-
Notifications
You must be signed in to change notification settings - Fork 290
The Nix pipelines #1573
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
The Nix pipelines #1573
Changes from 11 commits
8c71204
7928e44
0211e90
77afd70
f2b9f7b
b7d3fe6
7d29e15
5eda373
575e04c
6f6e2a3
8241a02
c2ae2b3
5586b14
2827fe6
7607154
5c33e8a
15759b6
ac320ca
1a6f4d9
e32a721
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,4 @@ | ||
# Doesn't work in the sandbox | ||
[yanked] | ||
enabled = false # Warn for yanked crates in Cargo.lock (default: true) | ||
update_index = false # Auto-update the crates.io index (default: true) |
Sk7Str1p3 marked this conversation as resolved.
Show resolved
Hide resolved
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
use flake |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,24 @@ | ||
name: update-flake-lock | ||
|
||
on: | ||
workflow_dispatch: # allows manual triggering | ||
schedule: | ||
- cron: '0 0 * * 0' # runs weekly on Sunday at 00:00 | ||
|
||
jobs: | ||
lockfile: | ||
runs-on: ubuntu-latest | ||
steps: | ||
- name: Checkout repository | ||
uses: actions/checkout@v4 | ||
- name: Install Determinate Nix | ||
uses: DeterminateSystems/nix-installer-action@main | ||
with: | ||
determinate: true | ||
- name: Update flake.lock | ||
uses: DeterminateSystems/update-flake-lock@main | ||
with: | ||
pr-title: "Update flake.lock" # Title of PR to be created | ||
pr-labels: | # Labels to be set on the PR | ||
dependencies | ||
automated |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -3,6 +3,7 @@ | |
/stage | ||
/parts | ||
/prime | ||
.direnv | ||
.gitignore.swp | ||
.DS_Store | ||
result | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,2 @@ | ||
[licenses] | ||
allow = ["MIT"] |
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'll have to research flake later, but could you discuss the pros of tracking the lock file in the repository? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Same pros of tracking cargo.lock in repository - to be sure the shell will be SAME, and to be sure it is going to behave same way anywhere. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I suppose the question is: do we need that amount of consistency? Or can we trust that the requirements and constraints in Continuing with the comparison to There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Not including it would null most of nix's benefits. I have yet to find a single nix flake without its respective lockfile attached. Just my 2cts here. :) There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I see, that makes sense. But I believe having to regularly update the lock file was part of the reason that the initial attempt was reverted (#1549 (comment)). I'm guessing that these benefits are being able to create a reproducible environment? IMO that's not always the highest priority -- our devcontainer config isn't that strict, for example (actually I think it's a bit too strict right now). Sometimes ease of setup, with the assumption that a well-functioning environment will be built, is enough. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. That's why I added workflow updating Although now I realized I didn't check it yet and don't really know how do I do that 😅. I'm doing some research right now. Also, (I didn't checked yet, but) I believe nix would refuse to work with flake.lock in .gitignore |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
@@ -0,0 +1,170 @@ | ||||||
{ | ||||||
description = '' | ||||||
Git repository summary on your terminal | ||||||
''; | ||||||
|
||||||
inputs = { | ||||||
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; | ||||||
crane.url = "github:ipetkov/crane"; | ||||||
flake-utils.url = "github:numtide/flake-utils"; | ||||||
|
||||||
advisory-db = { | ||||||
url = "github:rustsec/advisory-db"; | ||||||
flake = false; | ||||||
}; | ||||||
}; | ||||||
|
||||||
outputs = | ||||||
{ | ||||||
self, | ||||||
nixpkgs, | ||||||
crane, | ||||||
flake-utils, | ||||||
advisory-db, | ||||||
... | ||||||
}: | ||||||
flake-utils.lib.eachDefaultSystem ( | ||||||
system: | ||||||
let | ||||||
pkgs = nixpkgs.legacyPackages.${system}; | ||||||
|
||||||
inherit (pkgs) lib; | ||||||
|
||||||
craneLib = crane.mkLib pkgs; | ||||||
src = ./.; | ||||||
|
||||||
# Common arguments can be set here to avoid repeating them later | ||||||
common = { | ||||||
inherit src; | ||||||
strictDeps = true; | ||||||
|
||||||
# Bunch of libraries required for package proper work | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
buildInputs = | ||||||
with pkgs; | ||||||
[ | ||||||
# package dependencies | ||||||
zstd | ||||||
] | ||||||
++ lib.optionals pkgs.stdenv.isDarwin ( | ||||||
with pkgs; | ||||||
[ | ||||||
# additional dependencies on Darwin systems | ||||||
CoreFoundation | ||||||
libresolv | ||||||
Security | ||||||
] | ||||||
); | ||||||
# Software required for project build | ||||||
nativeBuildInputs = with pkgs; [ | ||||||
cmake | ||||||
pkg-config | ||||||
]; | ||||||
# Tools required for checks | ||||||
nativeCheckInputs = with pkgs; [ git ]; | ||||||
|
||||||
# Additional environment variables can be set directly | ||||||
# MY_CUSTOM_VAR = "some value"; | ||||||
}; | ||||||
|
||||||
# Build dependencies only, so we will be able to reuse them further | ||||||
cargoArtifacts = craneLib.buildDepsOnly common; | ||||||
|
||||||
# Build the actual crate itself, reusing the dependency | ||||||
# artifacts from above. | ||||||
build = craneLib.buildPackage (common // { inherit cargoArtifacts; }); | ||||||
in | ||||||
{ | ||||||
checks = { | ||||||
# Build the crate as part of `nix flake check` for convenience | ||||||
inherit build; | ||||||
|
||||||
# Run clippy (and deny all warnings) on the crate source, | ||||||
# again, reusing the dependency artifacts from above. | ||||||
clippy = craneLib.cargoClippy ( | ||||||
common | ||||||
// { | ||||||
inherit cargoArtifacts; | ||||||
cargoClippyExtraArgs = "--all-targets -- --deny warnings"; | ||||||
} | ||||||
); | ||||||
|
||||||
doc = craneLib.cargoDoc (common // { inherit cargoArtifacts; }); | ||||||
|
||||||
# Check formatting | ||||||
fmt = craneLib.cargoFmt { inherit src; }; | ||||||
|
||||||
tomlFmt = craneLib.taploFmt { | ||||||
src = pkgs.lib.sources.sourceFilesBySuffices src [ ".toml" ]; | ||||||
# taplo arguments can be further customized below as needed | ||||||
# taploExtraArgs = "--config ./taplo.toml"; | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The commented taplo configuration line references './taplo.toml' but the actual taplo.toml file exists at the project root. This should be uncommented and the path corrected to just 'taplo.toml' or removed if not needed.
Suggested change
Copilot uses AI. Check for mistakes. Positive FeedbackNegative Feedback |
||||||
}; | ||||||
|
||||||
# Audit dependencies | ||||||
audit = craneLib.cargoAudit { inherit src advisory-db; }; | ||||||
|
||||||
# Audit licenses | ||||||
deny = craneLib.cargoDeny { inherit src; }; | ||||||
|
||||||
# Run tests with cargo-nextest | ||||||
# Consider setting `doCheck = false` on `my-crate` if you do not want | ||||||
# the tests to run twice | ||||||
nextest = craneLib.cargoNextest ( | ||||||
common | ||||||
// { | ||||||
inherit cargoArtifacts; | ||||||
partitions = 1; | ||||||
partitionType = "count"; | ||||||
cargoNextestPartitionsExtraArgs = "--no-tests=pass"; | ||||||
} | ||||||
); | ||||||
}; | ||||||
|
||||||
packages = rec { | ||||||
onefetch-debug = craneLib.buildPackage ( | ||||||
common | ||||||
// { | ||||||
inherit cargoArtifacts; | ||||||
doCheck = false; | ||||||
CARGO_PROFILE = "dev"; | ||||||
} | ||||||
); | ||||||
onefetch = craneLib.buildPackage ( | ||||||
common | ||||||
// { | ||||||
inherit cargoArtifacts; | ||||||
doCheck = false; | ||||||
} | ||||||
); | ||||||
default = onefetch-debug; | ||||||
}; | ||||||
|
||||||
apps.default = flake-utils.lib.mkApp { drv = build; }; | ||||||
|
||||||
devShells.default = craneLib.devShell { | ||||||
# Inherit inputs from checks. | ||||||
checks = self.checks.${system}; | ||||||
|
||||||
# Additional dev-shell environment variables can be set directly | ||||||
# MY_CUSTOM_DEVELOPMENT_VAR = "something else"; | ||||||
|
||||||
# Extra inputs can be added here; cargo and rustc are provided by default. | ||||||
packages = with pkgs; [ | ||||||
# pkgs.ripgrep | ||||||
nixd | ||||||
nixfmt-rfc-style | ||||||
]; | ||||||
}; | ||||||
} | ||||||
); | ||||||
# Sets substituters to avoid locally building something already built | ||||||
nixConfig = { | ||||||
extra-substituters = [ | ||||||
"https://crane.cachix.org" | ||||||
"https://cache.garnix.io" | ||||||
]; | ||||||
extra-trusted-public-keys = [ | ||||||
"crane.cachix.org-1:8Scfpmn9w+hGdXH/Q9tTLiYAE/2dnJYRJP7kl80GuRk=" | ||||||
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=" | ||||||
]; | ||||||
}; | ||||||
} |
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Setting up TOML formatting sounds good to me, but TBH I think this can go in a separate PR. That way we can get TOML formatting merged in faster while we still discuss flake. |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,24 @@ | ||
# Sorts `Cargo.toml` dependencies. All other `.toml` files are formatted with the default config. | ||
# | ||
# https://taplo.tamasfe.dev/configuration/file.html#configuration-file | ||
|
||
[formatting] | ||
align_comments = true | ||
align_entries = true | ||
# | ||
array_auto_collapse = false | ||
array_auto_expand = true | ||
array_trailing_comma = true | ||
# | ||
compact_arrays = false | ||
compact_entries = false | ||
compact_inline_tables = false | ||
# | ||
indent_entries = true | ||
indent_tables = true | ||
# | ||
reorder_arrays = true | ||
reorder_inline_tables = true | ||
reorder_keys = true | ||
# | ||
crlf = true | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Definitely not CRLF for formatting. We do try to alphabetize, so that makes sense. Other than that, I'll leave preferences up to @o2sh to decide. I'll probably cherry-pick the taplo configuration, since it's not dependent on any sort of Nix configuration. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Done Btw @o2sh this is formatted Cargo.toml
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What happens in the sandbox? Does it fail to send HTTP requests to crates.io?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Did not checked (this is crane generated defaults) but I suppose yes it fails
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Got it. Makes sense if this file was generated by some tool.
But I don't think we'd want to disable audits for yanked crates just because a dev tool doesn't work well with it.