@smoothbricks/cli 0.11.10 → 0.11.12

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -31,20 +31,16 @@ add_repo_paths() {
 # `--accept-flake-config` makes it worse than untidy: it pre-trusts the
 # substituters declared by a commit nobody looked at.
 #
-# Resolved lazily, on the install path only: a runner that already has devenv
-# never needs the rev, and that is the one branch which pays for a `nix eval`.
-devenv_flake() {
-  if [ -n "${DEVENV_FLAKE:-}" ]; then
-    printf '%s' "$DEVENV_FLAKE"
-    return 0
-  fi
+# Resolved lazily, on the paths that need it, because a host runner never does
+# and that is the one branch which must not pay for a `nix eval`.
+devenv_locked_rev() {
   local lock="$repo_root/tooling/direnv/devenv.lock" rev
   # nix, not jq: jq arrives with the shell this script is about to build, while
   # nix is guaranteed by the install step before it. fromJSON also beats
   # hand-rolled parsing of a file whose key order is not ours to assume.
   # Absolute-path readFile needs --impure; nix's own error is left on stderr
-  # rather than swallowed, because an unresolvable pin is the failure this
-  # function exists to prevent.
+  # rather than swallowed, because an unresolvable pin is the failure these
+  # functions exist to prevent.
   rev="$(nix eval --raw --impure --expr \
     "(builtins.fromJSON (builtins.readFile \"$lock\")).nodes.devenv.locked.rev")" || rev=""
   if [ -z "$rev" ]; then
@@ -52,26 +48,89 @@ devenv_flake() {
     echo "                set DEVENV_FLAKE to install a devenv explicitly" >&2
     return 1
   fi
-  printf 'github:cachix/devenv/%s' "$rev"
+  printf '%s' "$rev"
+}
+
+# Whether a devenv binary is the commit the lock names. `devenv version` prints
+# "devenv <semver>+<short rev> (<system>)", so the abbreviated commit is right
+# there and a prefix test against the full rev is the entire comparison — no
+# assumption about how many characters devenv chooses to abbreviate to. A build
+# with no "+<rev>" at all cannot prefix a 40-char hex rev, so it reads as a
+# mismatch, which is the safe direction.
+devenv_matches_lock() {
+  local bin="$1" rev="$2" printed
+  printed="$("$bin" version 2>/dev/null)" || return 1
+  printed="${printed#*+}"
+  printed="${printed%% *}"
+  [ -n "$printed" ] || return 1
+  case "$rev" in
+    "$printed"*) return 0 ;;
+  esac
+  return 1
 }
 
 install_devenv() {
-  # Shared host /nix/store is the package cache. Image may already provide
-  # devenv; otherwise profile-add the flake rev devenv.lock names (links store
-  # paths; re-fetch only when missing).
-  # The restored profile is not on PATH yet; look where the store cache put
-  # it before evaluating the devenv flake again.
-  local restored="$HOME/.nix-profile/bin/devenv"
+  local rev flake found=""
+  # Host runners own their Nix profile, and that profile roots a /nix/store the
+  # whole fleet shares, so an image-provided devenv is authoritative here
+  # whatever commit it is — and a wrong one is never REPLACED, because
+  # `nix profile remove --all` on a host would take the fleet's other roots with
+  # it. SMOO_HOST_RUNNER comes from setup-devenv's runner-kind detection.
+  #
+  # With none present these runners install from the FLOATING branch, not the
+  # locked rev, which is the one place this script deliberately accepts drift.
+  # The pin exists to make the ephemeral runners' cached devenv reproducible;
+  # a host installs into a long-lived shared profile whose blast radius is the
+  # whole fleet, and pinning it down to an older CLI than the fleet had been
+  # running broke it: run 34374650577 segfaulted the Rust linker
+  # (devenv-rust-linker, clang exit 139) building cowshed-cli tests, where run
+  # 34371205556 on the same commit range was green with floating 2a399e9.
+  # 190959a is TWO COMMITS OLDER than what these hosts had been getting, so the
+  # pin was moving them backwards. A host's toolchain moves when its image or
+  # the lock moves, not when a repository decides to hold it back.
+  if [ "${SMOO_HOST_RUNNER:-false}" = true ]; then
+    if command -v devenv >/dev/null 2>&1; then
+      echo "using host devenv: $(command -v devenv) ($(devenv version))"
+    else
+      flake="${DEVENV_FLAKE:-github:cachix/devenv}"
+      echo "host runner has no devenv; nix profile add ${flake}"
+      nix profile add --accept-flake-config "$flake"
+    fi
+    devenv_path_and_caches
+    return 0
+  fi
+
+  rev="$(devenv_locked_rev)"
+  # The store cache carries content only, never the Nix profiles, so the normal
+  # ephemeral case is that nothing is installed yet and this profile-adds the
+  # locked rev against an already-warm /nix — an evaluation and a link, not a
+  # download. Anything that does turn up on PATH is still checked rather than
+  # trusted, because "a devenv exists" was never the question.
   if command -v devenv >/dev/null 2>&1; then
-    echo "using existing devenv: $(command -v devenv) ($(devenv version))"
-  elif [ -x "$restored" ]; then
-    echo "using restored devenv: $restored ($("$restored" version))"
+    found="$(command -v devenv)"
+  elif [ -x "$HOME/.nix-profile/bin/devenv" ]; then
+    found="$HOME/.nix-profile/bin/devenv"
+  fi
+
+  if [ -n "$found" ] && devenv_matches_lock "$found" "$rev"; then
+    echo "using locked devenv: $found ($("$found" version))"
   else
-    local flake
-    flake="$(devenv_flake)"
+    flake="${DEVENV_FLAKE:-github:cachix/devenv/$rev}"
+    if [ -n "$found" ]; then
+      # Replacing needs the old entry gone first: `nix profile add` would
+      # otherwise refuse on a bin/devenv collision at equal priority. --all is
+      # exact rather than blunt, because devenv is the only thing this script
+      # ever profile-adds, so a wrong devenv means a wrong profile.
+      echo "replacing devenv $("$found" version 2>/dev/null) — lock names ${rev:0:7}"
+      nix profile remove --all
+    fi
     echo "nix profile add ${flake}"
     nix profile add --accept-flake-config "$flake"
   fi
+  devenv_path_and_caches
+}
+
+devenv_path_and_caches() {
   if [ -d "$HOME/.nix-profile/bin" ]; then
     echo "$HOME/.nix-profile/bin" >> "${GITHUB_PATH:-/dev/null}"
   fi

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -119,9 +119,29 @@ runs:
           keep-env-derivations = true
 
     # The store itself, restored as files: /nix/store plus the Nix database,
-    # merged into the fresh install. Profiles live outside /nix/var in
-    # single-user mode and ride along. The post phase collects garbage down
-    # to the live closure and saves when the primary key missed.
+    # merged into the fresh install. The post phase collects garbage down to the
+    # live closure and saves when the primary key missed.
+    #
+    # CONTENT ONLY — never the Nix profiles. `~/.nix-profile` and
+    # ~/.local/state/nix/profiles are mutable places whose whole job is to be
+    # gcroots, and restoring a previous run's copies over a freshly installed
+    # single-user Nix de-roots the Nix binary that is currently running. The post
+    # phase then garbage-collects it and cache-nix-action's own `nix --version`
+    # probe fails, at which point it skips the upload and still reports the step
+    # as a success — so the store cache silently stops being written and every
+    # later run pays a cold shell. Measured exactly that way: run 34371205556
+    # logged `nix (Nix) 2.34.7`, freed 2.7 GiB, then `nix: command not found`,
+    # and no `Cache saved` line for this key ever appeared.
+    #
+    # It only surfaced now because it needs a restore-prefix fallback rather than
+    # a cold store or an exact hit: a matching key restores profiles consistent
+    # with the store, while the diet rotated the key and pulled the previous
+    # store's profiles onto a different Nix.
+    #
+    # Dropping them costs nothing and buys determinism. devenv's closure still
+    # arrives inside /nix, so install-devenv's `nix profile add` of the locked
+    # rev is a link rather than a download, and the devenv in play is the one
+    # devenv.lock names instead of whichever run last populated the prefix.
     - name: 🧊 Cache Nix store
       id: nix-cache
       if: steps.runner-kind.outputs.host != 'true'
@@ -129,12 +149,10 @@ runs:
       with:
         paths: |
           /nix
-          ~/.nix-profile
-          ~/.local/state/nix/profiles
           ~/.cache/nix
         # prettier-ignore
-        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v4-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
-        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v4-
+        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v5-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
+        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v5-
         gc-max-store-size: 1G
 
     - name: ⚡ Enable Cachix
@@ -143,9 +161,17 @@ runs:
       with:
         name: devenv
 
+    # A host runner's devenv belongs to its image, so install-devenv accepts
+    # whatever is on PATH there. On an ephemeral runner the devenv came out of a
+    # cache this workflow wrote, so it is held to devenv.lock's rev: the store
+    # cache restores ~/.nix-profile wholesale and a prefix match hands the job
+    # the CLI of whichever run last populated the key, which outlived a lock bump
+    # until the check existed.
     - name: 🧰 Install devenv
       shell: bash
       working-directory: tooling/direnv
+      env:
+        SMOO_HOST_RUNNER: ${{ steps.runner-kind.outputs.host }}
       run: ./github-actions-bootstrap.sh install-devenv
 
     # node_modules + ttsc plugin binaries: GH Actions cache on ephemeral runners.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.10",
+  "version": "0.11.12",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.5",
+    "@smoothbricks/nx-plugin": "0.4.6",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/monorepo/cargo-policy.test.ts

@@ -1,8 +1,9 @@
 import { describe, expect, it, spyOn } from 'bun:test';
+import { readFileSync } from 'node:fs';
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { validateCargoCachePolicy } from './cargo-policy.js';
+import { applyCargoFeatureUnification, type CargoHakariShell, validateCargoCachePolicy } from './cargo-policy.js';
 
 async function withFixture<T>(files: Record<string, string>, callback: (root: string) => T): Promise<T> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-cargo-policy-'));
@@ -18,17 +19,46 @@ async function withFixture<T>(files: Record<string, string>, callback: (root: st
   }
 }
 
-async function check(files: Record<string, string>): Promise<{ failures: number; messages: string[] }> {
+async function check(
+  files: Record<string, string>,
+  shell?: CargoHakariShell,
+): Promise<{ failures: number; messages: string[] }> {
   return withFixture(files, (root) => {
     const captured = captureErrors();
     try {
-      return { failures: validateCargoCachePolicy(root), messages: captured.messages };
+      return { failures: validateCargoCachePolicy(root, { shell }), messages: captured.messages };
     } finally {
       captured.restore();
     }
   });
 }
 
+/** Records what update would run, and answers `verify` however the test needs. */
+function recordingHakari(
+  verify: { code: number; output?: string; missing?: boolean } = { code: 0 },
+): CargoHakariShell & {
+  calls: string[][];
+} {
+  const calls: string[][] = [];
+  return {
+    calls,
+    run(_directory, args) {
+      calls.push([...args]);
+      return args[0] === 'verify'
+        ? { code: verify.code, output: verify.output ?? '', missing: verify.missing ?? false }
+        : { code: 0, output: '', missing: false };
+    },
+  };
+}
+
+const NIGHTLY_DEVENV = 'languages.rust = {\n  channel = "nightly";\n};\n';
+const UNIFIED_CONFIG = '[unstable]\nfeature-unification = true\n\n[resolver]\nfeature-unification = "workspace"\n';
+const TWO_CRATE_WORKSPACE = {
+  'Cargo.toml': '[workspace]\nmembers = ["crates/*"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+  'crates/alpha/Cargo.toml': '[package]\nname = "alpha"\n',
+  'crates/beta/Cargo.toml': '[package]\nname = "beta"\n',
+};
+
 function captureErrors(): { messages: string[]; restore: () => void } {
   const messages: string[] = [];
   const error = spyOn(console, 'error').mockImplementation((...args: unknown[]) => {
@@ -186,3 +216,176 @@ describe('Cargo cache policy', () => {
     expect(result.messages).toEqual([]);
   });
 });
+
+describe('Cargo workspace feature unification', () => {
+  it('leaves a single-crate workspace alone', async () => {
+    // Nothing to unify: `feature-unification = "workspace"` and a workspace-hack
+    // both exist to stop ONE dependency being built twice with different
+    // features for two members, which needs two members.
+    const result = await check({
+      'Cargo.toml': '[workspace]\nmembers = ["crates/only"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+      'crates/only/Cargo.toml': '[package]\nname = "only"\n',
+      'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV,
+    });
+    expect(result.failures).toBe(0);
+  });
+
+  it('requires a mechanism once a workspace holds more than one crate', async () => {
+    const result = await check({ ...TWO_CRATE_WORKSPACE, 'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV });
+    expect(result.failures).toBe(1);
+    expect(result.messages[0]).toContain('feature-unification');
+    expect(result.messages[0]).toContain('smoo monorepo update');
+  });
+
+  it('accepts the nightly resolver configuration and rejects it without the unstable flag', async () => {
+    const configured = await check({
+      ...TWO_CRATE_WORKSPACE,
+      'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV,
+      '.cargo/config.toml': UNIFIED_CONFIG,
+    });
+    expect(configured.failures).toBe(0);
+
+    // Cargo silently ignores [resolver] feature-unification without the
+    // unstable opt-in, so the half-configured repository believes it is unified
+    // while every crate still re-resolves features.
+    const inert = await check({
+      ...TWO_CRATE_WORKSPACE,
+      'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV,
+      '.cargo/config.toml': '[resolver]\nfeature-unification = "workspace"\n',
+    });
+    expect(inert.failures).toBe(1);
+    expect(inert.messages[0]).toContain('[unstable] feature-unification = true');
+  });
+
+  it('reads the channel from the managed devenv module, not from a decorative rust-toolchain file', async () => {
+    // devenv resolves the toolchain through rust-overlay and ignores
+    // rust-toolchain.toml unless languages.rust.toolchainFile names it, so the
+    // module's channel is the compiler that actually runs these commands.
+    const result = await check({
+      ...TWO_CRATE_WORKSPACE,
+      'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV,
+      'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      '.cargo/config.toml': UNIFIED_CONFIG,
+    });
+    expect(result.failures).toBe(0);
+  });
+
+  it('refuses the nightly-only resolver key on a stable toolchain', async () => {
+    const result = await check({
+      ...TWO_CRATE_WORKSPACE,
+      'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      '.cargo/config.toml': UNIFIED_CONFIG,
+    });
+    expect(result.failures).toBe(1);
+    expect(result.messages[0]).toContain('cargo-hakari');
+    expect(result.messages[0]).toContain('stable');
+  });
+
+  it('accepts a hakari-managed workspace-hack on a stable toolchain', async () => {
+    const hakari = recordingHakari();
+    const result = await check(
+      {
+        'Cargo.toml':
+          '[workspace]\nmembers = ["crates/*", "workspace-hack"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+        'crates/alpha/Cargo.toml':
+          '[package]\nname = "alpha"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'crates/beta/Cargo.toml':
+          '[package]\nname = "beta"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'workspace-hack/Cargo.toml': '[package]\nname = "workspace-hack"\n',
+        '.config/hakari.toml': 'hakari-package = "workspace-hack"\nresolver = "2"\n',
+        'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      },
+      hakari,
+    );
+    expect(result.failures).toBe(0);
+    expect(hakari.calls).toEqual([['verify']]);
+  });
+
+  it('flags a crate that does not depend on the workspace-hack', async () => {
+    const result = await check(
+      {
+        'Cargo.toml':
+          '[workspace]\nmembers = ["crates/*", "workspace-hack"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+        'crates/alpha/Cargo.toml':
+          '[package]\nname = "alpha"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'crates/beta/Cargo.toml': '[package]\nname = "beta"\n',
+        'workspace-hack/Cargo.toml': '[package]\nname = "workspace-hack"\n',
+        '.config/hakari.toml': 'hakari-package = "workspace-hack"\n',
+        'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      },
+      recordingHakari(),
+    );
+    expect(result.failures).toBe(1);
+    expect(result.messages[0]).toContain('beta');
+    expect(result.messages[0]).toContain('smoo monorepo update');
+  });
+
+  it('surfaces a stale workspace-hack that cargo hakari verify rejects', async () => {
+    const result = await check(
+      {
+        'Cargo.toml':
+          '[workspace]\nmembers = ["crates/*", "workspace-hack"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+        'crates/alpha/Cargo.toml':
+          '[package]\nname = "alpha"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'crates/beta/Cargo.toml':
+          '[package]\nname = "beta"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'workspace-hack/Cargo.toml': '[package]\nname = "workspace-hack"\n',
+        '.config/hakari.toml': 'hakari-package = "workspace-hack"\n',
+        'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      },
+      recordingHakari({ code: 1, output: 'workspace-hack is not up-to-date' }),
+    );
+    expect(result.failures).toBe(1);
+    expect(result.messages[0]).toContain('cargo hakari verify');
+    expect(result.messages[0]).toContain('workspace-hack is not up-to-date');
+  });
+});
+
+describe('Cargo feature unification update', () => {
+  it('writes the nightly resolver configuration once', async () => {
+    await withFixture({ ...TWO_CRATE_WORKSPACE, 'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV }, (root) => {
+      const configPath = join(root, '.cargo/config.toml');
+      const hakari = recordingHakari();
+      applyCargoFeatureUnification(root, { shell: hakari });
+      const written = readFileSync(configPath, 'utf8');
+      expect(written).toContain('[unstable]\nfeature-unification = true');
+      expect(written).toContain('[resolver]\nfeature-unification = "workspace"');
+      expect(hakari.calls).toEqual([]);
+
+      applyCargoFeatureUnification(root, { shell: hakari });
+      expect(readFileSync(configPath, 'utf8')).toBe(written);
+      const captured = captureErrors();
+      try {
+        expect(validateCargoCachePolicy(root, { shell: hakari })).toBe(0);
+      } finally {
+        captured.restore();
+      }
+    });
+  });
+
+  it('generates and wires a workspace-hack on a stable toolchain', async () => {
+    await withFixture(
+      { ...TWO_CRATE_WORKSPACE, 'rust-toolchain.toml': '[toolchain]\nchannel = "1.89.0"\n' },
+      (root) => {
+        const hakari = recordingHakari();
+        applyCargoFeatureUnification(root, { shell: hakari });
+        expect(hakari.calls).toEqual([['init', 'workspace-hack'], ['generate'], ['manage-deps', '--yes']]);
+      },
+    );
+  });
+
+  it('skips hakari init when the workspace already declares one', async () => {
+    await withFixture(
+      {
+        ...TWO_CRATE_WORKSPACE,
+        'rust-toolchain.toml': '[toolchain]\nchannel = "1.89.0"\n',
+        '.config/hakari.toml': 'hakari-package = "workspace-hack"\n',
+      },
+      (root) => {
+        const hakari = recordingHakari();
+        applyCargoFeatureUnification(root, { shell: hakari });
+        expect(hakari.calls).toEqual([['generate'], ['manage-deps', '--yes']]);
+      },
+    );
+  });
+});