From 710d095b8b5ea57316ab2256e18c6c56a412ac2a Mon Sep 17 00:00:00 2001 From: furedea <132188853+furedea@users.noreply.github.com> Date: Mon, 9 Nov 2026 21:39:22 +0900 Subject: [PATCH 1/3] build(nix): provide the dev shell for x86_64-linux Refs furedea/reusable-workflows#23 Co-Authored-By: Claude Sonnet 5.5 --- flake.nix | 65 +++++++++++++++++++++++++++++++----------------------- nix/uv.nix | 22 ++++++++++++++---- 2 files changed, 56 insertions(+), 31 deletions(-) diff --git a/flake.nix b/flake.nix index 11c3c18..f2db576 100644 --- a/flake.nix +++ b/flake.nix @@ -9,36 +9,47 @@ outputs = { nixpkgs, nixpkgs-unstable, ... }: let - system = "aarch64-darwin"; - pkgs = import nixpkgs { inherit system; }; + systems = [ + "aarch64-darwin" + "x86_64-linux" + ]; + forAllSystems = nixpkgs.lib.genAttrs systems; in { - devShells.${system}.default = pkgs.mkShell { - packages = - (with pkgs; [ - commitlint - deadnix - ls-lint - nixfmt - statix - ]) - ++ [ - (pkgs.callPackage ./nix/python.nix { }) - (pkgs.callPackage ./nix/uv.nix { }) - # lefthook before 2.1.6 runs hooks under a pty, which agent sandboxes deny. - nixpkgs-unstable.legacyPackages.${system}.lefthook - ]; + devShells = forAllSystems ( + system: + let + pkgs = import nixpkgs { inherit system; }; + in + { + default = pkgs.mkShell { + packages = + (with pkgs; [ + commitlint + deadnix + ls-lint + nixfmt + statix + ]) + ++ [ + (pkgs.callPackage ./nix/python.nix { }) + (pkgs.callPackage ./nix/uv.nix { }) + # lefthook before 2.1.6 runs hooks under a pty, which agent sandboxes deny. + nixpkgs-unstable.legacyPackages.${system}.lefthook + ]; - env = { - UV_PYTHON_DOWNLOADS = "never"; - UV_PYTHON_PREFERENCE = "only-system"; - }; + env = { + UV_PYTHON_DOWNLOADS = "never"; + UV_PYTHON_PREFERENCE = "only-system"; + }; - shellHook = '' - if [ -d .venv/bin ]; then - export PATH="$PWD/.venv/bin:$PATH" - fi - ''; - }; + shellHook = '' + if [ -d .venv/bin ]; then + export PATH="$PWD/.venv/bin:$PATH" + fi + ''; + }; + } + ); }; } diff --git a/nix/uv.nix b/nix/uv.nix index 006cd96..b921599 100644 --- a/nix/uv.nix +++ b/nix/uv.nix @@ -8,13 +8,27 @@ # TODO: Drop this and use pkgs.uv once the nixpkgs input has >= 0.13.5. # Official build of uv 0.13.5. 0.13.4 drops the compromised emSign root from its bundled CA store, # but 0.13.5 is the first release that can install managed CPython 3.14.9. +let + # Hashes are the sha256 digests that GitHub reports for each release asset. + assets = { + aarch64-darwin = { + target = "aarch64-apple-darwin"; + hash = "sha256-dD+FA1oZluyzUGWeAc2frqlwmCm+CbG0sDxz6vPJzXM="; + }; + x86_64-linux = { + target = "x86_64-unknown-linux-musl"; + hash = "sha256-V++dnMsB+xvZmN+ZWw3SIbUvfXhB++qT8tRGO/Yft6k="; + }; + }; + asset = assets.${stdenvNoCC.hostPlatform.system}; +in stdenvNoCC.mkDerivation (finalAttrs: { pname = "uv"; version = "0.13.5"; src = fetchurl { - url = "https://github.com/astral-sh/uv/releases/download/${finalAttrs.version}/uv-aarch64-apple-darwin.tar.gz"; - hash = "sha256-dD+FA1oZluyzUGWeAc2frqlwmCm+CbG0sDxz6vPJzXM="; + url = "https://github.com/astral-sh/uv/releases/download/${finalAttrs.version}/uv-${asset.target}.tar.gz"; + inherit (asset) hash; }; dontBuild = true; @@ -30,14 +44,14 @@ stdenvNoCC.mkDerivation (finalAttrs: { doInstallCheck = true; meta = { - description = "Python package and project manager, official macOS build"; + description = "Python package and project manager, official binary build"; homepage = "https://github.com/astral-sh/uv"; license = with lib.licenses; [ asl20 mit ]; mainProgram = "uv"; - platforms = [ "aarch64-darwin" ]; + platforms = builtins.attrNames assets; sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; }; }) From 3b0401a2c6c464b47c0c92e53320fe403985b2fe Mon Sep 17 00:00:00 2001 From: furedea <132188853+furedea@users.noreply.github.com> Date: Mon, 9 Nov 2026 21:40:09 +0900 Subject: [PATCH 2/3] ci: run language tools from the flake dev shell Replace setup-uv with the nix-setup composite action and run every step in nix develop. The nix-setup SHA is a placeholder until the release exists. Refs furedea/reusable-workflows#23 Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/ci.yml | 31 ++++++++++--------------------- 1 file changed, 10 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4d451a6..64e6637 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ env: defaults: run: - shell: bash + shell: nix develop --command bash -eo pipefail {0} jobs: nix-lint: @@ -36,11 +36,8 @@ jobs: with: persist-credentials: false - - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 - with: - version: "0.13.5" - python-version: "3.14.9" + - name: Set up Nix + uses: furedea/reusable-workflows/.github/actions/nix-setup@RELEASE_SHA # vRELEASE - name: Run ruff check run: uv run ruff check @@ -59,11 +56,8 @@ jobs: with: persist-credentials: false - - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 - with: - version: "0.13.5" - python-version: "3.14.9" + - name: Set up Nix + uses: furedea/reusable-workflows/.github/actions/nix-setup@RELEASE_SHA # vRELEASE - name: Run ty run: uv run ty check @@ -79,11 +73,8 @@ jobs: with: persist-credentials: false - - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 - with: - version: "0.13.5" - python-version: "3.14.9" + - name: Set up Nix + uses: furedea/reusable-workflows/.github/actions/nix-setup@RELEASE_SHA # vRELEASE - name: Run tests run: uv run pytest --cov @@ -99,11 +90,8 @@ jobs: with: persist-credentials: false - - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 - with: - version: "0.13.5" - python-version: "3.14.9" + - name: Set up Nix + uses: furedea/reusable-workflows/.github/actions/nix-setup@RELEASE_SHA # vRELEASE - name: Run deptry run: uv run --group audit deptry . @@ -163,4 +151,5 @@ jobs: steps: - name: Fail if any prerequisite did not succeed if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') + shell: bash run: exit 1 From dd4ee4a25a43b37b7841943c1ea549e19ae99261 Mon Sep 17 00:00:00 2001 From: furedea <132188853+furedea@users.noreply.github.com> Date: Mon, 9 Nov 2026 21:52:28 +0900 Subject: [PATCH 3/3] ci: pin nix-setup to v1.3.0 Refs furedea/reusable-workflows#23 Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 64e6637..824890f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,7 +37,7 @@ jobs: persist-credentials: false - name: Set up Nix - uses: furedea/reusable-workflows/.github/actions/nix-setup@RELEASE_SHA # vRELEASE + uses: furedea/reusable-workflows/.github/actions/nix-setup@2ae953294b9a805d0705657adc1d9d4f1bc1f646 # v1.3.0 - name: Run ruff check run: uv run ruff check @@ -57,7 +57,7 @@ jobs: persist-credentials: false - name: Set up Nix - uses: furedea/reusable-workflows/.github/actions/nix-setup@RELEASE_SHA # vRELEASE + uses: furedea/reusable-workflows/.github/actions/nix-setup@2ae953294b9a805d0705657adc1d9d4f1bc1f646 # v1.3.0 - name: Run ty run: uv run ty check @@ -74,7 +74,7 @@ jobs: persist-credentials: false - name: Set up Nix - uses: furedea/reusable-workflows/.github/actions/nix-setup@RELEASE_SHA # vRELEASE + uses: furedea/reusable-workflows/.github/actions/nix-setup@2ae953294b9a805d0705657adc1d9d4f1bc1f646 # v1.3.0 - name: Run tests run: uv run pytest --cov @@ -91,7 +91,7 @@ jobs: persist-credentials: false - name: Set up Nix - uses: furedea/reusable-workflows/.github/actions/nix-setup@RELEASE_SHA # vRELEASE + uses: furedea/reusable-workflows/.github/actions/nix-setup@2ae953294b9a805d0705657adc1d9d4f1bc1f646 # v1.3.0 - name: Run deptry run: uv run --group audit deptry .