nix-build.yml never runs on pull requests — packaging changes merge unverified (and the workflow is currently red)

[EtienneLescot]

The gap

nix-build.yml runs on workflow_dispatch, push to main, and a Monday 06:00 UTC cron. It never runs on pull_request. Every packaging change therefore merges unverified and is first exercised after the fact — by the cron, or by a user.

#531 is the current instance: #508 adds a libglvnd RPATH entry so an EGL dlopen resolves on NixOS, and nothing will build it before it lands.

Why this can't just be a one-line trigger change

The workflow has not been green in its last 8 runs, spanning roughly four weeks. Adding pull_request today would redden every PR for reasons unrelated to the PR. The failures are three separate real problems, none of which is "the derivation is broken":

1. Crate fetch 403 (runs 33195212151, 33195185053, Aug 28) — cannot download crate-async-fs-2.2.0.tar.gz from any mirror, same for ashpd-0.9.3. Fails ~2 min in. Looks like a crates.io mirror/rate-limit issue rather than anything in-tree, but it has now happened twice.
2. npmDepsHash mismatch (32755056975, 32755022311, 32719053231, Aug 24-25) — hash mismatch in fixed-output derivation ...-npm-deps. Worth understanding: nix-check.yml exists precisely to assert this on PRs and it passes there, yet the hash still mismatched on main. Whatever that divergence is, it is a hole in the guard we already have. Two of these also show cannot unlink '/tmp/nix-build-...': Directory not empty.
3. Smoke test can't run (32827253816, 32707512544, 32700094226) — Desktop source enumeration did not return within 20000ms, Recording did not start within 30s. The runner has no display or GPU stack. The workflow already fights this for Vulkan (it pulls lavapipe from nix after mesa-vulkan-drivers turned out to ship only the Asahi ICD), so the same treatment is presumably needed for the capture path — or the smoke test's scope needs narrowing on CI.

Suggested order

1. Fix or quarantine the three failure modes above until the workflow is reliably green on main.
2. Then add pull_request — likely path-filtered to nix/**, flake.nix, flake.lock, package-lock.json, and the native helper sources, so it only fires on changes that can actually break the derivation.
3. Decide whether it gates merges or is advisory. The job's own comments budget it at up to 60 minutes and describe its purpose as "catching drift rather than gating a commit" — a required check that slow would change how the repo merges, so this is a deliberate call, not a default.

A cheaper interim option, if the full build stays unreliable: build only nix/pipewire-helper.nix on PRs touching the helper. That is where the RPATH questions live, it is a far smaller closure than .#openscreen, and it needs no display or GPU to be meaningful — patchelf --print-rpath on the output is most of the value.

Related

• Verify the libglvnd RPATH fix for the EGL dlopen actually builds on NixOS (#508 follow-up) #531 — the specific unverified change this gap is currently hiding
• fix(capture): zero-copy dmabuf→VAAPI capture — fix whole-screen recording freeze on GNOME/AMD (#507) #508