Skip to content

Add protected Hackage publishing support

Laurie Holbrook requested to merge feature/hackage-publishing into master

Summary

Adds a first-class gitlab.ci.hackage module for Cabal validation, source packaging, protected candidate uploads, and optional permanent Hackage.org publication.

API

hackage = {
  enable = true;
  packageDirectories = [ "." ];

  candidate.enable = true;

  release = {
    enable = false;
    tagTemplate = "{version}";
  };
};

Publication safety

  • Candidate uploads are manual and available only on protected refs.
  • Enabling permanent releases turns the protected-tag candidate job into the first required manual gate.
  • Permanent publication is a second required manual gate and depends on the successful candidate job.
  • The final job rejects multiple archives, malformed versions, tag mismatches, missing tokens, non-tags, and unprotected refs before upload.
  • Permanent uploads are serialized with a GitLab resource group.
  • The token is referenced only through the configured protected and masked variable name.
  • Ordinary regression pipelines cannot contact Hackage.

Verification

  • nix flake check ./test/modules/gitlab-ci/hackage/it-generates-candidate-jobs --show-trace
  • nix flake check ./test/modules/gitlab-ci/hackage/it-generates-release-jobs --show-trace
  • nix flake check ./test/modules/gitlab-ci/cachix/it-generates-publish-job --show-trace
  • nix flake check --show-trace
  • Nested fixture packaging reproduction from the GitLab working directory
  • nix run .#gitlab-ci
  • git diff --check
  • Candidate fixture pipeline #19468
  • Release fixture pipeline #19469

Both Hackage child pipelines pass validation and source packaging. Upload jobs are skipped on the unprotected feature branch and make no Hackage request.

The aggregate pipeline #19454 remains red only because its two aarch64-darwin builds cannot reach the configured remote Mac builder (SSH: no route to host). All generated module-test pipelines pass.

Release scope

The changelog is prepared for 0.23.0. This draft does not merge the branch, mark the MR ready, or create the release tag. Hackage.org is the only supported repository in this version; self-hosted repositories and Haddock uploads remain out of scope.

Merge request reports