feat: binary cache — CI pushes gate-verified builds to attic #8

Merged

synapse merged 2 commits from feat/binary-cache into develop

2026-08-21 17:48:02 +00:00

synapse commented

2026-08-21 17:32:07 +00:00

Owner

Repo side of goatcounter-stats-gateway-c85 ("prod never compiles"), now that attic is live on chiba. Implements the binary-cache OpenSpec change.

nixConfig: consumers (chiba's nixos-rebuild foremost) get the substituter + public key automatically — one-time trust prompt, then rustc never runs there
ci.yml: pushes the default package closure to the byteflavour cache after the gate, on develop push-runs only — PRs never push, failed gates push nothing (structural via step order + event condition)
release.yml: pushes both static binaries at tag time
Auth = runner user's existing attic client config; zero secrets in repo or workflows
Manual flow proven: pushed the current default build, .narinfo answers publicly (attic dedup'd deps against cache.nixos.org upstream)

The CI run on THIS PR doubles as verification of the "PRs never push" scenario — the push step must be absent/skipped in its log.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

Repo side of goatcounter-stats-gateway-c85 ("prod never compiles"), now that attic is live on chiba. Implements the `binary-cache` OpenSpec change. - `nixConfig`: consumers (chiba's nixos-rebuild foremost) get the substituter + public key automatically — one-time trust prompt, then rustc never runs there - `ci.yml`: pushes the default package closure to the `byteflavour` cache **after** the gate, on `develop` push-runs only — PRs never push, failed gates push nothing (structural via step order + event condition) - `release.yml`: pushes both static binaries at tag time - Auth = runner user's existing attic client config; zero secrets in repo or workflows - Manual flow proven: pushed the current default build, `.narinfo` answers publicly (attic dedup'd deps against cache.nixos.org upstream) The CI run on THIS PR doubles as verification of the "PRs never push" scenario — the push step must be absent/skipped in its log. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

synapse added 1 commit

2026-08-21 17:32:07 +00:00

feat: binary cache wiring — CI-verified builds substitute on consumers

ci / gate (pull_request) Has been cancelled

Details

573dfb8e69

nixConfig declares cache.byteflavour.dev + public key; ci.yml pushes the
default closure after a green gate on develop pushes only (never PRs);
release.yml pushes both statics. Auth via the runner user's attic config
— no secrets in the repo. Manual push flow proven (.narinfo public).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

synapse added 1 commit

2026-08-21 17:45:48 +00:00

fix: CI hangs on flake nixConfig trust prompt; README speaks to strangers

ci / gate (pull_request) Successful in 17s

Details

884734a534

nix asks interactively whether to allow the flake's substituter config;
in the runner stdin is a pipe and the prompt waits forever — answer it
with --accept-flake-config on every CI nix invocation. README drops the
nixos-config reference (private-reality leak in public docs).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

synapse merged commit a9c7707a32 into develop

2026-08-21 17:48:02 +00:00

synapse deleted branch feat/binary-cache

2026-08-21 17:48:02 +00:00

synapse referenced this pull request from a commit

2026-08-21 17:48:03 +00:00

Merge pull request 'feat: binary cache — CI pushes gate-verified builds to attic' (#8) from feat/binary-cache into develop