Add modular Nix flake: dev shell, OCI images, static analysis - #13
Add modular Nix flake: dev shell, OCI images, static analysis#13randomizedcoder wants to merge 1 commit into
Conversation
Add a thin flake.nix orchestrator that delegates to a modular nix/ tree: flake-utils + a plain mkShell, one file per concern, and a single nix/versions.nix as the source of truth for tool versions. Provides: - nix develop: Python 3.12 dev shell with cmax on PATH (a shell function shadows it interactively to run the working tree) plus ruff, mypy, bandit, shellcheck, and helper commands (cmax-test, cmax-lint, ...). - nix build .#cmax: buildPythonApplication of the cmax CLI, with an install check for `cmax --version` and the bundled cmax.yaml / run.sh resources. - nix build .#oci-cmax: native per-system OCI image (amd64 + aarch64) via dockerTools.buildLayeredImage. - Report-only static analysis: analysis-ruff, -ruff-format, -mypy, -bandit, -shellcheck, and a combined `analysis` summary. These never gate. - nix flake check: sandbox-safe gates only (package build + nixfmt). - nix run .#test: pytest in the host environment (the suite's command stubs hard-code /bin/bash and /bin/cat, absent in the hermetic sandbox). pyproject.toml gains [tool.ruff], [tool.mypy], and [tool.bandit] config so the analysers run the same way inside and outside Nix. Docs: nix/README.md plus a "Develop with Nix" quickstart in README.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TiU7ttVHcNojp2T1TEutgX
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 22326a1. Configure here.
|
|
||
| config = { | ||
| Entrypoint = [ "/bin/cmax" ]; | ||
| Env = [ "SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt" ]; |
There was a problem hiding this comment.
OCI image cannot run audits
High Severity
The oci-cmax image never puts python3 on PATH and also omits /tmp and a home directory. cmax audit shells out to python3 and mktemp, so those runs fail even though cmax --version works.
Reviewed by Cursor Bugbot for commit 22326a1. Configure here.
| { self }: | ||
| final: _prev: { | ||
| cmax = self.packages.${final.system}.cmax or null; | ||
| cmax-oci = self.packages.${final.system}.oci-cmax or null; |
There was a problem hiding this comment.
Overlay crashes on unsupported systems
Medium Severity
or null only covers a missing cmax attribute. Selecting self.packages.${final.system} still throws on Darwin and other systems the flake does not export, so downstream overlay users cannot evaluate pkgs.
Reviewed by Cursor Bugbot for commit 22326a1. Configure here.
2 participants
Summary
Adds a thin
flake.nixorchestrator that delegates to a modularnix/tree:flake-utils+ a plainmkShell, one file per concern, and a singlenix/versions.nixas the source of truth for tool versions. The flake is optional and does not change the pip install path.What it provides
nix developcmaxon PATH (a shell function shadows it interactively to run the working tree) plusruff,mypy,bandit,shellcheckandcmax-*helpers. Typecmax-help.nix build .#cmaxbuildPythonApplicationof the CLI, with an install check forcmax --versionand the bundledcmax.yaml/run.shresources.nix build .#oci-cmaxdockerTools.buildLayeredImage.nix build .#analysis(+analysis-ruff,-ruff-format,-mypy,-bandit,-shellcheck)report.txt/summary.txt. Does not gate.nix run .#testnix flake checknixfmt.nix fmt.nixfiles.Design decisions
pyproject.toml([tool.ruff],[tool.mypy],[tool.bandit]) so the analysers run the same way inside and outside Nix..#oci-cmaxon a matching-arch host (or via binfmt/QEMU). Bothx86_64-linuxandaarch64-linuxderivations evaluate.nix run .#test, notnix flake check. Its command stubs hard-code/bin/bashand/bin/cat, which do not exist in Nix's hermetic build sandbox. (These paths exist on a real host, so the suite runs there.)Verification (x86_64-linux)
nix flake check— green (package build + install check + nixfmt).nix build .#cmax→cmax 0.2.1.nix build .#oci-cmax→ loaded into Docker and ran (cmax 0.2.1).nix build .#analysis→ all four analysers produced reports; build succeeded.nix develop—cmax, helpers, and tools all present.cmax/oci-cmaxderivations evaluate.Note:
nix run .#testshows pre-existing audit-test failures that are not introduced here — an untouched checkout ofHEADfails the same tests through the same interpreter (they depend on host tooling such asmlxconfig/DPU detection). This change adds no Python runtime code.Docs
nix/README.md(a Nix intro adapted for this project) plus a "Develop with Nix" quickstart inREADME.md.🤖 Generated with Claude Code
Note
Low Risk
Infrastructure and documentation only; no changes to
cmaxruntime or audit logic.Overview
Adds an optional Nix flake (
flake.nix,flake.lock, modularnix/) alongside the existing pip install path. Contributors getnix develop(Python 3.12 pluscmax-*helpers),nix build .#cmaxwith install checks for the CLI and bundledcmax.yaml/ auditrun.sh, native per-arch.#oci-cmaximages, and report-onlyanalysis-*targets (ruff, mypy, bandit, shellcheck) that always succeed and write reports.nix flake checkonly gates the package build andnixfmt; pytest stays onnix run .#testbecause audit test stubs need host/bin/bashand/bin/cat.pyproject.tomlgains[tool.ruff],[tool.mypy], and[tool.bandit]so the same rules apply in and out of Nix. README documents a “Develop with Nix” quickstart and points to newnix/README.md.Reviewed by Cursor Bugbot for commit 22326a1. Bugbot is set up for automated code reviews on this repo. Configure here.