fixup! tools: run CI with shared libs on GHA

Author: aduh95

.github/workflows/linters.yml

@@ -114,6 +114,20 @@ jobs:
           NODE=$(command -v node) make lint-md
         env:
           NODE_RELEASED_VERSIONS: ${{ steps.get-released-versions.outputs.NODE_RELEASED_VERSIONS }}
+  lint-nix:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
+        with:
+          persist-credentials: false
+      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31.6.1
+      - name: Lint Nix files
+        run: nix-shell -p '(import "${./nixpkgs.nix}" {}).nixfmt-tree' --run 'treefmt --fail-on-change'
+      - if: ${{ failure() }}
+        name: Show diff
+        run: git --no-pager diff
+
   lint-py:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest

.github/workflows/test-linux.yml

@@ -5,6 +5,7 @@ on:
     paths-ignore:
       - .mailmap
       - README.md
+      - '*.nix'
       - .github/**
       - '!.github/workflows/test-linux.yml'
     types: [opened, synchronize, reopened, ready_for_review]
@@ -17,6 +18,7 @@ on:
     paths-ignore:
       - .mailmap
       - README.md
+      - '*.nix'
       - .github/**
       - '!.github/workflows/test-linux.yml'
 

.github/workflows/test-macos.yml

@@ -6,6 +6,7 @@ on:
     paths-ignore:
       - .mailmap
       - '**.md'
+      - '*.nix'
       - AUTHORS
       - doc/**
       - .github/**
@@ -19,6 +20,7 @@ on:
     paths-ignore:
       - .mailmap
       - '**.md'
+      - '*.nix'
       - AUTHORS
       - doc/**
       - .github/**

.github/workflows/test-shared.yml

@@ -4,7 +4,9 @@ on:
   pull_request:
     paths-ignore:
       - .mailmap
-      - README.md
+      - '**.md'
+      - AUTHORS
+      - doc/**
       - .github/**
       - '!.github/workflows/test-shared.yml'
     types: [opened, synchronize, reopened, ready_for_review]
@@ -16,7 +18,9 @@ on:
       - v[0-9]+.x
     paths-ignore:
       - .mailmap
-      - README.md
+      - '**.md'
+      - AUTHORS
+      - doc/**
       - .github/**
       - '!.github/workflows/test-shared.yml'
   workflow_dispatch:
@@ -50,8 +54,6 @@ concurrency:
 
 env:
   FLAKY_TESTS: keep_retrying
-  NIXPKGS_REPO: https://github.com/NixOS/nixpkgs
-  NIXPKGS_PIN: ca77296380960cd497a765102eeb1356eb80fed0
 
 permissions:
   contents: read
@@ -140,11 +142,10 @@ jobs:
         env:
           EXPECTED_SHA: ${{ inputs.commit }}
 
-      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
+      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31.6.1
         with:
           extra_nix_config: sandbox = true
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
-          nix_path: nixpkgs=${{ env.NIXPKGS_REPO }}/archive/${{ env.NIXPKGS_PIN }}.tar.gz
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -173,7 +174,7 @@ jobs:
             --pure --keep TAR_DIR --keep FLAKY_TESTS \
             --keep SCCACHE_GHA_VERSION --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
             --arg loadJSBuiltinsDynamically false \
-            --arg ccache '(import <nixpkgs> {}).sccache' \
+            --arg ccache '(import "${./nixpkgs.nix}" {}).sccache' \
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
@@ -249,11 +250,10 @@ jobs:
           merge-multiple: true 
           path: raw-results
 
-      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
+      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31.6.1
         with:
           extra_nix_config: sandbox = true
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
-          nix_path: nixpkgs=${{ env.NIXPKGS_REPO }}/archive/${{ env.NIXPKGS_PIN }}.tar.gz
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:

.github/workflows/tools.yml

@@ -306,6 +306,9 @@ jobs:
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
+      - name: Set up Nix
+        if: matrix.id == 'nixpkgs-unstable' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
+        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31.6.1
       - run: ${{ matrix.run }}
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         env:

nixpkgs.nix

@@ -0,0 +1,10 @@
+arg:
+let
+  repo = "https://github.com/NixOS/nixpkgs";
+  rev = "ca77296380960cd497a765102eeb1356eb80fed0";
+  nixpkgs = import (builtins.fetchTarball {
+    url = "${repo}/archive/${rev}.tar.gz";
+    sha256 = "1airrw6l87iyny1a3mb29l28na4s4llifprlgpll2na461jd40iy";
+  }) arg;
+in
+  nixpkgs

shell.nix

@@ -1,5 +1,5 @@
 {
-  pkgs ? import <nixpkgs> {},
+  pkgs ? import "${./nixpkgs.nix}" {},
   loadJSBuiltinsDynamically ? true, # Load `lib/**.js` from disk instead of embedding
   ncu-path ? null, # Provide this if you want to use a local version of NCU
   icu ? pkgs.icu,

tools/dep_updaters/update-nixpkgs-pin.sh

@@ -4,11 +4,11 @@ set -ex
 # version on the unstable channel.
 
 BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
-WORKFLOW_FILE="$BASE_DIR/.github/workflows/test-shared.yml"
+NIXPKGS_PIN_FILE="$BASE_DIR/nixpkgs.nix"
 
-NIXPKGS_REPO=$(grep NIXPKGS_REPO: "$WORKFLOW_FILE" | awk -F': ' '{ print $2 }')
-CURRENT_VERSION_SHA1=$(grep NIXPKGS_PIN: "$WORKFLOW_FILE" | awk -F': ' '{ print $2 }')
-CURRENT_VERSION=$(echo "$CURRENT_UPSTREAM_SHA1" | head -c 7)
+NIXPKGS_REPO=$(grep 'repo =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
+CURRENT_VERSION_SHA1=$(grep 'rev =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
+CURRENT_VERSION=$(echo "$CURRENT_VERSION_SHA1" | head -c 7)
 
 NEW_UPSTREAM_SHA1=$(git ls-remote "$NIXPKGS_REPO.git" nixpkgs-unstable | awk '{print $1}')
 NEW_VERSION=$(echo "$NEW_UPSTREAM_SHA1" | head -c 7)
@@ -19,17 +19,21 @@ NEW_VERSION=$(echo "$NEW_UPSTREAM_SHA1" | head -c 7)
 
 compare_dependency_version "nixpkgs-unstable" "$NEW_VERSION" "$CURRENT_VERSION"
 
+CURRENT_TARBALL_HASH=$(grep 'sha256 =' "$NIXPKGS_PIN_FILE" | awk -F'"' '{ print $2 }')
+NEW_TARBALL_HASH=$(nix-prefetch-url --unpack "$NIXPKGS_REPO/archive/$NEW_UPSTREAM_SHA1.tar.gz")
+
 TMP_FILE=$(mktemp)
-sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/" "$WORKFLOW_FILE" > "$TMP_FILE"
-mv "$TMP_FILE" "$WORKFLOW_FILE"
-
-echo "All done!"
-echo ""
-echo "Please git add and commit the new version:"
-echo ""
-echo "$ git add $WORKFLOW_FILE"
-echo "$ git commit -m 'tools: bump nixpkgs-unstable pin to $NEW_VERSION'"
-echo ""
+sed "s/$CURRENT_VERSION_SHA1/$NEW_UPSTREAM_SHA1/;s/$CURRENT_TARBALL_HASH/$NEW_TARBALL_HASH/" "$NIXPKGS_PIN_FILE" > "$TMP_FILE"
+mv "$TMP_FILE" "$NIXPKGS_PIN_FILE"
+
+cat -<<EOF
+All done!
+
+Please git add and commit the new version:
+
+$ git add $NIXPKGS_PIN_FILE
+$ git commit -m 'tools: bump nixpkgs-unstable pin to $NEW_VERSION'
+EOF
 
 # The last line of the script should always print the new version,
 # as we need to add it to $GITHUB_ENV variable.