feat(nix): add update-profile tool - #2424
Draft
brainrake wants to merge 9 commits into
Draft
Conversation
PostgreSQL Extension Dependency Analysis: PR #2424
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
PostgreSQL Package Dependency Analysis: PR #2424
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
This comment has been minimized.
This comment has been minimized.
brainrake
force-pushed
the
martonboros/mpg-12-site-env-update
branch
from
September 8, 2026 01:13
48bf50f to
01c4e39
Compare
brainrake
force-pushed
the
martonboros/mpg-12-site-env-update
branch
from
September 8, 2026 09:27
e610160 to
f5befb5
Compare
This comment has been minimized.
This comment has been minimized.
brainrake
force-pushed
the
martonboros/mpg-12-site-env-update
branch
from
September 8, 2026 17:22
716aa2f to
b77c152
Compare
2 tasks
brainrake
force-pushed
the
martonboros/mpg-12-site-env-update
branch
3 times, most recently
from
September 8, 2026 22:50
d7baa39 to
31b661f
Compare
Given a git sha, pg major, and system, fetches the site-env-<major> catalog entry and flips /nix/var/nix/profiles/site via nix-env --set. Skips realise+set if already current. Fixes MPG-12.
brainrake
force-pushed
the
martonboros/mpg-12-site-env-update
branch
from
September 8, 2026 22:51
31b661f to
99ac48b
Compare
brainrake
changed the title
Extends ami-release-nix.yml's existing catalog step to also publish site-env-<major> and site-update catalogs. Adds nix/** to the release trigger path filter. MPG-15
brainrake
force-pushed
the
martonboros/mpg-12-site-env-update
branch
from
September 8, 2026 23:03
dd5cc54 to
0b4401c
Compare
Given a git sha and pg major, fetches the site-env-<major> catalog entry and flips /nix/var/nix/profiles/site-<major> via nix-env --set. System arch is inferred (uname), never a footgun to pass wrong. Per-major profile so an in-flight pg upgrade can prep the new major's site-env without touching the old one's live profile. Verifies the resolved store path is actually tagged for the requested major before setting it live. Skips realise+set if already current. Fixes MPG-12.
brainrake
force-pushed
the
martonboros/mpg-12-site-env-update
branch
from
September 9, 2026 00:52
0b4401c to
730068b
Compare
SITE_UPDATE_CATALOG env var lets tests bypass the S3 fetch with a local catalog file. Covers happy path, idempotent re-run, and refusal on a major-tag mismatch.
Drop the major-specific interface: site-update now takes <sha> <env> (e.g. site-env-17, postgres-env-17) instead of <sha> <major>, so the same tool works for any single-package catalog entry, not just site-env. Profile becomes /nix/var/nix/profiles/<env> directly. Catalog S3 key simplifies to <sha>-<env>-<system>.json. postgres-env-<major> packages already exist (nix/packages/postgres-env.nix); publishing their catalog and switching ansible off the live 'nix build github:...' resolution is a follow-up, not yet done here.
Argument order flips so the profile identity comes first; profile_name (the catalog/profile identifier) and profile_path (the actual /nix/var/nix/profiles/<name> path) are now distinct variables rather than conflating the two.
brainrake
changed the title
…step Extracts the realise+install tail into update-profile-paths (generic: given a profile and already-resolved paths, installs them replacing all existing ones). update-site-extensions keeps its own manifest resolution (genuinely different domain — local catalog, not S3-by-sha) and delegates the apply step. update-profile is untouched.
brainrake
force-pushed
the
martonboros/mpg-12-site-env-update
branch
from
September 9, 2026 16:06
2944b3b to
eee3f28
Compare
sha was required unconditionally even though it's only used to build the S3 fetch path; the catalog-override test hook never touches it.
…ronment AMIs already install AWS CLI v2 system-wide (ansible/tasks/internal/install-aws-cli.yml); bundling it again via Nix duplicated a 1.51 GiB closure (verified via nix path-info) with zero overlap with anything else installed on instances. Matches existing practice elsewhere in this repo (pam_jit_pg, supautils, pg_upgrade all call aws bare, assuming it's on PATH).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
update-profile: given a profile name (e.g.site-env-17,postgres-env-17) and a git sha, fetches that name's catalog entry and flips/nix/var/nix/profiles/<profile>vianix-env --set. Verifies the resolved store path is tagged for the requested profile before setting it live. Skips realise+set if already current.Also adds
update-profile-paths <profile> <path>...: the shared realise+install tail, given already-resolved paths — used by the renamedupdate-site-extensions(wassite-extensions-update) so its apply step isn't duplicated.Also: publishes
site-env-<major>/update-profilecatalogs inami-release-nix.yml, and bakesupdate-profileinto its own AMI profile so a fresh AMI is functional before salt's first run.Follow-up (not in this PR): publish a
postgres-env-<major>catalog (packages already exist) and switch the AMI-build ansible off its current livenix build github:...resolution to useupdate-profileinstead.MPG-12