nixpkgs/ci/nixpkgs-vet.nix
Wolfgang Walther 247d562379
ci/nixpkgs-vet: add badFiles and conflictingPaths checks
Those checks are part of top-level/nixpkgs-basic-release-checks.nix, but
can be run in CI already to prevent regressions. The idea is to upstream
them into nixpkgs-vet eventually, but we can just as well run them as-is
in the same derivation already.
2025-06-10 15:10:52 +02:00

54 lines
1.2 KiB
Nix

{
lib,
nix,
nixpkgs-vet,
runCommand,
}:
{
base ? ../.,
head ? ../.,
}:
let
filtered =
with lib.fileset;
path:
toSource {
fileset = (gitTracked path);
root = path;
};
in
runCommand "nixpkgs-vet"
{
nativeBuildInputs = [
nixpkgs-vet
];
env.NIXPKGS_VET_NIX_PACKAGE = nix;
}
''
export NIX_STATE_DIR=$(mktemp -d)
nixpkgs-vet --base ${filtered base} ${filtered head}
# TODO: Upstream into nixpkgs-vet, see:
# https://github.com/NixOS/nixpkgs-vet/issues/164
badFiles=$(find ${filtered head}/pkgs -type f -name '*.nix' -print | xargs grep -l '^[^#]*<nixpkgs/' || true)
if [[ -n $badFiles ]]; then
echo "Nixpkgs is not allowed to use <nixpkgs> to refer to itself."
echo "The offending files:"
echo "$badFiles"
exit 1
fi
# TODO: Upstream into nixpkgs-vet, see:
# https://github.com/NixOS/nixpkgs-vet/issues/166
conflictingPaths=$(find ${filtered head} | awk '{ print $1 " " tolower($1) }' | sort -k2 | uniq -D -f 1 | cut -d ' ' -f 1)
if [[ -n $conflictingPaths ]]; then
echo "Files in nixpkgs must not vary only by case."
echo "The offending paths:"
echo "$conflictingPaths"
exit 1
fi
touch $out
''