fix: nix develop flake output - #401
Merged
Merged
Conversation
- move devShells.default out from under packages so nix develop can find it - move apps.default to the proper top-level per-system flake output - share native/build inputs between the package derivation and dev shell - add LIBCLANG_PATH for bindgen/libclang-backed dependencies - avoid nix develop falling back to the package build path
- allow nix build to vendor patched git dependencies reproducibly
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe flake centralizes Rust build inputs, pins output hashes for librespot crates, reuses those inputs in the package and development shell, and configures ChangesRust build environment
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
LargeModGames
approved these changes
Jul 26, 2026
Owner
|
@all-contributors please add @DinoLeung for platform |
Contributor
|
I've put up a pull request to add @DinoLeung! 🎉 |
LargeModGames
added a commit
that referenced
this pull request
Jul 26, 2026
Adds @DinoLeung as a contributor for platform. This was requested by LargeModGames [in this comment](#401 (comment)) [skip ci]
LargeModGames
added a commit
that referenced
this pull request
Jul 26, 2026
# Summary Adds a Nix leg that the Rust matrix cannot cover. Three steps, cheapest first: - `nix flake check --all-systems --no-build` catches outputs declared under the wrong attribute path. This is the #401 class of bug: `devShells` and `apps` nested inside `packages` evaluated fine but were invisible to Nix, so `nix run` had no target and `nix develop` silently fell back to the package derivation. That had been the case since v0.37.0. - `nix develop --command cargo --version` guards the dev shell directly: reachable, and actually carrying the toolchain. - `nix build --no-link .#default` catches drift between the `librespot-*` entries in `cargoLock.outputHashes` and the fork rev in `Cargo.toml`'s `[patch]` block. Nothing links the two, so bumping the fork without regenerating the hash breaks `nix build` for every Nix user, with a fixed-output hash mismatch that never names the rev. Only an actual build realizes the vendor derivation, so only a build catches it. Separate workflow rather than a job in `ci.yml` because GitHub filters `paths:` at the workflow level only, and the build step compiles the full default feature set. # Testing Nix is not installed on my machine, so none of the three steps ran locally. The workflow triggers on changes to itself, so this PR's own run is the real verification. - `python3 -c "import yaml; yaml.safe_load(open('.github/workflows/nix.yml'))"` parses clean - `git ls-files flake.lock` confirms the lock is tracked, so the job will not go red merely because `nixos-unstable` moved - `gh api repos/cachix/install-nix-action/tags` to pin `v31.11.0`; that repo publishes no moving major tag # Additional notes - Not suitable as a required check. With `paths:` filters it does not run on most PRs, and a required check that never runs leaves them blocked pending forever. - Expect the build step to run long whenever it fires. A hermetic `nix build` gets no benefit from the existing `Swatinem/rust-cache`. That is inherent to catching hash drift by building; the path filter is the mitigation. - If step 1 fails on a darwin attribute rather than on output layout, drop `--all-systems`. It cross-evaluates the darwin outputs (including `pkgs.apple-sdk`) from a Linux runner, and the layout bug it guards reproduces on the Linux system alone. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added a Nix-based CI workflow that runs on relevant changes to Nix/Rust or the workflow itself, and on pushes to the main branch. * Validates the Nix flake across all systems (without building) and confirms the development shell provides Rust tooling. * Builds the flake’s default output and includes protections like limited permissions, a 60-minute timeout, and support for `[skip ci]`. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nix developfindsdevShells.defaultinstead of falling back to the package derivation.apps.defaultto the proper top-level per-system flake output.LIBCLANG_PATHfor bindgen/libclang-backed dependencies.cargoLock.outputHashesfor the patchedlibrespotgit dependencies sonix buildcan vendor them reproducibly.Testing
nix flake show --all-systemsnix develop --command truenix develop --command cargo --versioncargo 1.93.0nix develop --command pkg-config --modversion openssl3.6.1nix develop --command printenv LIBCLANG_PATHlibclangstore path.nix-prefetch-gitforLargeModGames/spotatui-librespotsha256-F1pAhVgxYsbmLXOcbOEU6mGYZO1n94EWCXn5yjhPxv0=nix build --no-linkspotatuiderivation; full package build did not complete during the validation window.Additional notes
librespot-*output hash entries use the same hash because they all come from the same pinned git repo/revision.Summary by CodeRabbit
librespotcrate versions to strengthen dependency integrity.LIBCLANG_PATH, to improve local build reliability.