Skip to content

ci: run language tools from the flake dev shell #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
furedea merged 3 commits into from
Nov 9, 2026
Merged

ci: run language tools from the flake dev shell #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
710d095
build(nix): provide the dev shell for x86_64-linux
furedea Nov 9, 2026
3b0401a
ci: run language tools from the flake dev shell
furedea Nov 9, 2026
dd4ee4a
ci: pin nix-setup to v1.3.0
furedea Nov 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 10 additions & 21 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ env:

defaults:
run:
shell: bash
shell: nix develop --command bash -eo pipefail {0}

jobs:
nix-lint:
Expand All @@ -36,11 +36,8 @@ jobs:
with:
persist-credentials: false

- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.13.5"
python-version: "3.14.9"
- name: Set up Nix
uses: furedea/reusable-workflows/.github/actions/nix-setup@2ae953294b9a805d0705657adc1d9d4f1bc1f646 # v1.3.0

- name: Run ruff check
run: uv run ruff check
Expand All @@ -59,11 +56,8 @@ jobs:
with:
persist-credentials: false

- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.13.5"
python-version: "3.14.9"
- name: Set up Nix
uses: furedea/reusable-workflows/.github/actions/nix-setup@2ae953294b9a805d0705657adc1d9d4f1bc1f646 # v1.3.0

- name: Run ty
run: uv run ty check
Expand All @@ -79,11 +73,8 @@ jobs:
with:
persist-credentials: false

- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.13.5"
python-version: "3.14.9"
- name: Set up Nix
uses: furedea/reusable-workflows/.github/actions/nix-setup@2ae953294b9a805d0705657adc1d9d4f1bc1f646 # v1.3.0

- name: Run tests
run: uv run pytest --cov
Expand All @@ -99,11 +90,8 @@ jobs:
with:
persist-credentials: false

- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.13.5"
python-version: "3.14.9"
- name: Set up Nix
uses: furedea/reusable-workflows/.github/actions/nix-setup@2ae953294b9a805d0705657adc1d9d4f1bc1f646 # v1.3.0

- name: Run deptry
run: uv run --group audit deptry .
Expand Down Expand Up @@ -163,4 +151,5 @@ jobs:
steps:
- name: Fail if any prerequisite did not succeed
if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
shell: bash
run: exit 1
65 changes: 38 additions & 27 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,36 +9,47 @@
outputs =
{ nixpkgs, nixpkgs-unstable, ... }:
let
system = "aarch64-darwin";
pkgs = import nixpkgs { inherit system; };
systems = [
"aarch64-darwin"
"x86_64-linux"
];
forAllSystems = nixpkgs.lib.genAttrs systems;
in
{
devShells.${system}.default = pkgs.mkShell {
packages =
(with pkgs; [
commitlint
deadnix
ls-lint
nixfmt
statix
])
++ [
(pkgs.callPackage ./nix/python.nix { })
(pkgs.callPackage ./nix/uv.nix { })
# lefthook before 2.1.6 runs hooks under a pty, which agent sandboxes deny.
nixpkgs-unstable.legacyPackages.${system}.lefthook
];
devShells = forAllSystems (
system:
let
pkgs = import nixpkgs { inherit system; };
in
{
default = pkgs.mkShell {
packages =
(with pkgs; [
commitlint
deadnix
ls-lint
nixfmt
statix
])
++ [
(pkgs.callPackage ./nix/python.nix { })

@github-actions github-actions Bot Nov 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: CPython 3.14.9 will be compiled from source on every Linux CI job

nix/python.nix replaces python314's src and postPatch, which gives it a new derivation hash. cache.nixos.org can't have a prebuilt copy, so the first nix develop in each of lint, typecheck, test and audit compiles CPython from source. On x86_64-linux nixpkgs also turns on LTO by default, which makes the build slower. On a standard ubuntu-latest runner that build can take close to or more than the jobs' timeout-minutes: 10, and the four jobs each do it separately.

Before this PR the overlay was only evaluated on aarch64-darwin, where a developer builds it once. This PR is the first time CI builds it.

Unless nix-setup@v1.3.0 restores a /nix/store cache (or a binary cache) that already holds this exact derivation, expect these jobs to time out on a cold cache. The PR body's "変更後" CI time is still blank, so this hasn't been measured yet. Possible fixes:

  • Push the derivation to a binary cache (Cachix, magic-nix-cache, etc.).
  • Raise the timeouts.
  • Keep setup-uv on Linux until nixpkgs ships Python 3.14.9 or later.

@furedea-agent furedea-agent Bot Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Measured on this PR (run 42621079854, cold cache): the four jobs compiled CPython 3.14.9 and still finished inside the 10 minute limit: test 4m33s, lint 4m49s, typecheck 6m08s, audit 6m30s. So the timeout risk did not materialize, but the cold-cache cost is real (main used to take about 43s in total). nix-setup v1.3.0 restores the Nix store cache keyed on flake.nix and flake.lock and saves it only on push to main, so a pull request run is always cold until the first main run seeds it. I cannot show the warm number before merge. Neither nixpkgs 26.05 (python314 3.14.7) nor the locked nixpkgs-unstable (3.14.7) ships 3.14.9, and dropping the override would bring back the compromised emSign root, so a binary cache or keeping setup-uv on Linux is a decision for the owner.

(pkgs.callPackage ./nix/uv.nix { })
# lefthook before 2.1.6 runs hooks under a pty, which agent sandboxes deny.
nixpkgs-unstable.legacyPackages.${system}.lefthook
];

env = {
UV_PYTHON_DOWNLOADS = "never";
UV_PYTHON_PREFERENCE = "only-system";
};
env = {
UV_PYTHON_DOWNLOADS = "never";
UV_PYTHON_PREFERENCE = "only-system";
};

shellHook = ''
if [ -d .venv/bin ]; then
export PATH="$PWD/.venv/bin:$PATH"
fi
'';
};
shellHook = ''
if [ -d .venv/bin ]; then
export PATH="$PWD/.venv/bin:$PATH"
fi
'';
};
}
);
};
}
22 changes: 18 additions & 4 deletions nix/uv.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,27 @@
# TODO: Drop this and use pkgs.uv once the nixpkgs input has >= 0.13.5.
# Official build of uv 0.13.5. 0.13.4 drops the compromised emSign root from its bundled CA store,
# but 0.13.5 is the first release that can install managed CPython 3.14.9.
let
# Hashes are the sha256 digests that GitHub reports for each release asset.
assets = {
aarch64-darwin = {
target = "aarch64-apple-darwin";
hash = "sha256-dD+FA1oZluyzUGWeAc2frqlwmCm+CbG0sDxz6vPJzXM=";
};
x86_64-linux = {
target = "x86_64-unknown-linux-musl";
hash = "sha256-V++dnMsB+xvZmN+ZWw3SIbUvfXhB++qT8tRGO/Yft6k=";
};
};
asset = assets.${stdenvNoCC.hostPlatform.system};
in
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "uv";
version = "0.13.5";

src = fetchurl {
url = "https://github.com/astral-sh/uv/releases/download/${finalAttrs.version}/uv-aarch64-apple-darwin.tar.gz";
hash = "sha256-dD+FA1oZluyzUGWeAc2frqlwmCm+CbG0sDxz6vPJzXM=";
url = "https://github.com/astral-sh/uv/releases/download/${finalAttrs.version}/uv-${asset.target}.tar.gz";
inherit (asset) hash;
};

dontBuild = true;
Expand All @@ -30,14 +44,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
doInstallCheck = true;

meta = {
description = "Python package and project manager, official macOS build";
description = "Python package and project manager, official binary build";
homepage = "https://github.com/astral-sh/uv";
license = with lib.licenses; [
asl20
mit
];
mainProgram = "uv";
platforms = [ "aarch64-darwin" ];
platforms = builtins.attrNames assets;
sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
};
})
Loading