tools: improve nix-changes coverage

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #65403
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

Author: aduh95

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -52,6 +53,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
  - v[0-9]+.x
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 pull_request:
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
 with:
 fetch-depth: 2
 persist-credentials: false
-sparse-checkout: '*.nix'
+sparse-checkout: |
+ shell.nix
+ tools/nix/
 sparse-checkout-cone-mode: false
 
  - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
@@ -60,39 +64,14 @@ jobs:
 name: nodejs
 
  - name: Compute requisites after change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-run: |
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-after.list
+run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
  - name: Compute requisites before change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
 run: |
  git reset HEAD^ --hard
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-before.list
+ # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+ [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+ ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
  - name: Output diff
 run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**
@@ -27,6 +28,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -53,6 +54,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**
@@ -96,6 +97,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**

tools/nix/list-requisites.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.."&& pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+ (import <nixpkgs> {}).lib.concatMapStrings
+ (n: ''--arg \${n} true '')
+ (builtins.filter
+ (n: builtins.match ''with[A-Z].+'' n != null)
+ (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+"
+)
+
+DRV=$(
+cd"$BASE_DIR"
+# shellcheck disable=SC2086
+ nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+$OPTIONAL_FLAGS \
+ --arg sharedLibDeps '{
+ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+ # We pass the shared deps as devTools below so they are still accounted for.
+ }' \
+ --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+ # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+ }' \
+ --arg devTools '
+ let
+ pkgs = import <nixpkgs> { };
+ sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+ in
+ (import ./tools/nix/devTools.nix { })
+ ++ pkgs.lib.flatten (
+ with (pkgs.callPackage ./tools/nix/v8.nix { });
+ [
+ # We do not want to build V8 here, but still want to list its requisites.
+ buildInputs
+ nativeBuildInputs
+ propagatedBuildInputs
+ propagatedNativeBuildInputs
+ (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+ ]
+ )
+ ++ builtins.attrValues (
+ {
+ # Additional packages we are using across the codebase
+ inherit (pkgs) nixfmt-tree sccache;
+ }
+ // import ./tools/nix/openssl-matrix.nix { }
+ // sharedLibDepsFn (
+ pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+ builtins.functionArgs sharedLibDepsFn
+ )
+ )
+ )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS"| xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS"| xargs nix-store --query --requisites)
+
+echo"$REQUISITES"| sort -k1.45 | uniq

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -52,6 +53,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
  - v[0-9]+.x
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 pull_request:
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
 with:
 fetch-depth: 2
 persist-credentials: false
-sparse-checkout: '*.nix'
+sparse-checkout: |
+ shell.nix
+ tools/nix/
 sparse-checkout-cone-mode: false
 
  - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
@@ -60,39 +64,14 @@ jobs:
 name: nodejs
 
  - name: Compute requisites after change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-run: |
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-after.list
+run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
  - name: Compute requisites before change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
 run: |
  git reset HEAD^ --hard
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-before.list
+ # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+ [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+ ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
  - name: Output diff
 run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**
@@ -27,6 +28,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -53,6 +54,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**
@@ -96,6 +97,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**

tools/nix/list-requisites.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.."&& pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+ (import <nixpkgs> {}).lib.concatMapStrings
+ (n: ''--arg \${n} true '')
+ (builtins.filter
+ (n: builtins.match ''with[A-Z].+'' n != null)
+ (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+"
+)
+
+DRV=$(
+cd"$BASE_DIR"
+# shellcheck disable=SC2086
+ nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+$OPTIONAL_FLAGS \
+ --arg sharedLibDeps '{
+ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+ # We pass the shared deps as devTools below so they are still accounted for.
+ }' \
+ --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+ # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+ }' \
+ --arg devTools '
+ let
+ pkgs = import <nixpkgs> { };
+ sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+ in
+ (import ./tools/nix/devTools.nix { })
+ ++ pkgs.lib.flatten (
+ with (pkgs.callPackage ./tools/nix/v8.nix { });
+ [
+ # We do not want to build V8 here, but still want to list its requisites.
+ buildInputs
+ nativeBuildInputs
+ propagatedBuildInputs
+ propagatedNativeBuildInputs
+ (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+ ]
+ )
+ ++ builtins.attrValues (
+ {
+ # Additional packages we are using across the codebase
+ inherit (pkgs) nixfmt-tree sccache;
+ }
+ // import ./tools/nix/openssl-matrix.nix { }
+ // sharedLibDepsFn (
+ pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+ builtins.functionArgs sharedLibDepsFn
+ )
+ )
+ )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS"| xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS"| xargs nix-store --query --requisites)
+
+echo"$REQUISITES"| sort -k1.45 | uniq

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -52,6 +53,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
  - v[0-9]+.x
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 pull_request:
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
 with:
 fetch-depth: 2
 persist-credentials: false
-sparse-checkout: '*.nix'
+sparse-checkout: |
+ shell.nix
+ tools/nix/
 sparse-checkout-cone-mode: false
 
  - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
@@ -60,39 +64,14 @@ jobs:
 name: nodejs
 
  - name: Compute requisites after change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-run: |
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-after.list
+run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
  - name: Compute requisites before change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
 run: |
  git reset HEAD^ --hard
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-before.list
+ # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+ [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+ ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
  - name: Output diff
 run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**
@@ -27,6 +28,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -53,6 +54,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**
@@ -96,6 +97,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**

tools/nix/list-requisites.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.."&& pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+ (import <nixpkgs> {}).lib.concatMapStrings
+ (n: ''--arg \${n} true '')
+ (builtins.filter
+ (n: builtins.match ''with[A-Z].+'' n != null)
+ (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+"
+)
+
+DRV=$(
+cd"$BASE_DIR"
+# shellcheck disable=SC2086
+ nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+$OPTIONAL_FLAGS \
+ --arg sharedLibDeps '{
+ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+ # We pass the shared deps as devTools below so they are still accounted for.
+ }' \
+ --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+ # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+ }' \
+ --arg devTools '
+ let
+ pkgs = import <nixpkgs> { };
+ sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+ in
+ (import ./tools/nix/devTools.nix { })
+ ++ pkgs.lib.flatten (
+ with (pkgs.callPackage ./tools/nix/v8.nix { });
+ [
+ # We do not want to build V8 here, but still want to list its requisites.
+ buildInputs
+ nativeBuildInputs
+ propagatedBuildInputs
+ propagatedNativeBuildInputs
+ (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+ ]
+ )
+ ++ builtins.attrValues (
+ {
+ # Additional packages we are using across the codebase
+ inherit (pkgs) nixfmt-tree sccache;
+ }
+ // import ./tools/nix/openssl-matrix.nix { }
+ // sharedLibDepsFn (
+ pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+ builtins.functionArgs sharedLibDepsFn
+ )
+ )
+ )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS"| xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS"| xargs nix-store --query --requisites)
+
+echo"$REQUISITES"| sort -k1.45 | uniq

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -52,6 +53,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
  - v[0-9]+.x
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 pull_request:
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
 with:
 fetch-depth: 2
 persist-credentials: false
-sparse-checkout: '*.nix'
+sparse-checkout: |
+ shell.nix
+ tools/nix/
 sparse-checkout-cone-mode: false
 
  - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
@@ -60,39 +64,14 @@ jobs:
 name: nodejs
 
  - name: Compute requisites after change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-run: |
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-after.list
+run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
  - name: Compute requisites before change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
 run: |
  git reset HEAD^ --hard
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-before.list
+ # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+ [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+ ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
  - name: Output diff
 run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**
@@ -27,6 +28,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -53,6 +54,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**
@@ -96,6 +97,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**

tools/nix/list-requisites.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.."&& pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+ (import <nixpkgs> {}).lib.concatMapStrings
+ (n: ''--arg \${n} true '')
+ (builtins.filter
+ (n: builtins.match ''with[A-Z].+'' n != null)
+ (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+"
+)
+
+DRV=$(
+cd"$BASE_DIR"
+# shellcheck disable=SC2086
+ nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+$OPTIONAL_FLAGS \
+ --arg sharedLibDeps '{
+ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+ # We pass the shared deps as devTools below so they are still accounted for.
+ }' \
+ --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+ # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+ }' \
+ --arg devTools '
+ let
+ pkgs = import <nixpkgs> { };
+ sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+ in
+ (import ./tools/nix/devTools.nix { })
+ ++ pkgs.lib.flatten (
+ with (pkgs.callPackage ./tools/nix/v8.nix { });
+ [
+ # We do not want to build V8 here, but still want to list its requisites.
+ buildInputs
+ nativeBuildInputs
+ propagatedBuildInputs
+ propagatedNativeBuildInputs
+ (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+ ]
+ )
+ ++ builtins.attrValues (
+ {
+ # Additional packages we are using across the codebase
+ inherit (pkgs) nixfmt-tree sccache;
+ }
+ // import ./tools/nix/openssl-matrix.nix { }
+ // sharedLibDepsFn (
+ pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+ builtins.functionArgs sharedLibDepsFn
+ )
+ )
+ )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS"| xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS"| xargs nix-store --query --requisites)
+
+echo"$REQUISITES"| sort -k1.45 | uniq

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -52,6 +53,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
  - v[0-9]+.x
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 pull_request:
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
 with:
 fetch-depth: 2
 persist-credentials: false
-sparse-checkout: '*.nix'
+sparse-checkout: |
+ shell.nix
+ tools/nix/
 sparse-checkout-cone-mode: false
 
  - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
@@ -60,39 +64,14 @@ jobs:
 name: nodejs
 
  - name: Compute requisites after change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-run: |
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-after.list
+run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
  - name: Compute requisites before change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
 run: |
  git reset HEAD^ --hard
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-before.list
+ # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+ [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+ ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
  - name: Output diff
 run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**
@@ -27,6 +28,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -53,6 +54,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**
@@ -96,6 +97,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**

tools/nix/list-requisites.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.."&& pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+ (import <nixpkgs> {}).lib.concatMapStrings
+ (n: ''--arg \${n} true '')
+ (builtins.filter
+ (n: builtins.match ''with[A-Z].+'' n != null)
+ (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+"
+)
+
+DRV=$(
+cd"$BASE_DIR"
+# shellcheck disable=SC2086
+ nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+$OPTIONAL_FLAGS \
+ --arg sharedLibDeps '{
+ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+ # We pass the shared deps as devTools below so they are still accounted for.
+ }' \
+ --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+ # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+ }' \
+ --arg devTools '
+ let
+ pkgs = import <nixpkgs> { };
+ sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+ in
+ (import ./tools/nix/devTools.nix { })
+ ++ pkgs.lib.flatten (
+ with (pkgs.callPackage ./tools/nix/v8.nix { });
+ [
+ # We do not want to build V8 here, but still want to list its requisites.
+ buildInputs
+ nativeBuildInputs
+ propagatedBuildInputs
+ propagatedNativeBuildInputs
+ (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+ ]
+ )
+ ++ builtins.attrValues (
+ {
+ # Additional packages we are using across the codebase
+ inherit (pkgs) nixfmt-tree sccache;
+ }
+ // import ./tools/nix/openssl-matrix.nix { }
+ // sharedLibDepsFn (
+ pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+ builtins.functionArgs sharedLibDepsFn
+ )
+ )
+ )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS"| xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS"| xargs nix-store --query --requisites)
+
+echo"$REQUISITES"| sort -k1.45 | uniq

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -52,6 +53,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
  - v[0-9]+.x
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 pull_request:
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
 with:
 fetch-depth: 2
 persist-credentials: false
-sparse-checkout: '*.nix'
+sparse-checkout: |
+ shell.nix
+ tools/nix/
 sparse-checkout-cone-mode: false
 
  - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
@@ -60,39 +64,14 @@ jobs:
 name: nodejs
 
  - name: Compute requisites after change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-run: |
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-after.list
+run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
  - name: Compute requisites before change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
 run: |
  git reset HEAD^ --hard
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-before.list
+ # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+ [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+ ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
  - name: Output diff
 run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**
@@ -27,6 +28,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -53,6 +54,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**
@@ -96,6 +97,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**

tools/nix/list-requisites.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.."&& pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+ (import <nixpkgs> {}).lib.concatMapStrings
+ (n: ''--arg \${n} true '')
+ (builtins.filter
+ (n: builtins.match ''with[A-Z].+'' n != null)
+ (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+"
+)
+
+DRV=$(
+cd"$BASE_DIR"
+# shellcheck disable=SC2086
+ nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+$OPTIONAL_FLAGS \
+ --arg sharedLibDeps '{
+ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+ # We pass the shared deps as devTools below so they are still accounted for.
+ }' \
+ --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+ # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+ }' \
+ --arg devTools '
+ let
+ pkgs = import <nixpkgs> { };
+ sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+ in
+ (import ./tools/nix/devTools.nix { })
+ ++ pkgs.lib.flatten (
+ with (pkgs.callPackage ./tools/nix/v8.nix { });
+ [
+ # We do not want to build V8 here, but still want to list its requisites.
+ buildInputs
+ nativeBuildInputs
+ propagatedBuildInputs
+ propagatedNativeBuildInputs
+ (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+ ]
+ )
+ ++ builtins.attrValues (
+ {
+ # Additional packages we are using across the codebase
+ inherit (pkgs) nixfmt-tree sccache;
+ }
+ // import ./tools/nix/openssl-matrix.nix { }
+ // sharedLibDepsFn (
+ pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+ builtins.functionArgs sharedLibDepsFn
+ )
+ )
+ )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS"| xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS"| xargs nix-store --query --requisites)
+
+echo"$REQUISITES"| sort -k1.45 | uniq

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -52,6 +53,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
  - v[0-9]+.x
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 pull_request:
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
 with:
 fetch-depth: 2
 persist-credentials: false
-sparse-checkout: '*.nix'
+sparse-checkout: |
+ shell.nix
+ tools/nix/
 sparse-checkout-cone-mode: false
 
  - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
@@ -60,39 +64,14 @@ jobs:
 name: nodejs
 
  - name: Compute requisites after change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-run: |
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-after.list
+run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
  - name: Compute requisites before change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
 run: |
  git reset HEAD^ --hard
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-before.list
+ # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+ [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+ ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
  - name: Output diff
 run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**
@@ -27,6 +28,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -53,6 +54,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**
@@ -96,6 +97,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**

tools/nix/list-requisites.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.."&& pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+ (import <nixpkgs> {}).lib.concatMapStrings
+ (n: ''--arg \${n} true '')
+ (builtins.filter
+ (n: builtins.match ''with[A-Z].+'' n != null)
+ (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+"
+)
+
+DRV=$(
+cd"$BASE_DIR"
+# shellcheck disable=SC2086
+ nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+$OPTIONAL_FLAGS \
+ --arg sharedLibDeps '{
+ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+ # We pass the shared deps as devTools below so they are still accounted for.
+ }' \
+ --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+ # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+ }' \
+ --arg devTools '
+ let
+ pkgs = import <nixpkgs> { };
+ sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+ in
+ (import ./tools/nix/devTools.nix { })
+ ++ pkgs.lib.flatten (
+ with (pkgs.callPackage ./tools/nix/v8.nix { });
+ [
+ # We do not want to build V8 here, but still want to list its requisites.
+ buildInputs
+ nativeBuildInputs
+ propagatedBuildInputs
+ propagatedNativeBuildInputs
+ (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+ ]
+ )
+ ++ builtins.attrValues (
+ {
+ # Additional packages we are using across the codebase
+ inherit (pkgs) nixfmt-tree sccache;
+ }
+ // import ./tools/nix/openssl-matrix.nix { }
+ // sharedLibDepsFn (
+ pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+ builtins.functionArgs sharedLibDepsFn
+ )
+ )
+ )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS"| xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS"| xargs nix-store --query --requisites)
+
+echo"$REQUISITES"| sort -k1.45 | uniq

.github/workflows/build-tarball.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -52,6 +53,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/coverage-windows.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'
@@ -49,6 +50,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - .**
  - '!.github/workflows/coverage-windows.yml'

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
  - v[0-9]+.x
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 pull_request:
 paths:
  - '**.nix'
+ - tools/nix/**
  - .github/workflows/nix-changes.yml
 types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
 with:
 fetch-depth: 2
 persist-credentials: false
-sparse-checkout: '*.nix'
+sparse-checkout: |
+ shell.nix
+ tools/nix/
 sparse-checkout-cone-mode: false
 
  - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
@@ -60,39 +64,14 @@ jobs:
 name: nodejs
 
  - name: Compute requisites after change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-run: |
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-after.list
+run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list
 
  - name: Compute requisites before change
-shell: bash # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
 run: |
  git reset HEAD^ --hard
- nix-store --query --references "$(
- nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
- --arg devTools "
- (import ./tools/nix/devTools.nix {})
- ++ builtins.attrValues (
- { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
- // import ./tools/nix/openssl-matrix.nix {}
- // import ./tools/nix/pkcs11.nix {}
- )")" \
- | xargs nix-store --realise \
- | xargs nix-store --query --requisites \
- | sort -k1.45 \
- > requisites-${{ matrix.system }}-before.list
+ # TODO(aduh95): remove this once list-requisites.sh has reached `main`
+ [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+ ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
 
  - name: Output diff
 run: |

.github/workflows/test-linux.yml

@@ -9,6 +9,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**
@@ -27,6 +28,7 @@ on:
  - tools/actions/**
  - tools/clang-format/**
  - tools/dep_updaters/**
+ - tools/nix/**
  - test/internet/**
  - '**.nix'
  - .github/**

.github/workflows/test-macos.yml

@@ -23,6 +23,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**
@@ -53,6 +54,7 @@ on:
  - tools/eslint-rules/**
  - tools/eslint/**
  - tools/lint-md/**
+ - tools/nix/**
  - typings/**
  - vcbuild.bat
  - .**

.github/workflows/test-shared.yml

@@ -44,6 +44,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**
@@ -96,6 +97,7 @@ on:
  - '!tools/nix/**'
  - '!tools/v8/**'
  - '!tools/v8_gypfiles/**'
+ - tools/nix/list-requisites.sh
  - typings/**
  - vcbuild.bat
  - .**

tools/nix/list-requisites.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+
+set -ex
+
+BASE_DIR=$(cd "$(dirname "$0")/../.."&& pwd)
+
+OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E "
+ (import <nixpkgs> {}).lib.concatMapStrings
+ (n: ''--arg \${n} true '')
+ (builtins.filter
+ (n: builtins.match ''with[A-Z].+'' n != null)
+ (builtins.attrNames (builtins.functionArgs (import $BASE_DIR/shell.nix))))
+"
+)
+
+DRV=$(
+cd"$BASE_DIR"
+# shellcheck disable=SC2086
+ nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+$OPTIONAL_FLAGS \
+ --arg sharedLibDeps '{
+ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+ # We pass the shared deps as devTools below so they are still accounted for.
+ }' \
+ --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+ # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+ }' \
+ --arg devTools '
+ let
+ pkgs = import <nixpkgs> { };
+ sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+ in
+ (import ./tools/nix/devTools.nix { })
+ ++ pkgs.lib.flatten (
+ with (pkgs.callPackage ./tools/nix/v8.nix { });
+ [
+ # We do not want to build V8 here, but still want to list its requisites.
+ buildInputs
+ nativeBuildInputs
+ propagatedBuildInputs
+ propagatedNativeBuildInputs
+ (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+ ]
+ )
+ ++ builtins.attrValues (
+ {
+ # Additional packages we are using across the codebase
+ inherit (pkgs) nixfmt-tree sccache;
+ }
+ // import ./tools/nix/openssl-matrix.nix { }
+ // sharedLibDepsFn (
+ pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+ builtins.functionArgs sharedLibDepsFn
+ )
+ )
+ )'
+)
+REFS=$(nix-store --query --references "$DRV")
+STORE_PATHS=$(echo "$REFS"| xargs nix-store --realise)
+REQUISITES=$(echo "$STORE_PATHS"| xargs nix-store --query --requisites)
+
+echo"$REQUISITES"| sort -k1.45 | uniq