From f230b4ec01d65017fe5b95c495af920b6b76e8a6 Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Mon, 4 Mar 2024 13:54:32 -0500 Subject: [PATCH 01/17] feat: add initial flake.nix --- .gitignore | 4 +++ flake.lock | 61 ++++++++++++++++++++++++++++++++++++++++++ flake.nix | 16 +++++++++++ shell-plugins.nix | 67 +++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 148 insertions(+) create mode 100644 flake.lock create mode 100644 flake.nix create mode 100644 shell-plugins.nix diff --git a/.gitignore b/.gitignore index 10710b115..8ed151494 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,7 @@ plugins/registry.json # 1Password .op + +# direnv +.direnv +.envrc diff --git a/flake.lock b/flake.lock new file mode 100644 index 000000000..936ebb3dd --- /dev/null +++ b/flake.lock @@ -0,0 +1,61 @@ +{ + "nodes": { + "flake-utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1709126324, + "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "d465f4819400de7c8d874d50b982301f28a84605", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1709237383, + "narHash": "sha256-cy6ArO4k5qTx+l5o+0mL9f5fa86tYUX3ozE1S+Txlds=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "1536926ef5621b09bba54035ae2bb6d806d72ac8", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "flake-utils": "flake-utils", + "nixpkgs": "nixpkgs" + } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 000000000..9038f2cd1 --- /dev/null +++ b/flake.nix @@ -0,0 +1,16 @@ +{ + inputs = { + nixpkgs = { url = "github:nixos/nixpkgs/nixos-unstable"; }; + flake-utils = { url = "github:numtide/flake-utils"; }; + }; + outputs = { nixpkgs, flake-utils, ... }: + flake-utils.lib.eachDefaultSystem (system: + let pkgs = import nixpkgs { inherit system; }; + in { + devShell = pkgs.mkShell { + name = "Shell with Go toolchain"; + + packages = with pkgs; [ go gopls ]; + }; + }); +} diff --git a/shell-plugins.nix b/shell-plugins.nix new file mode 100644 index 000000000..31324613f --- /dev/null +++ b/shell-plugins.nix @@ -0,0 +1,67 @@ +{ pkgs, lib, config, is-home-manager, ... }: +with lib; +let cfg = config.programs.op-shell-plugins; +in { + options = { + programs.op-shell-plugins = { + enable = mkEnableOption "1Password Shell Plugins"; + plugins = mkOption { + type = types.listOf types.package; + default = [ ]; + example = literalExpression '' + with pkgs; [ + gh + awscli2 + cachix + ] + ''; + description = + "CLI Packages to enable 1Password Shell Plugins for; ensure that a Shell Plugin exists by checking the docs: https://developer.1password.com/docs/cli/shell-plugins/"; + }; + }; + }; + + config = let + # Explanation: + # Map over `cfg.plugins` (the value of the `plugins` option provided by the user) + # and for each package specified, get the executable name, then create a shell alias + # of the form: + # `alias {pkg}="op plugin run -- {pkg}"` + # where `{pkg}` is the executable name of the package + aliases = '' + export OP_PLUGIN_ALIASES_SOURCED=1 + ${concatMapStrings + (plugin: ''alias ${plugin}="op plugin run -- ${plugin}"'') + (map (package: builtins.baseNameOf (lib.getExe package)) cfg.plugins)} + ''; + # install the 1Password CLI, as well as any of the CLIs for which + # shell plugins are enabled + packages = [ pkgs._1password ] ++ cfg.plugins; + in mkIf cfg.enable (mkMerge [ + ({ + # the option names are slightly different depending on whether you're using home-manager or not + programs = if is-home-manager then { + fish.interactiveShellInit = '' + ${aliases} + ''; + bash.initExtra = '' + ${aliases} + ''; + zsh.initExtra = '' + ${aliases} + ''; + } else { + fish.interactiveShellInit = ""; + bash.interactiveShellInit = '' + ${aliases} + ''; + zsh.interactiveShellInit = '' + ${aliases} + ''; + }; + } // optionalAttrs is-home-manager { home.packages = packages; } + // optionalAttrs (not is-home-manager) { + environment.systemPackages = packages; + }) + ]); +} From acc486835a772523ec85fefbe0b151d82c0120bd Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Tue, 5 Mar 2024 07:07:38 -0500 Subject: [PATCH 02/17] fix: Move nixos and home-manager modules outside of `flake-utils.eachDefaultSystem` lambda --- flake.lock | 12 +++--- flake.nix | 11 ++++-- nix/home-manager.nix | 7 ++++ nix/nixos.nix | 7 ++++ shell-plugins.nix => nix/shell-plugins.nix | 43 +++++++--------------- 5 files changed, 40 insertions(+), 40 deletions(-) create mode 100644 nix/home-manager.nix create mode 100644 nix/nixos.nix rename shell-plugins.nix => nix/shell-plugins.nix (53%) diff --git a/flake.lock b/flake.lock index 936ebb3dd..0a801e9cd 100644 --- a/flake.lock +++ b/flake.lock @@ -20,16 +20,16 @@ }, "nixpkgs": { "locked": { - "lastModified": 1709237383, - "narHash": "sha256-cy6ArO4k5qTx+l5o+0mL9f5fa86tYUX3ozE1S+Txlds=", - "owner": "nixos", + "lastModified": 1709386671, + "narHash": "sha256-VPqfBnIJ+cfa78pd4Y5Cr6sOWVW8GYHRVucxJGmRf8Q=", + "owner": "NixOS", "repo": "nixpkgs", - "rev": "1536926ef5621b09bba54035ae2bb6d806d72ac8", + "rev": "fa9a51752f1b5de583ad5213eb621be071806663", "type": "github" }, "original": { - "owner": "nixos", - "ref": "nixos-unstable", + "owner": "NixOS", + "ref": "nixpkgs-unstable", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix index 9038f2cd1..3831af0b4 100644 --- a/flake.nix +++ b/flake.nix @@ -1,16 +1,19 @@ { inputs = { - nixpkgs = { url = "github:nixos/nixpkgs/nixos-unstable"; }; + nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; flake-utils = { url = "github:numtide/flake-utils"; }; }; outputs = { nixpkgs, flake-utils, ... }: - flake-utils.lib.eachDefaultSystem (system: - let pkgs = import nixpkgs { inherit system; }; + (flake-utils.lib.eachDefaultSystem (system: + let pkgs = nixpkgs.legacyPackages.${system}; in { devShell = pkgs.mkShell { name = "Shell with Go toolchain"; packages = with pkgs; [ go gopls ]; }; - }); + })) // { + nixosModule = import ./nix/nixos.nix; + hmModule = import ./nix/home-manager.nix; + }; } diff --git a/nix/home-manager.nix b/nix/home-manager.nix new file mode 100644 index 000000000..590a1fa3b --- /dev/null +++ b/nix/home-manager.nix @@ -0,0 +1,7 @@ +{ pkgs, lib, config, ... }: +import ./shell-plugins.nix { + inherit pkgs; + inherit lib; + inherit config; + is-home-manager = true; +} diff --git a/nix/nixos.nix b/nix/nixos.nix new file mode 100644 index 000000000..7ae12ba3c --- /dev/null +++ b/nix/nixos.nix @@ -0,0 +1,7 @@ +{ pkgs, lib, config, ... }: +import ./shell-plugins.nix { + inherit pkgs; + inherit lib; + inherit config; + is-home-manager = false; +} diff --git a/shell-plugins.nix b/nix/shell-plugins.nix similarity index 53% rename from shell-plugins.nix rename to nix/shell-plugins.nix index 31324613f..e06ca2ba6 100644 --- a/shell-plugins.nix +++ b/nix/shell-plugins.nix @@ -1,9 +1,9 @@ { pkgs, lib, config, is-home-manager, ... }: with lib; -let cfg = config.programs.op-shell-plugins; +let cfg = config.programs._1password-shell-plugins; in { options = { - programs.op-shell-plugins = { + programs._1password-shell-plugins = { enable = mkEnableOption "1Password Shell Plugins"; plugins = mkOption { type = types.listOf types.package; @@ -28,39 +28,22 @@ in { # of the form: # `alias {pkg}="op plugin run -- {pkg}"` # where `{pkg}` is the executable name of the package - aliases = '' - export OP_PLUGIN_ALIASES_SOURCED=1 - ${concatMapStrings - (plugin: ''alias ${plugin}="op plugin run -- ${plugin}"'') - (map (package: builtins.baseNameOf (lib.getExe package)) cfg.plugins)} - ''; - # install the 1Password CLI, as well as any of the CLIs for which - # shell plugins are enabled + aliases = listToAttrs (map (package: { + name = package; + value = "op plugin run -- ${package}"; + }) (map (package: + builtins.unsafeDiscardStringContext (baseNameOf (getExe package))) + cfg.plugins)); packages = [ pkgs._1password ] ++ cfg.plugins; in mkIf cfg.enable (mkMerge [ ({ - # the option names are slightly different depending on whether you're using home-manager or not - programs = if is-home-manager then { - fish.interactiveShellInit = '' - ${aliases} - ''; - bash.initExtra = '' - ${aliases} - ''; - zsh.initExtra = '' - ${aliases} - ''; - } else { - fish.interactiveShellInit = ""; - bash.interactiveShellInit = '' - ${aliases} - ''; - zsh.interactiveShellInit = '' - ${aliases} - ''; + programs = { + bash.shellAliases = aliases; + zsh.shellAliases = aliases; + fish.shellAliases = aliases; }; } // optionalAttrs is-home-manager { home.packages = packages; } - // optionalAttrs (not is-home-manager) { + // optionalAttrs (!is-home-manager) { environment.systemPackages = packages; }) ]); From 92568af31a0a01d7b6b093d73c06a80ad44770c7 Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Tue, 5 Mar 2024 07:09:50 -0500 Subject: [PATCH 03/17] chore: Add comment explanation --- nix/shell-plugins.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nix/shell-plugins.nix b/nix/shell-plugins.nix index e06ca2ba6..a8f983591 100644 --- a/nix/shell-plugins.nix +++ b/nix/shell-plugins.nix @@ -32,6 +32,11 @@ in { name = package; value = "op plugin run -- ${package}"; }) (map (package: + # NOTE: SAFETY: This is okay because the `packages` list is also referred + # to below as `home.packages = packages;` or `environment.systemPackages = packages;` + # depending on if it's using `home-manager` or not; this means that Nix can still + # compute the dependency tree, even though we're discarding string context here, + # since the packages are still referred to below without discarding string context. builtins.unsafeDiscardStringContext (baseNameOf (getExe package))) cfg.plugins)); packages = [ pkgs._1password ] ++ cfg.plugins; From 2d9bb29cb2fd294c23323963097ae013abece902 Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Tue, 5 Mar 2024 07:32:15 -0500 Subject: [PATCH 04/17] chore: Refactor to make it easier to validate --- nix/shell-plugins.nix | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/nix/shell-plugins.nix b/nix/shell-plugins.nix index a8f983591..8c58b341c 100644 --- a/nix/shell-plugins.nix +++ b/nix/shell-plugins.nix @@ -22,6 +22,15 @@ in { }; config = let + # executable names as strings, e.g. `pkgs.gh` => `"gh"`, `pkgs.awscli2` => `"aws"` + pkg-exe-names = map (package: + # NOTE: SAFETY: This is okay because the `packages` list is also referred + # to below as `home.packages = packages;` or `environment.systemPackages = packages;` + # depending on if it's using `home-manager` or not; this means that Nix can still + # compute the dependency tree, even though we're discarding string context here, + # since the packages are still referred to below without discarding string context. + builtins.unsafeDiscardStringContext (baseNameOf (getExe package))) + cfg.plugins; # Explanation: # Map over `cfg.plugins` (the value of the `plugins` option provided by the user) # and for each package specified, get the executable name, then create a shell alias @@ -31,14 +40,7 @@ in { aliases = listToAttrs (map (package: { name = package; value = "op plugin run -- ${package}"; - }) (map (package: - # NOTE: SAFETY: This is okay because the `packages` list is also referred - # to below as `home.packages = packages;` or `environment.systemPackages = packages;` - # depending on if it's using `home-manager` or not; this means that Nix can still - # compute the dependency tree, even though we're discarding string context here, - # since the packages are still referred to below without discarding string context. - builtins.unsafeDiscardStringContext (baseNameOf (getExe package))) - cfg.plugins)); + }) pkg-exe-names); packages = [ pkgs._1password ] ++ cfg.plugins; in mkIf cfg.enable (mkMerge [ ({ From df780b6b448c58a7adcd2368fbdb4d3a78fbfc03 Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Tue, 5 Mar 2024 09:33:09 -0500 Subject: [PATCH 05/17] feat(ci): Add CI job to check Nix flake --- .github/workflows/check-flake.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/workflows/check-flake.yml diff --git a/.github/workflows/check-flake.yml b/.github/workflows/check-flake.yml new file mode 100644 index 000000000..542a0c2c3 --- /dev/null +++ b/.github/workflows/check-flake.yml @@ -0,0 +1,20 @@ +name: Check Nix flake +on: + pull_request: + push: + branches: + - main +jobs: + check-flake: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: DeterminateSystems/nix-installer-action@main + - uses: DeterminateSystems/magic-nix-cache-action@main + - name: Check Nix flake inputs + uses: DeterminateSystems/flake-checker-action@v5 + with: + fail-mode: true + send-statistics: false + - name: Run nix flake check + run: nix flake check From 5888a41389a6e0172a81b4e14d79efcf94fc7b4a Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Tue, 5 Mar 2024 09:38:43 -0500 Subject: [PATCH 06/17] chore: Rename properties --- flake.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.nix b/flake.nix index 3831af0b4..eb2495a04 100644 --- a/flake.nix +++ b/flake.nix @@ -7,13 +7,13 @@ (flake-utils.lib.eachDefaultSystem (system: let pkgs = nixpkgs.legacyPackages.${system}; in { - devShell = pkgs.mkShell { + devShells.default = pkgs.mkShell { name = "Shell with Go toolchain"; packages = with pkgs; [ go gopls ]; }; })) // { - nixosModule = import ./nix/nixos.nix; - hmModule = import ./nix/home-manager.nix; + nixosModules.default = import ./nix/nixos.nix; + hmModules.default = import ./nix/home-manager.nix; }; } From 74318715acb2113d8ed9781e4442743706ed1690 Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Tue, 5 Mar 2024 10:07:25 -0500 Subject: [PATCH 07/17] chore(ci): Add CI job to update flake dependencies --- .../workflows/update-flake-dependencies.yml | 30 +++++++++++++++++++ flake.nix | 1 - 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/update-flake-dependencies.yml diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml new file mode 100644 index 000000000..070b55f5b --- /dev/null +++ b/.github/workflows/update-flake-dependencies.yml @@ -0,0 +1,30 @@ +name: Update flake dependencies + +on: + schedule: + - cron: '0 16 * * 5' + workflow_dispatch: # for allowing manual triggers of the workflow + +jobs: + update-dependencies: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: DeterminateSystems/nix-installer-action@main + - uses: DeterminateSystems/magic-nix-cache-action@main + - name: update flake.lock + run: nix flake update + - name: Create signed commit with flake.lock changes + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + FILE_TO_COMMIT: flake.lock + COMMIT_BRANCH: automation/update-flake-dependencies + COMMIT_MESSAGE: "chore(nix): Update Flake dependencies" + run: | + # commit via the GitHub API so we get automatic commit signing + gh api --method PUT /repos/1Password/shell-plugins/contents/$FILE_TO_COMMIT \ + --field message="$COMMIT_MESSAGE" \ + --field content=@<(base64 -i $FILE_TO_COMMIT) \ + --field branch="$COMMIT_BRANCH" \ + --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" + gh pr create --title "[automation]: Update Flake dependencies" --reviewer mrjones2014 --base main --head $COMMIT_BRANCH diff --git a/flake.nix b/flake.nix index eb2495a04..fcd773003 100644 --- a/flake.nix +++ b/flake.nix @@ -9,7 +9,6 @@ in { devShells.default = pkgs.mkShell { name = "Shell with Go toolchain"; - packages = with pkgs; [ go gopls ]; }; })) // { From ec0377a5340e21a2f1fe3dcb69317e6ac1e3e24f Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Tue, 5 Mar 2024 10:11:33 -0500 Subject: [PATCH 08/17] chore: Add comment explanation --- .github/workflows/update-flake-dependencies.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index 070b55f5b..fbc1f71fe 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -1,3 +1,4 @@ +# CI job to periodically (once a week) update flake.lock name: Update flake dependencies on: From 5ece816172bcaa33329914493d9dbc88a0fac8f4 Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Tue, 5 Mar 2024 20:04:23 -0500 Subject: [PATCH 09/17] fix: Add OP_PLUGINS_SOURCED=1 environment variable --- nix/shell-plugins.nix | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/nix/shell-plugins.nix b/nix/shell-plugins.nix index 8c58b341c..b1c0122ef 100644 --- a/nix/shell-plugins.nix +++ b/nix/shell-plugins.nix @@ -49,9 +49,16 @@ in { zsh.shellAliases = aliases; fish.shellAliases = aliases; }; - } // optionalAttrs is-home-manager { home.packages = packages; } - // optionalAttrs (!is-home-manager) { - environment.systemPackages = packages; - }) + } // optionalAttrs is-home-manager { + home = { + inherit packages; + sessionVariables = { OP_PLUGINS_SOURCED = "1"; }; + }; + } // optionalAttrs (!is-home-manager) { + environment = { + systemPackages = packages; + variables = { OP_PLUGINS_SOURCED = "1"; }; + }; + }) ]); } From 13a3b13f86d7e4c2c1f4fed35a5014d1546568b8 Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Wed, 6 Mar 2024 07:29:28 -0500 Subject: [PATCH 10/17] fix: use function from lib instead of builtins --- nix/shell-plugins.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/nix/shell-plugins.nix b/nix/shell-plugins.nix index 8c58b341c..0f51f68a8 100644 --- a/nix/shell-plugins.nix +++ b/nix/shell-plugins.nix @@ -29,8 +29,7 @@ in { # depending on if it's using `home-manager` or not; this means that Nix can still # compute the dependency tree, even though we're discarding string context here, # since the packages are still referred to below without discarding string context. - builtins.unsafeDiscardStringContext (baseNameOf (getExe package))) - cfg.plugins; + strings.unsafeDiscardStringContext (baseNameOf (getExe package))) cfg.plugins; # Explanation: # Map over `cfg.plugins` (the value of the `plugins` option provided by the user) # and for each package specified, get the executable name, then create a shell alias From 39d777c1d7876b283351f4714aa6f697cc60a05d Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Wed, 6 Mar 2024 08:37:36 -0500 Subject: [PATCH 11/17] chore: Remove flake.lock and update update-flake-dependencies.yml as a test --- .../workflows/update-flake-dependencies.yml | 3 + flake.lock | 61 ------------------- 2 files changed, 3 insertions(+), 61 deletions(-) delete mode 100644 flake.lock diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index fbc1f71fe..bc5cce0fa 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -2,6 +2,9 @@ name: Update flake dependencies on: + # TODO this is just a test, remove the `push` trigger before merging + push: + branches: [ mrj/nix-flake-overlay ] schedule: - cron: '0 16 * * 5' workflow_dispatch: # for allowing manual triggers of the workflow diff --git a/flake.lock b/flake.lock deleted file mode 100644 index 0a801e9cd..000000000 --- a/flake.lock +++ /dev/null @@ -1,61 +0,0 @@ -{ - "nodes": { - "flake-utils": { - "inputs": { - "systems": "systems" - }, - "locked": { - "lastModified": 1709126324, - "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "d465f4819400de7c8d874d50b982301f28a84605", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, - "nixpkgs": { - "locked": { - "lastModified": 1709386671, - "narHash": "sha256-VPqfBnIJ+cfa78pd4Y5Cr6sOWVW8GYHRVucxJGmRf8Q=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "fa9a51752f1b5de583ad5213eb621be071806663", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixpkgs-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "root": { - "inputs": { - "flake-utils": "flake-utils", - "nixpkgs": "nixpkgs" - } - }, - "systems": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - } - }, - "root": "root", - "version": 7 -} From 01d503a3ea67146c4077179ec13adb5ffebf6a2c Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Wed, 6 Mar 2024 08:47:55 -0500 Subject: [PATCH 12/17] fix: create the branch on the remote before trying to commit to it via REST API --- .github/workflows/update-flake-dependencies.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index bc5cce0fa..d5a568318 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -25,6 +25,9 @@ jobs: COMMIT_BRANCH: automation/update-flake-dependencies COMMIT_MESSAGE: "chore(nix): Update Flake dependencies" run: | + # create the branch on the remote + git branch "$COMMIT_BRANCH" + git push -u origin "$COMMIT_BRANCH" # commit via the GitHub API so we get automatic commit signing gh api --method PUT /repos/1Password/shell-plugins/contents/$FILE_TO_COMMIT \ --field message="$COMMIT_MESSAGE" \ From 8ac3f454e3b186fdbceb1a24c688209bc187ae1f Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Wed, 6 Mar 2024 08:50:37 -0500 Subject: [PATCH 13/17] fix: add --body argument --- .github/workflows/update-flake-dependencies.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index d5a568318..bd9e0bed8 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -34,4 +34,4 @@ jobs: --field content=@<(base64 -i $FILE_TO_COMMIT) \ --field branch="$COMMIT_BRANCH" \ --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" - gh pr create --title "[automation]: Update Flake dependencies" --reviewer mrjones2014 --base main --head $COMMIT_BRANCH + gh pr create --title "[automation]: Update Flake dependencies" --body "This is an automated PR to update \`flake.lock\`" --reviewer mrjones2014 --base main --head $COMMIT_BRANCH From 4cd313c9178fd34f67aa94a186e4aac867423369 Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Wed, 6 Mar 2024 08:53:20 -0500 Subject: [PATCH 14/17] chore: Update flake.lock --- flake.lock | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 flake.lock diff --git a/flake.lock b/flake.lock new file mode 100644 index 000000000..20f0a1fcf --- /dev/null +++ b/flake.lock @@ -0,0 +1,61 @@ +{ + "nodes": { + "flake-utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1709126324, + "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "d465f4819400de7c8d874d50b982301f28a84605", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1709675310, + "narHash": "sha256-w61tqFEmuJ+/1rAwU7nkYZ+dN6sLwyobfLwX2Yn42FE=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "43d259f8d726113fac056e8bb17d5ac2dea3e0a8", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "flake-utils": "flake-utils", + "nixpkgs": "nixpkgs" + } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} From 3c5ef63acb718ab0cc1dff4fb2a981b9835d0bee Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Wed, 6 Mar 2024 08:54:17 -0500 Subject: [PATCH 15/17] chore: Remove CI trigger that was added as a test --- .github/workflows/update-flake-dependencies.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index bd9e0bed8..206d25abf 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -2,9 +2,6 @@ name: Update flake dependencies on: - # TODO this is just a test, remove the `push` trigger before merging - push: - branches: [ mrj/nix-flake-overlay ] schedule: - cron: '0 16 * * 5' workflow_dispatch: # for allowing manual triggers of the workflow From b2743a2fc9482dd1f97afa79de3ffce973acbead Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Wed, 6 Mar 2024 09:01:37 -0500 Subject: [PATCH 16/17] fix: only create flake.lock PR if there are actually changes --- .../workflows/update-flake-dependencies.yml | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index 206d25abf..7f7f7d55d 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -22,13 +22,16 @@ jobs: COMMIT_BRANCH: automation/update-flake-dependencies COMMIT_MESSAGE: "chore(nix): Update Flake dependencies" run: | - # create the branch on the remote - git branch "$COMMIT_BRANCH" - git push -u origin "$COMMIT_BRANCH" - # commit via the GitHub API so we get automatic commit signing - gh api --method PUT /repos/1Password/shell-plugins/contents/$FILE_TO_COMMIT \ - --field message="$COMMIT_MESSAGE" \ - --field content=@<(base64 -i $FILE_TO_COMMIT) \ - --field branch="$COMMIT_BRANCH" \ - --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" - gh pr create --title "[automation]: Update Flake dependencies" --body "This is an automated PR to update \`flake.lock\`" --reviewer mrjones2014 --base main --head $COMMIT_BRANCH + # make sure something actually changed first, if not, no updates required + if [[ `git status --porcelain` ]]; then + # create the branch on the remote + git branch "$COMMIT_BRANCH" + git push -u origin "$COMMIT_BRANCH" + # commit via the GitHub API so we get automatic commit signing + gh api --method PUT /repos/1Password/shell-plugins/contents/$FILE_TO_COMMIT \ + --field message="$COMMIT_MESSAGE" \ + --field content=@<(base64 -i $FILE_TO_COMMIT) \ + --field branch="$COMMIT_BRANCH" \ + --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" + gh pr create --title "[automation]: Update Flake dependencies" --body "This is an automated PR to update \`flake.lock\`" --reviewer mrjones2014 --base main --head $COMMIT_BRANCH + fi From e751aa59860f8ca296dc369380480e42e6b9ac2b Mon Sep 17 00:00:00 2001 From: Mat Jones Date: Wed, 6 Mar 2024 11:09:17 -0500 Subject: [PATCH 17/17] feat: Validate specified plugins against the list of supported plugins --- nix/shell-plugins.nix | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-) diff --git a/nix/shell-plugins.nix b/nix/shell-plugins.nix index 3d901ad59..907bf2f5a 100644 --- a/nix/shell-plugins.nix +++ b/nix/shell-plugins.nix @@ -1,6 +1,22 @@ { pkgs, lib, config, is-home-manager, ... }: with lib; -let cfg = config.programs._1password-shell-plugins; +let + cfg = config.programs._1password-shell-plugins; + + supported_plugins = splitString "\n" (lib.readFile "${ + # get the list of supported plugin executable names + pkgs.runCommand "op-plugin-list" { } + # 1Password CLI tries to create the config directory automatically, so set a temp XDG_CONFIG_HOME + # since we don't actually need it for this + "mkdir $out && XDG_CONFIG_HOME=$out ${pkgs._1password}/bin/op plugin list | cut -d ' ' -f1 | tail -n +2 > $out/plugins.txt" + }/plugins.txt"); + getExeName = package: + # NOTE: SAFETY: This is okay because the `packages` list is also referred + # to below as `home.packages = packages;` or `environment.systemPackages = packages;` + # depending on if it's using `home-manager` or not; this means that Nix can still + # compute the dependency tree, even though we're discarding string context here, + # since the packages are still referred to below without discarding string context. + strings.unsafeDiscardStringContext (baseNameOf (getExe package)); in { options = { programs._1password-shell-plugins = { @@ -17,19 +33,25 @@ in { ''; description = "CLI Packages to enable 1Password Shell Plugins for; ensure that a Shell Plugin exists by checking the docs: https://developer.1password.com/docs/cli/shell-plugins/"; + # this is a bit of a hack to do option validation; + # ensure that the list of packages include only packages + # for which the executable has a supported 1Password Shell Plugin + apply = package_list: + map (package: + if (elem (getExeName package) supported_plugins) then + package + else + abort "${ + getExeName package + } is not a valid 1Password Shell Plugin. A list of supported plugins can be found by running `op plugin list` or at: https://developer.1password.com/docs/cli/shell-plugins/") + package_list; }; }; }; config = let # executable names as strings, e.g. `pkgs.gh` => `"gh"`, `pkgs.awscli2` => `"aws"` - pkg-exe-names = map (package: - # NOTE: SAFETY: This is okay because the `packages` list is also referred - # to below as `home.packages = packages;` or `environment.systemPackages = packages;` - # depending on if it's using `home-manager` or not; this means that Nix can still - # compute the dependency tree, even though we're discarding string context here, - # since the packages are still referred to below without discarding string context. - strings.unsafeDiscardStringContext (baseNameOf (getExe package))) cfg.plugins; + pkg-exe-names = map getExeName cfg.plugins; # Explanation: # Map over `cfg.plugins` (the value of the `plugins` option provided by the user) # and for each package specified, get the executable name, then create a shell alias