x509-certificate-exporter/flake.nix

{
  description = "x509-certificate-exporter dev shell";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, flake-utils }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = nixpkgs.legacyPackages.${system};

        # go-size-analyzer is not in nixpkgs (yet). We grab the
        # upstream-built binary rather than `buildGoModule` because the
        # repo embeds a pnpm-built web UI via go:embed — building from
        # source would require also setting up the JS toolchain.
        # Acceptable trade-off for a dev/diagnostic tool.
        #
        # Bump procedure (manual — Renovate can't refresh the four
        # per-arch hashes on a `fetchurl` bump):
        #   1. update `version` below
        #   2. curl -sL https://github.com/Zxilly/go-size-analyzer/releases/download/v<v>/checksums.txt
        #   3. for each (arch, hex) pair: hash = "sha256-$(echo <hex> | xxd -r -p | base64)"
        goSizeAnalyzer = let
          version = "1.12.6";
          assets = {
            "x86_64-linux"   = { suffix = "linux_amd64";  hash = "sha256-k8NBdryks8GIFpADqs0Er0uLXK9BOfg8th01GnVaILA="; };
            "aarch64-linux"  = { suffix = "linux_arm64";  hash = "sha256-hX7LtqLJIX1PTb+8tm4CVE/IuFTGUVDFWipGUMWVPWg="; };
            "x86_64-darwin"  = { suffix = "darwin_amd64"; hash = "sha256-v2IOQEsMShTgW9bntHGsp7MeNI8iV7nSNT5q7KrXj3o="; };
            "aarch64-darwin" = { suffix = "darwin_arm64"; hash = "sha256-5lyZJPD6i1h08wjlg/hBV8wr8MjpFuykCn5bEfyZ1LU="; };
          };
          asset = assets.${system} or (throw "go-size-analyzer: unsupported system ${system}");
        in pkgs.stdenvNoCC.mkDerivation {
          pname = "go-size-analyzer";
          inherit version;
          src = pkgs.fetchurl {
            url = "https://github.com/Zxilly/go-size-analyzer/releases/download/v${version}/go-size-analyzer_${version}_${asset.suffix}.tar.gz";
            hash = asset.hash;
          };
          sourceRoot = ".";
          # Upstream ships the binary as `gsa` — install it under that
          # name (matches the project's own README usage).
          installPhase = ''
            install -Dm755 gsa $out/bin/gsa
          '';
        };

        # GoReleaser pinned independently of nixpkgs so the dev/e2e
        # build path can adopt new releases as soon as upstream ships
        # them. Grabs the upstream binary release rather than rebuilding
        # via `buildGoModule` — same trade-off as goSizeAnalyzer above.
        #
        # Bump procedure (Renovate refreshes `version` but cannot
        # recompute the four per-arch hashes on a `fetchurl` bump):
        #   1. update `version` below
        #   2. curl -sL https://github.com/goreleaser/goreleaser/releases/download/v<v>/checksums.txt
        #   3. for each `goreleaser_<OS>_<arch>.tar.gz` line, convert:
        #      `hash = "sha256-$(echo <hex> | xxd -r -p | base64)"`
        goreleaser = let
          # goreleaser version
          version = "2.16.0";
          assets = {
            "x86_64-linux"   = { suffix = "Linux_x86_64";  hash = "sha256-6q4FteugdTO9DwaEa2jICDmVBHhN8Axi6yGVQfwE5eI="; };
            "aarch64-linux"  = { suffix = "Linux_arm64";   hash = "sha256-AQLZdDc/zet3BC0fWJfK/6GTvjZiD9xsHaQ6Ae+OENM="; };
            "x86_64-darwin"  = { suffix = "Darwin_x86_64"; hash = "sha256-K4LYMZ7lF9QkK0ioWBFLJnxiHx3R/lGhRoCQKxil2sg="; };
            "aarch64-darwin" = { suffix = "Darwin_arm64";  hash = "sha256-j2iYJW81UxFl2Q8ttYHF7g0yvag+vCWsIx/1vbnSBxo="; };
          };
          asset = assets.${system} or (throw "goreleaser: unsupported system ${system}");
        in pkgs.stdenvNoCC.mkDerivation {
          pname = "goreleaser";
          inherit version;
          src = pkgs.fetchurl {
            url = "https://github.com/goreleaser/goreleaser/releases/download/v${version}/goreleaser_${asset.suffix}.tar.gz";
            hash = asset.hash;
          };
          sourceRoot = ".";
          installPhase = ''
            install -Dm755 goreleaser $out/bin/goreleaser
          '';
        };
      in {
        devShells.default = pkgs.mkShell {
          # Go is intentionally unpinned: the dev shell ships whatever Go
          # version nixpkgs currently exposes, and Go's GOTOOLCHAIN=auto
          # mechanism transparently downloads the exact toolchain declared
          # in go.mod. Single source of truth: the `go` directive in go.mod.
          # The Dagger CLI is deliberately NOT a Nix package here. Its
          # version must equal `dagger.json`'s engineVersion (a module
          # refuses to run on an older CLI), and any Nix packaging —
          # upstream's `github:dagger/nix` input or a local fetchurl —
          # carries a *second* copy of that version (plus per-arch
          # hashes) that nothing can derive from the manifest. That
          # duplication is what silently drifts and breaks every
          # `dagger call`. Instead `scripts/dagger-cli.sh` reads
          # engineVersion, fetches the matching binary once into a
          # per-version cache, and verifies it against the release's
          # checksums.txt. Renovate bumps engineVersion; the shell
          # follows with zero manual steps.
          shellHook = ''
            if daggerBin=$(${./scripts/dagger-cli.sh}); then
              PATH="$daggerBin:$PATH"
            else
              echo "warning: Dagger CLI unavailable; 'task lint:*' / 'test:*' will fail" >&2
            fi
          '';

          packages = [
            goSizeAnalyzer
            goreleaser
          ] ++ (with pkgs; [
            go
            go-task
            tilt
            k3d
            kubectl
            kubernetes-helm
            cosign
            rekor-cli
            goda
            graphviz   # `dot`, used by `task analysis:graph` to render goda's DOT output
            xdg-utils  # `xdg-open`, used by `task analysis:graph` to open the SVG
          ]);
        };
      });
}