From 60dbb903cc87f90c42cab9db7b8724f373606c35 Mon Sep 17 00:00:00 2001
From: "claude@clouddev1" <claude-clouddev1@oliversturm.ch>
Date: Sun, 14 Jun 2026 22:07:48 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20macOS=20smoke-test=20=E2=80=94=20run=20te?=
 =?UTF-8?q?sts=20+=20nix-store=20generation=20pruning?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add `cargo test` before the darwin builds (gate is Linux-only; the macOS
  leg is test-then-build) — a full dry-run of release-macos bar the upload.
- Add an `if: always()` prune step. The runner wipes the workspace each run,
  so cargo target/ never accumulates (no sweep). The persistent cache is the
  nix store: record the current toolchain in a persistent profile, keep the
  2 newest generations (nix-env --delete-generations +2), reclaim the rest
  (nix-collect-garbage). Pairs with min-free/max-free in the runner nix.conf.
---
 .gitea/workflows/macos-probe.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.gitea/workflows/macos-probe.yaml b/.gitea/workflows/macos-probe.yaml
index d338026..565625a 100644
--- a/.gitea/workflows/macos-probe.yaml
+++ b/.gitea/workflows/macos-probe.yaml
@@ -25,6 +25,8 @@ jobs:
       NIX_CONFIG: "experimental-features = nix-command flakes"
     steps:
       - uses: actions/checkout@v4
+      - name: test (macOS — the gate only covers Linux)
+        run: nix develop -c cargo test --no-fail-fast
       - name: build, de-nix, sign, verify both darwin targets
         run: |
           set -e
@@ -58,3 +60,22 @@ jobs:
             echo "OK: $t portable"
           done
           echo "=== both darwin targets built, de-nixed, signed, verified ==="
+
+      - name: prune nix store — keep the last 2 toolchain generations
+        # The runner wipes the whole workspace before each run, so cargo target/
+        # never accumulates (no sweep needed). The persistent caches are the nix
+        # store (/nix) and ~/.cargo (in $HOME). Bound the nix store by generation:
+        # record the current devShell closure as a generation of a persistent
+        # profile (lives in $HOME, survives the workspace wipe), keep the 2 newest
+        # (current + previous), reclaim what the older ones referenced. No time
+        # window — never more than two toolchains regardless of flake.lock churn.
+        if: always()
+        run: |
+          echo "--- disk before ---"; df -h / | tail -1
+          P="$HOME/.cache/rdbms-ci/toolchain"
+          nix develop --profile "$P" -c true || true
+          nix-env -p "$P" --delete-generations +2 || true
+          nix-collect-garbage || true
+          echo "--- disk after ---"; df -h / | tail -1
+          # ~/.cargo/registry also persists but grows only on Cargo.lock bumps;
+          # bound it later with `cargo-cache --autoclean` if it ever matters.