#!/usr/bin/env bash
#
# Run a command with one nixpkgs package on PATH, taken from *this repo's*
# flake.lock.
#
#     bash .gitea/with-nixpkgs.sh python3 python3 tools/sync_blocked_label.py …
#     bash .gitea/with-nixpkgs.sh openssh nix build .#checks.x86_64-linux.tests
#
# **Call it as `bash <script>`, not `<script>`.** The runner has no
# `/usr/bin/env`, so the shebang cannot be relied on there:
#
#     .gitea/with-nixpkgs.sh: /usr/bin/env: bad interpreter: No such file or directory
#
# The shebang stays for running it by hand on a normal machine. `run:` steps
# already execute under bash, so naming the interpreter costs nothing.
#
# ## Why not `nix shell nixpkgs#python3`
#
# That is a *registry* reference. It resolves the indirect `nixpkgs` entry to
# whatever the branch points at now, so whenever that moves the runner fetches
# a fresh channel tarball and evaluates it cold -- caught in the act in a job
# log:
#
#     unpacking 'https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz'
#     into the Git cache...
#
# for a job that wanted one binary.
#
# ## Why not a `packages.python3` flake output
#
# It was that first, and bit's review of cfbypass#22 asked for pipeline things
# to live under `.gitea/` rather than in the flake. That is also the only form
# that works everywhere: evaluating *any* output of weblib-archive's flake
# forces its inputs, one of which is `cfbypass` over ssh -- which the runner
# cannot fetch. This script never evaluates the project flake, only the lock
# file, so the same line works in every repo.
#
# The rev comes from flake.lock, so it cannot drift the way a rev hardcoded in
# YAML would, and it is the same nixpkgs the test job instantiates -- one store
# path, not two.
set -euo pipefail

if [ "$#" -lt 2 ]; then
  echo "usage: $0 <nixpkgs attribute> <command> [args...]" >&2
  exit 2
fi

attr=$1
shift

# --impure because the expression reads a path relative to the working
# directory. It only reads flake.lock; nothing is fetched to find the rev.
rev=$(nix eval --raw --impure \
  --expr '(builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked.rev')

exec nix shell "github:nixos/nixpkgs/${rev}#${attr}" --command "$@"