Add Nix support by srid · Pull Request #165 · avivsinai/bitbucket-cli

srid · 2026-04-14T21:31:54Z

Adds Nix flake support so bkt can be installed and run reproducibly on NixOS, nix-darwin, Linux, and macOS:

nix run github:avivsinai/bitbucket-cli -- --version
nix profile install github:avivsinai/bitbucket-cli

New to Nix? See Nix First.

Changes

flake.nix — packages.default, apps.default, devShells.default (go, gopls, gotools, golangci-lint). Version is stamped from the short git rev via ldflags.
.github/workflows/nix.yml — builds and smoke-tests the flake on ubuntu-latest and macos-latest.
README.md — new Installation subsection covering nix run / nix profile install / ref-pinning.

vendorHash is pinned to the current go.sum; CI fails loudly on drift. Commits are DCO-signed.

Context: came up while wiring bkt into srid/agency#10. Related: #121.

Adds a Nix flake so users can install and run bkt reproducibly: nix run github:avivsinai/bitbucket-cli -- --version nix build github:avivsinai/bitbucket-cli#default The flake exposes: - packages.default / packages.bkt — built via buildGoModule, stamping the short commit into internal/build.versionFromLdflags when building from a clean tree - apps.default — for `nix run` - devShells.default — go, gopls, gotools, golangci-lint A new .github/workflows/nix.yml builds and smoke-tests the flake on ubuntu-latest and macos-latest. It runs only when flake inputs or Go modules change to avoid duplicating the Go-native CI on every PR. Motivation: NixOS / nix-darwin users currently have no first-class install path (Homebrew/Scoop/go install are the documented options). For agents/tools that want a pinned, reproducible bkt without touching a Go toolchain, `nix run github:...` is the simplest entry point. Signed-off-by: Sridhar Ratnakumar <srid@srid.ca>

- README: add a Nix section between Go Install and Binary Downloads with `nix run`, `nix profile install`, and ref-pinning guidance. - nix.yml: drop the paths filter so the flake is built on every push and PR, catching Go module / vendor hash drift proactively. Signed-off-by: Sridhar Ratnakumar <srid@srid.ca>

Signed-off-by: Sridhar Ratnakumar <srid@srid.ca>

avivsinai

Triage note: the diff is scoped and reasonable, and I don't see a blocking code/design issue in the flake or workflow itself.

What is still missing is an actual Nix verification signal. This machine does not have nix installed, and the PR currently does not show a successful Nix workflow run, so the next action here is a real nix flake check / nix build .#default verification from an environment that has Nix available.

srid · 2026-04-15T10:07:53Z

I can confirm nix build works locally. Also the PR includes GitHub workflows to run both nix flake check and nix build in CI, but it may require repo maintainer's approval and acceptance to actually begin running. @avivsinai

avivsinai

I want to push back on one design choice before we merge this.

The flake currently sets doCheck = false in flake.nix, which disables the entire Go test suite for the Nix build. For an OSS project, I don't think we should ship that as the default unless there is a concrete, documented reason that the tests cannot run in the Nix sandbox.

Why I'm pushing on this:

buildGoModule runs checks by default; the idiomatic direction is to keep checks on and only narrow them if specific tests are sandbox-incompatible.
go test ./... passes on this repo today.
If a few tests need extra tools under Nix, the targeted fix is things like nativeCheckInputs = [ pkgs.git ]; and/or selective checkFlags, not a blanket doCheck = false.

So I think this PR should do one of these before merge:

Remove doCheck = false and make the test phase pass under Nix.
If there is a real blocker, document the exact failing tests/tooling constraint in the flake and scope the workaround as narrowly as possible.

The rest of the PR looks reasonable for a first flake integration:

exposing packages.default / apps.default / devShells.default is fine
buildGoModule + vendorHash + subPackages = [ "cmd/bkt" ] is the right overall shape
the Linux/macOS workflow is the right platform coverage

Non-blocking notes:

nix flake check --no-build is more of an eval pass than a real build check; the separate nix build .#default step is what actually proves the package builds.
cachix/install-nix-action already enables nix-command and flakes, so the explicit experimental-features stanza is redundant, though harmless.

References:

Nixpkgs Go packaging manual (buildGoModule): https://ryantm.github.io/nixpkgs/languages-frameworks/go/
nix flake check reference: https://nix.dev/manual/nix/2.18/command-ref/new-cli/nix3-flake-check
install-nix-action defaults: https://github.com/marketplace/actions/install-nix

- Remove doCheck = false so buildGoModule runs go test (idiomatic default) - Switch from cachix/install-nix-action to nixbuild/nix-quick-install-action@v34 - Remove redundant experimental-features config

srid · 2026-04-15T15:17:10Z

@avivsinai Done!

srid · 2026-04-15T15:17:58Z

https://github.com/nixbuild/nix-quick-install-action is also preferable because it is faster in general. And I've been using it in several projects. The AI defaults to cachix action (or DetSys action) for some reason.

avivsinai

Thanks for pushing on Nix support. I think there are a few merge blockers here, mainly because this changes user-visible product behavior rather than just adding another packaging path.

flake.nix:14-30 breaks the version contract for Nix installs. The flake derives version from self.rev and injects that short SHA into internal/build.versionFromLdflags. internal/build/info.go:18-26 then prefers that value over Go build metadata. That means a tag-pinned install like github:avivsinai/bitbucket-cli/v0.24.1 will report a commit hash from bkt --version, not the release version. For a CLI, version output is part of the product contract; Nix installs should not behave differently from the official binaries.
The Nix build currently drops the Cloud OAuth ldflags that the release binaries carry. flake.nix:26-30 only sets versionFromLdflags, while .goreleaser.yaml:22-28 also injects pkg/oauth.cloudClientID and pkg/oauth.cloudClientSecret. As a result, bkt auth login --kind cloud --web will fail for Nix users at pkg/cmd/auth/auth.go:318-321. If Nix is presented in the README as a first-class install path, that auth flow needs to work or be called out explicitly.
.github/workflows/nix.yml:25-27 regresses the repo’s current GitHub Actions hardening by using floating action tags instead of pinned SHAs. The existing workflows already pin actions, for example .github/workflows/ci.yml:22-24, and I think we should keep the same supply-chain bar here.

Stepping back: gh itself is a useful reference point here. It treats packaging as part of the product surface, not just distribution plumbing. That means keeping version output stable, keeping auth behavior consistent, and keeping CI hygiene aligned with the rest of the repo.

Stop overriding versionFromLdflags with a short commit hash; the binary now falls through to Go build metadata or "dev", matching the product contract that only goreleaser release builds carry the real version.

Align with the repo's existing supply-chain hardening convention.

Nix builds don't embed OAuth client credentials; document the BKT_OAUTH_CLIENT_ID / BKT_OAUTH_CLIENT_SECRET fallback.

sentry · 2026-04-16T06:22:37Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

avivsinai

Thanks for pushing this through. The mechanics are green now, and I’m happy with merging this as an additional packaging path.

srid added 3 commits April 14, 2026 17:31

docs(nix): link to nixos.asia install guide for first-time Nix users

4482e40

Signed-off-by: Sridhar Ratnakumar <srid@srid.ca>

srid changed the title ~~build(nix): add flake.nix with CI workflow~~ Add Nix support Apr 14, 2026

srid mentioned this pull request Apr 14, 2026

Support Bitbucket Server repos srid/agency#10

Open

avivsinai added enhancement New feature or request docs Documentation improvements and fixes github_actions Pull requests that update GitHub Actions code labels Apr 15, 2026

avivsinai reviewed Apr 15, 2026

View reviewed changes

avivsinai requested changes Apr 15, 2026

View reviewed changes

srid added 2 commits April 15, 2026 11:15

fix(nix): enable tests and clean up CI workflow

5517b28

- Remove doCheck = false so buildGoModule runs go test (idiomatic default) - Switch from cachix/install-nix-action to nixbuild/nix-quick-install-action@v34 - Remove redundant experimental-features config

chore(nix): use tag ref for actions/checkout

acbcb33

srid requested a review from avivsinai April 15, 2026 15:19

avivsinai requested changes Apr 15, 2026

View reviewed changes

srid added 3 commits April 15, 2026 16:38

fix(nix): remove git-SHA version injection from flake

3847a84

Stop overriding versionFromLdflags with a short commit hash; the binary now falls through to Go build metadata or "dev", matching the product contract that only goreleaser release builds carry the real version.

ci(nix): pin actions to full SHAs

c3d2c0c

Align with the repo's existing supply-chain hardening convention.

docs(nix): note OAuth env vars for Cloud auth

ffb2928

Nix builds don't embed OAuth client credentials; document the BKT_OAUTH_CLIENT_ID / BKT_OAUTH_CLIENT_SECRET fallback.

srid requested a review from avivsinai April 15, 2026 20:40

avivsinai approved these changes Apr 16, 2026

View reviewed changes

avivsinai merged commit c18c129 into avivsinai:master Apr 16, 2026
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Nix support#165

Add Nix support#165
avivsinai merged 8 commits intoavivsinai:masterfrom
srid:add-nix-flake

srid commented Apr 14, 2026 •

edited

Loading

Uh oh!

avivsinai left a comment

Uh oh!

srid commented Apr 15, 2026 •

edited

Loading

Uh oh!

avivsinai left a comment

Uh oh!

srid commented Apr 15, 2026

Uh oh!

srid commented Apr 15, 2026 •

edited

Loading

Uh oh!

avivsinai left a comment

Uh oh!

sentry Bot commented Apr 16, 2026

Uh oh!

avivsinai left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

srid commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

avivsinai left a comment

Choose a reason for hiding this comment

Uh oh!

srid commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

avivsinai left a comment

Choose a reason for hiding this comment

Uh oh!

srid commented Apr 15, 2026

Uh oh!

srid commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

avivsinai left a comment

Choose a reason for hiding this comment

Uh oh!

sentry Bot commented Apr 16, 2026

Codecov Report

Uh oh!

avivsinai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

srid commented Apr 14, 2026 •

edited

Loading

srid commented Apr 15, 2026 •

edited

Loading

srid commented Apr 15, 2026 •

edited

Loading