7056edce28
* fix(nix): replace manual hash management with bun2nix Eliminate the recurring problem of Nix build hashes breaking whenever bun dependencies change or the bun version in nixpkgs updates. Changes: - Add bun2nix flake input (pinned to v2.0.1) for per-package fetchurl expressions from bun.lock, replacing the single FOD hash approach - Use allowBuiltinFetchGit for cargo git dependencies, removing manual outputHashes that required updates on every git dep change - Add scripts/check-nix-deps.ts (cross-platform, runs via bun) that auto-regenerates .nix/bun.nix when bun.lock changes, triggered by the postinstall hook in package.json - Update CI workflow to verify bun.nix is in sync and evaluate flake - Remove scripts/update-nix-hashes.sh (no longer needed) * style: format check-nix-deps.ts with prettier * ci(nix): make nix-check job a required check * fix(nix): address review feedback - Fix bun2nix input pinning: use path syntax (github:owner/repo/tag) instead of ?tag= query parameter so flake.lock records the ref and `nix flake update` respects the pin - Make check-nix-deps.ts exit with 0 on bun2nix failure so that `bun install` is not blocked for non-Nix developers (CI validates bun.nix independently) - Fix stale reference to check-nix-deps.sh in flake.nix comment * ci(nix): add full nix build step to CI workflow Add `nix build .#handy -L --show-trace` after flake evaluation to catch runtime build errors (broken dependencies, sandbox issues, compilation failures) that flake eval alone cannot detect. * fix(nix): update bun2nix pin from 2.0.1 to 2.0.8 bun2nix 2.0.1 has a bug in cache-entry-creator that causes "ln: failed to create symbolic link '/p': Permission denied" during the build. Version 2.0.8 fixes this.
80 lines
3.4 KiB
YAML
80 lines
3.4 KiB
YAML
# Verify that Nix dependency files (.nix/bun.nix) are in sync with lockfiles
|
|
# and that the flake evaluates successfully.
|
|
#
|
|
# This catches cases where a developer updated bun.lock but forgot to
|
|
# regenerate .nix/bun.nix (e.g., committed without running bun install,
|
|
# which triggers the postinstall hook).
|
|
|
|
name: "nix build check"
|
|
on: [pull_request]
|
|
|
|
jobs:
|
|
nix-build:
|
|
runs-on: ubuntu-24.04
|
|
continue-on-error: false
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: oven-sh/setup-bun@v2
|
|
|
|
- uses: cachix/install-nix-action@v30
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
|
|
# Regenerate .nix/bun.nix from bun.lock and check if it matches
|
|
# what's committed. A diff means the developer forgot to run
|
|
# bun scripts/check-nix-deps.ts or bun install (which triggers it).
|
|
- name: Check bun.nix is up to date
|
|
id: bun-check
|
|
run: |
|
|
bunx bun2nix -o .nix/bun.nix
|
|
if ! git diff --quiet .nix/bun.nix; then
|
|
echo "outdated=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Hint on outdated bun.nix
|
|
if: steps.bun-check.outputs.outdated == 'true'
|
|
run: |
|
|
echo ""
|
|
echo "::warning::.nix/bun.nix is out of sync with bun.lock"
|
|
echo ""
|
|
echo "┌──────────────────────────────────────────────────────────────┐"
|
|
echo "│ .nix/bun.nix is outdated. To fix, run: │"
|
|
echo "│ │"
|
|
echo "│ bun scripts/check-nix-deps.ts │"
|
|
echo "│ │"
|
|
echo "│ Or simply run 'bun install' — the postinstall hook will │"
|
|
echo "│ regenerate it automatically. Commit the resulting changes. │"
|
|
echo "└──────────────────────────────────────────────────────────────┘"
|
|
echo ""
|
|
echo "Diff:"
|
|
git diff .nix/bun.nix
|
|
exit 1
|
|
|
|
# Evaluate the flake to catch issues with cargo git dependency hashes,
|
|
# missing inputs, or other Nix expression errors.
|
|
# Skip if bun.nix is already outdated — nix eval would fail with a
|
|
# cryptic error, and the bun-check step already printed a clear message.
|
|
- name: Check flake evaluation
|
|
if: steps.bun-check.outputs.outdated != 'true'
|
|
id: eval
|
|
run: |
|
|
if ! nix eval .#packages.x86_64-linux.handy.drvPath 2>eval_err.log; then
|
|
echo "failed=true" >> "$GITHUB_OUTPUT"
|
|
cat eval_err.log
|
|
fi
|
|
|
|
- name: Hint on evaluation failure
|
|
if: steps.eval.outputs.failed == 'true'
|
|
run: |
|
|
echo ""
|
|
echo "::warning::flake.nix evaluation failed"
|
|
echo ""
|
|
cat eval_err.log
|
|
exit 1
|
|
|
|
# Full build — catches runtime build errors (broken dependencies,
|
|
# sandbox issues, compilation failures) that flake eval alone misses.
|
|
- name: Build handy
|
|
if: steps.bun-check.outputs.outdated != 'true' && steps.eval.outputs.failed != 'true'
|
|
run: nix build .#handy -L --show-trace
|