feat: initial implementation

.bazelrc

@@ -0,0 +1,22 @@
+build --enable_bzlmod
+
+# CI Configuration
+# ----------------
+common:ci --announce_rc
+test:ci --test_output=errors --test_summary=terse
+
+# MacOS CI Configuration
+# ----------------------
+# The unit tests have a tendency to timeout when executed on the GH macos 
+# runners. So, we reduce the number of parallel jobs and increase the timeout 
+# for the tests.
+common:macos_ci --jobs=2
+common:macos_ci --test_timeout=600
+
+# Remote Cache Authentication
+# ---------------------------
+try-import %workspace%/.bazelrc.auth
+
+# User Configuration
+# ------------------
+try-import %workspace%/.bazelrc.local

.envrc

@@ -0,0 +1 @@
+use flake

.github/actions/set_up_runner/action.yaml

@@ -0,0 +1,26 @@
+name: Set up GitHub runner
+
+inputs:
+  github_token:
+    type: string
+
+runs:
+  using: composite
+  steps:
+    - uses: DeterminateSystems/nix-installer-action@v9
+      with:
+        github-token: ${{ inputs.github_token }}
+    - uses: DeterminateSystems/magic-nix-cache-action@v2
+    - name: Configure
+      shell: bash
+      run: |
+        cat >>.bazelrc.local <<EOF
+        common --config=ci
+        EOF
+    - name: Configure MacOS
+      if: ${{ runner.os == 'macOS' }}
+      shell: bash
+      run: |
+        cat >>.bazelrc.local <<EOF
+        common --config=macos_ci
+        EOF

.github/workflows/ci.yaml

@@ -0,0 +1,80 @@
+name: Continuous integration
+on:
+  push:
+    branches: main
+  pull_request:
+    branches: main
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    - cron: '1 11 * * *'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
+jobs:
+  unit_tests:
+    name: Unit Tests
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: ./.github/actions/set_up_runner
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Execute Bazel tests
+        shell: bash
+        run: bazel test //...
+
+  integration_tests:
+    name: Integration Tests
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: ./.github/actions/set_up_runner
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Execute simple
+        uses: ./
+        with:
+          verbose: true
+          working-directory: ./tests/integration_tests
+          options: |
+            --arg customVarBool true
+            --argstr customVarStr "Hello, World!"
+          run: |
+            echo "FIRST" > integration_test.out
+            echo "${CUSTOM_VAR_BOOL}" >> integration_test.out
+            echo "${CUSTOM_VAR_STR}" >> integration_test.out
+      - name: Confirm output
+        shell: bash
+        run: |
+          output="$(<./tests/integration_tests/integration_test.out)"
+          expected="$(cat <<-EOF
+          FIRST
+          true
+          Hello, World!
+          EOF
+          )"
+          [[ "${output}" == "${expected}" ]] || \
+            (echo >&2 "Ouptput from integration test does not match:" "${output}"; exit 1)
+
+  all_ci_tests:
+    runs-on: ubuntu-latest
+    needs:
+      - unit_tests
+      - integration_tests
+    if: ${{ always() }}
+    steps:
+      - uses: cgrindel/gha_join_jobs@794a2d117251f22607f1aab937d3fd3eaaf9a2f5 # v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1,3 @@
+bazel-*
+
+.direnv

BUILD.bazel

@@ -0,0 +1,10 @@
+# exports_files(["flake.lock"])
+
+filegroup(
+    name = "flake_files",
+    srcs = [
+        "flake.lock",
+        "flake.nix",
+    ],
+    visibility = ["//:__subpackages__"],
+)

MODULE.bazel

@@ -0,0 +1,15 @@
+module(
+    name = "run_nix_shell",
+    version = "0.0.0",
+)
+
+bazel_dep(
+    name = "rules_nixpkgs_core",
+    version = "0.10.0",
+)
+
+bazel_dep(
+    name = "cgrindel_bazel_starlib",
+    version = "0.18.1",
+    dev_dependency = True,
+)

README.md

@@ -1,2 +1,64 @@
-# run-nix-shell
-GitHub action for executing scripts via nix-shell.
+# Execute scripts using `nix-shell`
+
+[![Continuous Integration](https://github.com/tweag/run-nix-shell/actions/workflows/ci.yaml/badge.svg?event=schedule)](https://github.com/tweag/run-nix-shell/actions/workflows/ci.yaml)
+
+Executes a script or script file using `nix-shell`.
+
+## Usage
+
+To use this action, install Nix on your runner and start executing scripts.
+
+```yaml
+name: Example
+on:
+  workflow_dispatch: # allows manual triggering
+
+jobs:
+  run_under_nix:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Execute script in Nix shell
+        uses: tweag/run-nix-shell@v0
+        with:
+          run: |
+            set -o errexit -o nounset -o pipefail
+            echo "Hello"
+
+      - name: Execute script file
+        uses: tweag/run-nix-shell@v0
+        with:
+          run: path/to/my/script
+
+      - name: Configure Nix shell before executing script
+        uses: tweag/run-nix-shell@v0
+        with:
+          options: |
+            --arg myNixArg true
+            --argstr anotherNixArg "Hello, World!"
+          run: |
+            set -o errexit -o nounset -o pipefail
+            echo "Hello"
+
+      - name: Execute script in a specific directory
+        uses: tweag/run-nix-shell@v0
+        with:
+          working-directory: my/working/directory
+          run: |
+            set -o errexit -o nounset -o pipefail
+            echo "${PWD}"
+```
+
+## Inputs
+
+| Input | Description |
+| ----- | ----------- |
+| `run` | The script to be executed using `nix-shell`. This can be the actual script or a path to as cript file. |
+| `options` | Any options that you want to pass to `nix-shell`. |
+| `working-directory` | This will be the current working direcotry when the script is executed. |
+| `verbose` | Enables additional output for debugging this action. |

WORKSPACE

@@ -0,0 +1 @@
+# Intentionally blank; using bzlmod

WORKSPACE.bzlmod

@@ -0,0 +1,2 @@
+# Intentionally blank
+# This file exists to force bzlmod into a strict mode.

action.yaml

@@ -0,0 +1,34 @@
+name: Run nix-shell scripts
+description: Executes shell scripts using nix-shell.
+
+inputs:
+  run:
+    type: string
+    required: true
+    description: The path to a file that contains shell code or the actual shell code.
+  pure:
+    type: boolean
+    default: true
+  options:
+    type: string
+    description: Any parameters that are to be passed to nix-shell are specified here.
+  working-directory:
+    type: string
+    description: The path where the nix-shell execution should take place.
+    default: .
+  verbose:
+    type: boolean
+    description: Enable debug output written to stderr.
+    default: false
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        RNS_CWD: ${{ inputs.working-directory }}
+        RNS_OPTS: ${{ inputs.options }}
+        RNS_RUN: ${{ inputs.run }}
+        RNS_PURE: ${{ inputs.pure }}
+        RNS_VERBOSE: ${{ inputs.verbose }}
+      run: ${GITHUB_ACTION_PATH}/tools/run_nix_shell.sh

flake.nix

@@ -0,0 +1,33 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    # Library for working with tools that need default.nix and shell.nix.
+    # https://nixos.wiki/wiki/Flakes#Using_flakes_with_stable_Nix
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
+  };
+  outputs = { nixpkgs, flake-utils, ... }:
+    # For every platform that Nix supports, we ...
+    flake-utils.lib.eachDefaultSystem (system:
+      # ... get the package set for this particular platform ...
+      let pkgs = import nixpkgs { inherit system; };
+      in {
+        # ... and define a development shell for it ...
+        devShells.default = with pkgs; mkShell {
+            # BEGIN Config to build Bazel 6
+            # do not use Xcode on macOS
+            BAZEL_USE_CPP_ONLY_TOOLCHAIN = "1";
+            # for nixpkgs cc wrappers, select C++ explicitly (see https://github.com/NixOS/nixpkgs/issues/150655)
+            BAZEL_CXXOPTS = "-x:c++";
+            buildInputs = lib.optional pkgs.stdenv.isDarwin darwin.cctools;
+            # END Config to build Bazel 6
+            # Name for the shell
+            name = "run_nix_shell_shell";
+            # ... which makes available the following dependencies, 
+            packages = [ bazel_6 bazel-buildtools cacert gcc nix git openssh ];
+          };
+      });
+}

nixpkgs.nix

@@ -0,0 +1,8 @@
+# Ensure that our development shell uses the same Nixpkgs version as what
+# rules_nixpkgs uses in Bazel.
+let
+  lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+  spec = lock.nodes.nixpkgs.locked;
+  nixpkgs = fetchTarball "https://github.com/${spec.owner}/${spec.repo}/archive/${spec.rev}.tar.gz";
+in
+import nixpkgs

tests/integration_tests/README.md

@@ -0,0 +1,4 @@
+# Integration Tests
+
+This directory contains the files needed to execute the integration tests as configured in the CI
+GitHub workflow.