ci: propose the NixOS base image nixpkgs pin bump on a schedule

[tomassrnka]

The base image pins an exact nixpkgs release — that's what makes it reproducible, and also what makes it go stale silently, since nothing moves the pin. nixos-26.05 has taken 100+ commits in the last month, none of which we'd pick up.

This adds a monthly job that resolves the current release of whatever series the pin is already on and, if it moved, opens a draft PR updating build.sh and the README pin table. It deliberately does not build and does not publish: the value is turning "the userland is drifting" into a reviewable diff CI can run the distro build test against. Publishing stays manual, because the publish job's only gate inspects the rootfs tar — and a tar can pass every assertion while the image still cannot boot, which is exactly what 25.05 replacing $toplevel/init with the systemd binary produced. The bot also refuses to cross a series: 24.05 → 26.05 needed an activation shim, a stateVersion decision and real KVM verification, none of which a cron should attempt.

Uses the GitHub App token rather than GITHUB_TOKEN so the bump PR actually triggers CI, and checks the release's nixexprs.tar.xz is served before proposing a pin the build couldn't fetch. Verified by simulation against the current pin: the resolve step reads 26.05/nixos-26.05.6503.21ea275a7c46, the channel resolves to the same id (so today it correctly no-ops), the series guard passes, and a simulated newer release rewrites both files with zero stale mentions left.

[cursor]

PR Summary

Low Risk
Automation only proposes pin updates within the same NixOS series and does not build or publish images; main risk is a bad global README replace if the old release id appeared outside the pin table.

Overview
A scheduled (and manually dispatchable) GitHub Actions workflow keeps the premade NixOS base image from going stale by comparing the pinned NIXPKGS_RELEASE in build.sh to the current channels.nixos.org release for the existing NIXOS_SERIES. When the channel moved, it opens a draft PR that updates the pin in build.sh and the README table, using a GitHub App token so CI runs on that PR. It refuses cross-series bumps, skips work when already current or when a PR/branch for that release already exists, and checks that nixexprs.tar.xz is available before proposing. The base image README pin table drops the separate release/date row so it matches the simplified table format.

^{Reviewed by Cursor Bugbot for commit 327191e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
3727	2	3725	7

View the full list of 2 ❄️ flaky test(s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildDistroFamilies

Flake rate in main: 20.00% (Passed 88 times, Failed 22 times)

Stack Traces | 0s run time

=== RUN   TestTemplateBuildDistroFamilies
=== PAUSE TestTemplateBuildDistroFamilies
=== CONT  TestTemplateBuildDistroFamilies
--- FAIL: TestTemplateBuildDistroFamilies (0.00s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildDistroFamilies/Arch

Flake rate in main: 18.52% (Passed 88 times, Failed 20 times)

Stack Traces | 300s run time

=== RUN   TestTemplateBuildDistroFamilies/Arch
=== PAUSE TestTemplateBuildDistroFamilies/Arch
=== CONT  TestTemplateBuildDistroFamilies/Arch
    build_template_test.go:159: test-distro-arch: [info] Building template w9y59pwsqvbp1vhktxzb/56a17b3e-2f7e-4499-839a-38db2e60588d
    build_template_test.go:159: test-distro-arch: [info] [base] FROM archlinux:base [715034aabba64dcb025b46739c58e97dda26a116731027d92a86dcc0291cfbd7]
    build_template_test.go:159: test-distro-arch: [info] Base Docker image size: 133 MB
    build_template_test.go:159: test-distro-arch: [info] Creating file system and pulling Docker image
    build_template_test.go:159: test-distro-arch: [info] Uncompressing layer sha256:b29eedb0cba68b40ef1c21ad33ace0b0b65e43c800ce9ae3fb885ed388c8ff1f 133 MB
    build_template_test.go:159: test-distro-arch: [info] Uncompressing layer sha256:79c8b8c2b0d09dc3a8ac0a624ff34d637e7d300e2aa444e5daf77dea4d38cdd4 8.7 kB
    build_template_test.go:159: test-distro-arch: [info] Uncompressing layer sha256:f0d76845f1ade741b182544c1f7d9ef23e50b4e353c2fe7564dde52018074b15 14 MB
    build_template_test.go:159: test-distro-arch: [info] Uncompressing layer sha256:e216621d8a0a7a4486d6a228759b29bc378eff95e6ea9469854b8624b267dd13 137 B
    build_template_test.go:159: test-distro-arch: [info] Layers extracted
    build_template_test.go:159: test-distro-arch: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib64, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    build_template_test.go:159: test-distro-arch: [info] Provisioning sandbox template
    build_template_test.go:159: test-distro-arch: [info] Provisioning was successful, cleaning up
    build_template_test.go:159: test-distro-arch: [info] Sandbox template provisioned
    build_template_test.go:159: test-distro-arch: [info] [base] DEFAULT USER user [160a14646197f084356bc50932d931bdd26aa794f1d220052e16f21361a8b928]
    distro_build_test.go:66: 
        	Error Trace:	.../api/templates/build_template_test.go:124
        	            				.../api/templates/distro_build_test.go:66
        	Error:      	Received unexpected error:
        	            	Get "http://localhost:.../builds/56a17b3e-2f7e-4499-839a-38db2e60588d/status?logsOffset=14&level=info": context deadline exceeded
        	Test:       	TestTemplateBuildDistroFamilies/Arch
--- FAIL: TestTemplateBuildDistroFamilies/Arch (300.24s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e515fdd. Configure here.}