fix(nix): use system-specific hashes for pnpm deps

Different platforms download different platform-specific npm packages
(e.g., darwin-arm64 vs linux-x64 binaries), resulting in different
hashes for pnpm deps.

- Add pnpmDepsHash map with per-system hashes
- Update hash script to detect current system and update only that hash
- Add hashes for x86_64-linux (CI) and aarch64-darwin (local dev)

Author: ryoppippi

flake.nix

@@ -16,11 +16,16 @@
       ];
 
       perSystem =
-        { pkgs, ... }:
+        { pkgs, system, ... }:
         {
           packages.default =
             let
               packageJson = builtins.fromJSON (builtins.readFile ./package.json);
+              pnpmDepsHash = {
+                x86_64-linux = "sha256-PrCGXf5r03gfsoGJAzew592Al1G5dx6xa/qFxazuqUo=";
+                aarch64-linux = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+                aarch64-darwin = "sha256-GDY7RZUl6A0d3l8Rz6X1sHQfwHgM2GKpcJ65yAKOmrg=";
+              };
             in
             pkgs.stdenv.mkDerivation (finalAttrs: {
               pname = "stackone-ai";
@@ -36,7 +41,7 @@
 
               pnpmDeps = pkgs.pnpm_10.fetchDeps {
                 inherit (finalAttrs) pname version src;
-                hash = "sha256-GDY7RZUl6A0d3l8Rz6X1sHQfwHgM2GKpcJ65yAKOmrg=";
+                hash = pnpmDepsHash.${system};
                 fetcherVersion = 1;
               };
 

scripts/update-pnpm-hash.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Update pnpm deps hash in flake.nix
+# Update pnpm deps hash in flake.nix for the current system
 # This script runs nix build to get the correct hash and updates flake.nix
 
 FLAKE_FILE="flake.nix"
@@ -12,6 +12,10 @@ if [[ ! -f "$FLAKE_FILE" ]]; then
   exit 1
 fi
 
+# Detect current system
+SYSTEM=$(nix eval --impure --raw --expr 'builtins.currentSystem')
+echo "Current system: $SYSTEM"
+
 # Run nix build and capture the output
 echo "Calculating pnpm deps hash..."
 OUTPUT=$(nix build --no-link 2>&1 || true)
@@ -26,13 +30,13 @@ if echo "$OUTPUT" | grep -q "hash mismatch"; then
     exit 1
   fi
 
-  echo "New hash: $NEW_HASH"
+  echo "New hash for $SYSTEM: $NEW_HASH"
 
-  # Update the hash in flake.nix (simple pattern for the hash line)
-  sed -i.bak "s|hash = \"sha256-[^\"]*\"|hash = \"${NEW_HASH}\"|" "$FLAKE_FILE"
+  # Update the hash for current system in flake.nix
+  sed -i.bak "s|${SYSTEM} = \"sha256-[^\"]*\"|${SYSTEM} = \"${NEW_HASH}\"|" "$FLAKE_FILE"
   rm -f "${FLAKE_FILE}.bak"
 
-  echo "Updated $FLAKE_FILE with new hash"
+  echo "Updated $FLAKE_FILE with new hash for $SYSTEM"
 else
-  echo "Hash is up to date"
+  echo "Hash is up to date for $SYSTEM"
 fi