Darwin builders should enable nix sandbox

[KSJ2000]

While nix on linux has sandbox enabled by default, on darwin it is not the case.
This is shown here: NixOS/nixpkgs#389848 (comment)
where nixpkgs-review-gha succeded, while running nixpkgs-review with sandbox enabled failed on darwin.

[ethancedwards8]

Related: Mic92/nixpkgs-review#477

[yzx9]

I think enabling the sandbox on Darwin by default may not be a good idea, for a couple of reasons:

1. The Darwin sandbox is imperfect and not enabled on Hydra, as explained in nixpkgs#353489.
2. Many packages are currently broken on sandboxed Darwin (example: nixpkgs#403532), which is rather discouraging.

[Defelo]

I recently added the option to disable the sandbox on Darwin via the workflow inputs, so if a package fails to build with sandboxing enabled, you can just start another run with sandbox = relaxed for example (which is just a matter of two additional clicks per system). The report now also contains the sandbox setting that was used for each system.

Currently this setting defaults to true, but this default is easy to change for anyone in their own fork. Do you think we should change it to relaxed in the "root" repository? In my opinion it would be great to encourage people to make their builds work with sandboxing enabled while still providing them the option to fall back to relaxed if that's not feasible.

[yzx9]

I originally wanted to suggest changing the default value to false, but encouraging people to improve sandboxed builds is a good idea.

Would it be possible to add a simple tip or warning when sandboxing is enabled, since it often causes things to break?

---

Updated: My apologies — I just saw that the sandbox message has already been added in the latest version. Thank you for your excellent work!