Nix Forge CI v2.7.0

Changelog

  • Bound each historical flake-check derivation evaluation to 60 seconds by default. A timeout builds the current check, so a slow base revision cannot delay the partition indefinitely or suppress validation.
  • Add the optional base-eval-timeout input to actions/flake-checks. Callers can select a different positive limit or use zero for unlimited comparison. Existing callers need no migration.

This compatible v2 release changes no permissions, secret access, or privileged queue behavior. The reviewed implementation is commit 1cc86ef5aa21bc27df920239b8fe85496a93545e (PR #44). The nix-forge/ci/.github/workflows/release.yml workflow builds, attests, verifies, and publishes the tagged source archive.

Validation: nix develop --command bash scripts/check.sh, nix flake check on x86_64 Linux, and the shared workflow validator against the nix-conf caller passed locally. PR and merge-group CI, CodeQL, and DCO must pass before tagging. The nix-conf caller will update its immutable pin in a separate PR revision.

The v2.6.0 pin remains usable for rollback. No support end date is scheduled for v2.6.x; a later major contract change will define its end-of-life window.