the seam say it, at the one moment the manifest is in hand and the cause is obvious.

+40 lines, one file, most of it the reasoning.

In scope

A refresh-time probe of each input's development home for the ref branch, warning on stderr with the input, the repo and the branch.
A header correction: it said an undeclared input is inert, which invites the wrong inference that a bad one is too. It now states what a bad one does, and why a published-only repo has no entry at all.

Out of scope

Raising. Every repo in the estate fetches this file; raising would give one bad line a wider blast radius than it already has. The warning may only ever be added — flags and exit status are untouched, and that is tested.
Probing on the hot path. flake_override runs assemble on every just in a wired repo. The refresh already pays a network cost once a day; the probe rides that and nothing else.
Teaching the manifest to express a main-only input (per-input ref, a [published] section). No input wants it — a repo consumed as published is not a development home, so the correct entry is no entry. Schema for a case with no instances is invented work.
Skipping or rewriting a bad input. Routing around it hides it. The line is wrong and a person must fix it.

Boundary

This adds git to what the seam assumes, and it has deliberately assumed only nu and just because it ships everywhere. So the probe is best-effort by construction: no git, no key, no network → it says nothing and behaves exactly as before.

What makes that safe is that git ls-remote --exit-code distinguishes the two failures, which I measured rather than assumed:

result	meaning	action
`0`	branch exists	silent
`2`	connected, no such branch — a fact about the manifest	warn
`128`	unreachable / unauthenticated — a fact about this machine	silent

BatchMode=yes so a passphrase prompt can never hang a build.

The probe validates the default ref. just ref=<other> assemble stays unvalidated and fails the old way — a cache cannot pre-validate every ref someone might pass.

Acceptance

Ran, not reasoned. Test 1 is the real manifest; test 2 stubs only the http get line (every other line is the shipped file) so a deliberately broken manifest could be fed in.

Bad entry warns, precisely — a manifest with jostoph-rs (main-only) → fastlane: jostoph-rs names ssh://[email protected]/lar.ad/jostoph-rs, which has no fastlane branch — every repo declaring this input will fail to evaluate…, exit 0, flags still emitted. ✅
The real four warn about nothing. ✅
128 stays silent — an unreachable repo in the same manifest produced no warning, correctly treated as an environment fact. ✅
Flags byte-identical to the pre-change seam — diff against the output of the current main copy: identical. ✅
No git on PATH — run under env -i with a PATH containing only just and nu (git provably absent — even sh was not there): exit 0, empty stderr, correct flags. ✅
Zero hot-path cost — cold run (refresh + probe) 2.1s, warm run with a fresh cache 0.022s. ✅

Not run: the ref=<other> path, which is out of scope above and unchanged.

Closes #14. `assemble` appends `?ref={{ref}}` to every manifest input unconditionally, so the manifest silently assumes every listed repo carries a `fastlane` branch. Some repos are `main`-only by design, so the rule is really "leave those out" — an implicit rule, written nowhere, enforced by nothing, and when broken the failure names nothing useful: ``` error: Failed to fetch git repository '…' … while updating the flake input 'jostoph-rs' ``` It fails the *whole* evaluation, in *every* repo declaring the input, mentioning neither fastlane nor this file nor the missing branch. This makes the seam say it, at the one moment the manifest is in hand and the cause is obvious. +40 lines, one file, most of it the reasoning. ## In scope - A refresh-time probe of each input's development home for the `ref` branch, warning on stderr with the input, the repo and the branch. - A header correction: it said an *undeclared* input is inert, which invites the wrong inference that a *bad* one is too. It now states what a bad one does, and why a published-only repo has no entry at all. ## Out of scope - **Raising.** Every repo in the estate fetches this file; raising would give one bad line a wider blast radius than it already has. The warning may only ever be *added* — flags and exit status are untouched, and that is tested. - **Probing on the hot path.** `flake_override` runs `assemble` on every `just` in a wired repo. The refresh already pays a network cost once a day; the probe rides that and nothing else. - **Teaching the manifest to express a main-only input** (per-input `ref`, a `[published]` section). No input wants it — a repo consumed as published is not a development home, so the correct entry is no entry. Schema for a case with no instances is invented work. - **Skipping or rewriting a bad input.** Routing around it hides it. The line is wrong and a person must fix it. ## Boundary This adds `git` to what the seam assumes, and it has deliberately assumed only `nu` and `just` because it ships everywhere. So the probe is best-effort by construction: no git, no key, no network → it says nothing and behaves exactly as before. What makes that safe is that `git ls-remote --exit-code` distinguishes the two failures, which I measured rather than assumed: | result | meaning | action | |---|---|---| | `0` | branch exists | silent | | `2` | connected, no such branch — **a fact about the manifest** | warn | | `128` | unreachable / unauthenticated — a fact about this machine | silent | `BatchMode=yes` so a passphrase prompt can never hang a build. The probe validates the *default* ref. `just ref=<other> assemble` stays unvalidated and fails the old way — a cache cannot pre-validate every ref someone might pass. ## Acceptance Ran, not reasoned. Test 1 is the real manifest; test 2 stubs only the `http get` line (every other line is the shipped file) so a deliberately broken manifest could be fed in. - **Bad entry warns, precisely** — a manifest with `jostoph-rs` (main-only) → `fastlane: jostoph-rs names ssh://[email protected]/lar.ad/jostoph-rs, which has no `fastlane` branch — every repo declaring this input will fail to evaluate…`, **exit 0, flags still emitted**. ✅ - **The real four warn about nothing.** ✅ - **128 stays silent** — an unreachable repo in the same manifest produced no warning, correctly treated as an environment fact. ✅ - **Flags byte-identical to the pre-change seam** — `diff` against the output of the current `main` copy: identical. ✅ - **No git on PATH** — run under `env -i` with a PATH containing only `just` and `nu` (git provably absent — even `sh` was not there): exit 0, empty stderr, correct flags. ✅ - **Zero hot-path cost** — cold run (refresh + probe) 2.1s, warm run with a fresh cache **0.022s**. ✅ Not run: the `ref=<other>` path, which is out of scope above and unchanged.

agent.teyla added 1 commit

2026-08-10 08:16:55 +00:00

fastlane: name the input whose development home has no ref 055350a112

A manifest entry pointing at a repo with no `ref` branch has no local
symptom. nix fails the whole evaluation with `Failed to fetch git
repository`, in every repo that declares the input, naming neither
fastlane nor this file nor the branch that is missing.

Probed at refresh — at most once a day, never on the hot path, since
flake_override runs assemble on every `just` in a wired repo. Warned,
never raised: this file is fetched by every repo in the estate, so
raising would give one bad line a wider blast radius than it has.

Best-effort throughout. `--exit-code` separates the case worth
reporting (2: connected, no such branch — the manifest is wrong) from
the case that is not this file's business (128: unreachable or
unauthenticated — the machine is). With no git on PATH the probe says
nothing and the flags are unchanged.

The header said an undeclared input is inert, which invites the wrong
inference that a bad one is too. It now says what a bad one does, and
why a published-only repo has no entry at all.

Closes #14

larandar merged commit fc292012e7 into main

2026-08-10 17:42:00 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Ting/Jostoph!15

No description provided.

Rows
Columns