chore(ci): remove the no-op nix access-tokens experiment (#239-#243)#246
Conversation
Pure deletion (34 lines). The access-tokens approach to the org-wide nix CI 429 was proven a no-op (the line never landed in the effective nix.conf; the 429 is GitHub's secondary burst limit auth can't bypass). The real fix is pinning the flake rev (#245). Removes the github-token input + access-tokens nix_conf line + debug step from nix-cachix-setup, and the github-token plumbing from 12 reusables. No behavior change; legitimate gh-release github-token usages kept. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 29 minutes and 24 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (13)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Reviewed 1f1dd5a: removes the no-op nix access-tokens experiment (#239-#243) — 34-line pure deletion, independently adversarially verified clean across completeness, consumer-safety, and structure. All CI green (mergeStateStatus CLEAN, including both rainix-check-shell jobs). Merge authorized by thedavidmeister ('merge 246') — his approval, not an agent self-approval. Merging. |
|
@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment: S/M/L PR Classification Guidelines:This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed. Small (S)Characteristics:
Review Effort: Would have taken 5-10 minutes Examples:
Medium (M)Characteristics:
Review Effort: Would have taken 15-30 minutes Examples:
Large (L)Characteristics:
Review Effort: Would have taken 45+ minutes Examples:
Additional Factors to ConsiderWhen deciding between sizes, also consider:
Notes:
|
1 participant
What
Pure deletion (34 lines, 13 files) removing the no-op nix access-tokens experiment from #239–#243, now that pinning the flake rev (#245, merged) is the real fix for the org-wide nix CI 429.
Removes from
.github/actions/nix-cachix-setup/action.yml:github-tokencomposite input,access-tokens = github.com=…line in nix-quick-install'snix_conf,and the
github-token: ${{ github.token }}plumbing line from the 12 reusables that passed it (autopublish, copy-artifacts, manual-sol-artifacts, rs-static, rs-test, rs-wasm-test, rs-wasm, sol-legal, sol-static, sol-test, subgraph-test, vercel).Why it's safe (no behavior change)
The access-tokens approach was proven a no-op: the
access-tokensline never landed in the effective/etc/nix/nix.conf, and even forced in viaNIX_CONFIGthe fetch still 429'd — it's GitHub's secondary/burst rate-limit on the flakecommits/HEADresolution, which authentication can't bypass. So removing it changes nothing at runtime.github-tokenwas purely internal reusable→composite plumbing — never aworkflow_callinput — so no downstream consumer repo passed it, and none can break.check-shell.yml,test.yml) never passed it.github-tokenusages —gh-release's own input and autopublish passingsecrets.GITHUB_TOKENto the release step — are untouched.Verified by independent adversarial review across completeness, consumer-safety, and structural-correctness — all clean;
git diffis zero insertions.Not included (separate decision)
The other 10 reusables still carry unpinned
github:rainlanguage/rainix#sol-shellrefs and remain subject to the intermittent 429 (exactly as before this experiment). Pinning them like #245 did for the deploy reusable is the durable org-wide fix — left out here because it trades off against test CI tracking the current toolchain. Happy to open that as a follow-up.🤖 Generated with Claude Code