Review a pull request by booting it

通过启动 PR 来进行代码审查

tl;dr; trynix-preview is a GitHub action that comments a link on a pull request which lets you boot the PR’s build in the browser using https://trynix.dev. No servers, just browsers. 简而言之，trynix-preview 是一个 GitHub Action，它会在 Pull Request (PR) 中自动评论一个链接，让你能够通过 https://trynix.dev 在浏览器中直接启动该 PR 的构建版本。无需服务器，只需浏览器。

I ended my earlier trynix post with a list of ideas I think we could accomplish now that we can boot arbitrary /nix/store paths in the browser. The most obvious one was to let a reviewer boot a pull request’s build in the browser for testing, validation and feedback. That is now real. 🤯 我在之前关于 trynix 的文章结尾列出了一些想法，认为既然我们现在可以在浏览器中启动任意的 /nix/store 路径，那么这些想法就有可能实现。其中最显而易见的一个就是：让审查者能够在浏览器中启动 PR 的构建版本，以便进行测试、验证和反馈。现在，这已经成为现实。🤯

A demo is worth a 1000 words: here is a pull request (PR#31) against my sqlelf project, from a fork, with the comment our action left on it: Click the link and a Linux machine boots in your tab with that PR’s sqlelf on PATH. You did not clone anything, you did not build anything. No servers, no SSH, no VPN, no Docker, no VM, no cloud. Just a browser and a link. 😈 演示胜过千言万语：这是我的 sqlelf 项目的一个来自 fork 的 Pull Request (PR#31)，其中包含了我们的 Action 留下的评论：点击链接，一个 Linux 机器就会在你的标签页中启动，并且该 PR 的 sqlelf 已经配置在 PATH 中。你无需克隆任何东西，也无需构建任何东西。没有服务器、没有 SSH、没有 VPN、没有 Docker、没有虚拟机、没有云服务。只需要一个浏览器和一个链接。😈

§Gimme. Gimme. Gimme. §给我，给我，给我。

As with any GitHub action, it’s just a few lines to add to your workflow. The caveat is that you must have built and cached the path already, so the action can link to it. The action does not build or cache anything. 和任何 GitHub Action 一样，只需在你的工作流中添加几行代码即可。需要注意的是，你必须已经构建并缓存了该路径，这样 Action 才能链接到它。该 Action 本身不负责构建或缓存任何内容。

# Setup Cachix as our Nix cache.
- uses: cachix/cachix-action@v17
  with:
    name: sqlelf
    authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

# We build the pull request's code and push it to the cache, so the action can link to it.
- run: nix build .#default
- uses: fzakaria/trynix@v1
  with:
    cache: https://sqlelf.cachix.org
    publicKey: sqlelf.cachix.org-1:MLnjolA9AsKscTOJKDSA+ZAcgIK8BwZA574j4+Cs2bg=
    # You can have multiple attrs if you want to boot more than one path.
    attrs: .#default

The action publishes and builds nothing. Whatever already fills your cache keeps doing it, and the action’s whole job is to simply provide the store paths via nix eval and hand the cache’s URL and public key to the browser. It is not Nix cache provider specific, but I do recommend Cachix because it is free for open source up to 5GiB. You should definitely sign up for Cachix but you can test this out without it since the free tier is very generous. You can checkout my trynix.yaml workflow for the full example. 该 Action 不发布也不构建任何东西。无论是什么在填充你的缓存，它都会继续工作，而该 Action 的全部工作仅仅是通过 nix eval 提供存储路径，并将缓存的 URL 和公钥传递给浏览器。它并不局限于特定的 Nix 缓存提供商，但我推荐使用 Cachix，因为它为开源项目提供高达 5GiB 的免费额度。你绝对应该注册 Cachix，但即使不使用它，你也可以进行测试，因为它的免费层级非常慷慨。你可以查看我的 trynix.yaml 工作流以获取完整示例。

You have to set allow-unsafe-pr-checkout: true in the actions/checkout step because the workflow runs on a fork’s pull request, and that has security implications. I recommend a private segregated cache for pull request builds, so that a fork cannot push to your main cache. If that is not your cup of tea, there is a version where a maintainer types /trynix on the pull request which kicks off the workflow. In either case, the workflow runs on the default branch and checks out the pull request’s code, so a fork cannot edit the workflow that builds it. 你必须在 actions/checkout 步骤中设置 allow-unsafe-pr-checkout: true，因为工作流是在 fork 的 PR 上运行的，这涉及安全隐患。我建议为 PR 构建使用一个私有的隔离缓存，这样 fork 就无法推送到你的主缓存中。如果你不喜欢这种方式，还有一个版本是维护者在 PR 中输入 /trynix 来触发工作流。无论哪种情况，工作流都是在默认分支上运行并检出 PR 代码的，因此 fork 无法修改构建它的工作流。

§Game over? §游戏结束了吗？

Did I just upend all CI products by easily letting reviewers boot a PR? Unfortunately, no. 🥲 The performance for large binaries is pretty bad. Even with many of the improvements I AI-assisted into the engine, large binaries can still take 1-2 minutes to execute. I added a benchmark page, https://trynix.dev/bench/, to the site with a lot of rich data on boot and run times for various applications. 我是否通过让审查者轻松启动 PR 而颠覆了所有的 CI 产品？遗憾的是，并没有。🥲 对于大型二进制文件，性能表现相当糟糕。即使我在 AI 的辅助下对引擎进行了许多改进，大型二进制文件仍然可能需要 1-2 分钟才能执行。我在网站上添加了一个基准测试页面 https://trynix.dev/bench/，其中包含了各种应用程序启动和运行时间的丰富数据。

Nevertheless, this is still a pretty amazing workflow and showcases the power of Nix. Maybe as we get closer to AGI, our AI overlords will be able to optimize the engine to execute large binaries in a few seconds, but for now, the action is best suited for small to medium-sized binaries. 尽管如此，这仍然是一个非常了不起的工作流，展示了 Nix 的强大之处。也许随着我们越来越接近 AGI，我们的 AI 主宰们将能够优化引擎，在几秒钟内执行大型二进制文件，但就目前而言，该 Action 最适合小型到中型的二进制文件。