claude
061d8b266c
Split out of the four repos per weblib-archive#44. All three files were byte-identical across every repo at this moment, which will not stay true -- they converged only because four twin PRs landed within hours today, and report_job_log.py had already drifted once before that. Taken from weblib-archive, verified identical to every other copy first: with-nixpkgs.sh ca43fa20 (cfbypass, archive, fs) report_job_log.py aaef8f62 (cfbypass, archive) sync_blocked_label.py e6ddb21d (all four) action.yml is included so the `uses:` question can be re-measured now the repo is public; it did not work while private. Co-authored-by: bit <bit@das-labor.org>
57 lines
2.2 KiB
Bash
Executable File
57 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Run a command with one nixpkgs package on PATH, taken from *this repo's*
|
|
# flake.lock.
|
|
#
|
|
# bash .gitea/with-nixpkgs.sh python3 python3 tools/sync_blocked_label.py …
|
|
# bash .gitea/with-nixpkgs.sh openssh nix build .#checks.x86_64-linux.tests
|
|
#
|
|
# **Call it as `bash <script>`, not `<script>`.** The runner has no
|
|
# `/usr/bin/env`, so the shebang cannot be relied on there:
|
|
#
|
|
# .gitea/with-nixpkgs.sh: /usr/bin/env: bad interpreter: No such file or directory
|
|
#
|
|
# The shebang stays for running it by hand on a normal machine. `run:` steps
|
|
# already execute under bash, so naming the interpreter costs nothing.
|
|
#
|
|
# ## Why not `nix shell nixpkgs#python3`
|
|
#
|
|
# That is a *registry* reference. It resolves the indirect `nixpkgs` entry to
|
|
# whatever the branch points at now, so whenever that moves the runner fetches
|
|
# a fresh channel tarball and evaluates it cold -- caught in the act in a job
|
|
# log:
|
|
#
|
|
# unpacking 'https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz'
|
|
# into the Git cache...
|
|
#
|
|
# for a job that wanted one binary.
|
|
#
|
|
# ## Why not a `packages.python3` flake output
|
|
#
|
|
# It was that first, and bit's review of cfbypass#22 asked for pipeline things
|
|
# to live under `.gitea/` rather than in the flake. That is also the only form
|
|
# that works everywhere: evaluating *any* output of weblib-archive's flake
|
|
# forces its inputs, one of which is `cfbypass` over ssh -- which the runner
|
|
# cannot fetch. This script never evaluates the project flake, only the lock
|
|
# file, so the same line works in every repo.
|
|
#
|
|
# The rev comes from flake.lock, so it cannot drift the way a rev hardcoded in
|
|
# YAML would, and it is the same nixpkgs the test job instantiates -- one store
|
|
# path, not two.
|
|
set -euo pipefail
|
|
|
|
if [ "$#" -lt 2 ]; then
|
|
echo "usage: $0 <nixpkgs attribute> <command> [args...]" >&2
|
|
exit 2
|
|
fi
|
|
|
|
attr=$1
|
|
shift
|
|
|
|
# --impure because the expression reads a path relative to the working
|
|
# directory. It only reads flake.lock; nothing is fetched to find the rev.
|
|
rev=$(nix eval --raw --impure \
|
|
--expr '(builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked.rev')
|
|
|
|
exec nix shell "github:nixos/nixpkgs/${rev}#${attr}" --command "$@"
|