feat: add Nix flake for reproducible builds#100
Merged
Conversation
Adds flake.nix and flake.lock providing a Nix-native install path: nix run github:gitmpr/wt nix profile install github:gitmpr/wt The build uses buildGoModule with vendorHash and injects the version string via ldflags. Three sandbox quirks are handled explicitly: - git, bash, util-linux in nativeCheckInputs so tests have git, script(1), and a bash binary reachable by absolute path - postPatch rewrites #!/usr/bin/env bash in the runtime-generated test helper to an absolute nix store path, since /usr/bin/env is absent from the Nix build sandbox - preCheck initialises a git repo in the source tree so tests that call git in the working directory (TestGetAvailableBranches, TestDefaultCmdRunsWithoutError) find a valid repository
- Exclude internal e2e main package so only the wt binary is built/installed - Derive version from git rev instead of a hardcoded semver that goes stale - Resolve bash via exec.LookPath in the cleanup test, dropping the fragile postPatch shebang rewrite - Document flake-input usage for NixOS/home-manager (pkgs.wt does not exist) - Add maintainer note for refreshing vendorHash
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #100 +/- ##
==========================================
+ Coverage 30.48% 30.58% +0.10%
==========================================
Files 27 27
Lines 2805 2805
==========================================
+ Hits 855 858 +3
+ Misses 1864 1860 -4
- Partials 86 87 +1 🚀 New features to boost your workflow:
|
- Add a Linux 'nix' job to CI that runs `nix build .#wt` (which executes the sandboxed Go test suite) plus a version smoke test - Add a Dockerfile + .dockerignore for reproducing the flake build locally without installing Nix (docker build -t wt-nix .)
- Pin Dockerfile base to the nixos/nix digest that was validated - Pin nix-installer-action to the v22 release tag instead of @main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
flake.nix/flake.locksowtcan be installed and run via Nix. Builds on @gitmpr's work in #99 (their three commits are preserved here) and folds in the review +codexfindings from that PR.Changes on top of #99
e2emain package (excludedPackages = [ "e2e" ]) sonix profile installproduces only thewtbinary, not a straye2eorchestrator binary. UnlikesubPackages, this keeps the full test suite in check scope.self.shortRev) instead of a hardcoded0.1.29that silently goes stale after each release (release binaries are still versioned by goreleaser from the tag; the flake has no access to tags).bashviaexec.LookPathinremove_cleanup_test.goinstead of hardcoding#!/usr/bin/env bash, which removes the fragilepostPatchshebang rewrite entirely and is robust in any sandbox.gitin the binary's runtime PATH viamakeWrapper, sincewtshells out togitat ~39 sites — the package now works even when git isn't otherwise installed.util-linuxto Linux innativeCheckInputs(it's unavailable on Darwin, wherescript(1)ships with the base system) so the Darwin systems fromeachDefaultSystemevaluate.pkgs.wtdoesn't exist in nixpkgs; show a complete flake-input example. Also document that shell integration callsgitandscript(1)in the user's shell.vendorHash.Test plan
go build ./...and the fullgo test ./...suite passnix build .#wt— not run locally (nix isn't installed on this machine); please confirm via CI or a nix-capable machine that the build + sandboxed checks pass on Linux and DarwinCloses #99 (superseded).
Co-authored-by: gitmpr 89863774+gitmpr@users.noreply.github.com