mirror of
https://github.com/getpaseo/paseo.git
synced 2026-07-29 12:01:31 +00:00
bb560809c7
* fix: add missing resolved/integrity fields to package-lock.json npm omits resolved URLs and integrity hashes for workspace-local node_modules overrides. This breaks offline installers like Nix's npm ci. Add the missing fields for 25 workspace-hoisted packages. * feat: add Nix flake with package and NixOS module Add a Nix flake that builds the Paseo daemon (server + CLI) and provides a NixOS module for declarative deployment. Package (nix/package.nix): - Builds relay, server, and CLI workspaces - Skips onnxruntime-node install script (sandbox-incompatible) - Rebuilds only node-pty for native terminal support - Source filter excludes app/website/desktop workspaces NixOS module (nix/module.nix): - Systemd service with configurable user, port, listen address - allowedHosts for DNS rebinding protection - relay.enable to toggle remote access via app.paseo.sh - inheritUserEnvironment to expose user tools (git, ssh) to agents - openFirewall and extra environment variables ci: add Nix hash maintenance scripts and workflows scripts/fix-lockfile.mjs: Adds missing resolved/integrity fields to package-lock.json for workspace-local overrides. Idempotent, uses `npm view`. scripts/update-nix.sh: Runs fix-lockfile.mjs, prefetches deps, computes NAR hash, and updates npmDepsHash in nix/package.nix. Supports --check for CI. .github/workflows/nix-build.yml: Builds the Nix package on push/PR and verifies the lockfile and hash are up to date. .github/workflows/fix-nix-hash.yml: Auto-fixes lockfile signatures and Nix hash on dependabot PRs. fix: update npmDepsHash after upstream sync nix: allowlist workspace symlinks instead of blocklist Prevents build failures when upstream adds new workspace packages. * don't block PRs on nix failures * better document npm workaround * fix hash update script, and update hash * integrate with npm run build:daemon * ci: trigger nix build on highlight changes * fix(nix): update npmDepsHash --------- Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
60 lines
1.6 KiB
YAML
60 lines
1.6 KiB
YAML
name: Nix Build
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'nix/**'
|
|
- 'flake.nix'
|
|
- 'flake.lock'
|
|
- 'package.json'
|
|
- 'package-lock.json'
|
|
- 'packages/highlight/**'
|
|
- 'packages/server/**'
|
|
- 'packages/relay/**'
|
|
- 'packages/cli/**'
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- 'nix/**'
|
|
- 'flake.nix'
|
|
- 'flake.lock'
|
|
- 'package.json'
|
|
- 'package-lock.json'
|
|
- 'packages/highlight/**'
|
|
- 'packages/server/**'
|
|
- 'packages/relay/**'
|
|
- 'packages/cli/**'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: cachix/install-nix-action@v31
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
|
|
- name: Build Nix package
|
|
run: nix build .#default -o result
|
|
|
|
- name: Verify lockfile is complete
|
|
# npm silently omits resolved/integrity fields in workspace monorepos.
|
|
# Nix needs them for offline builds. See https://github.com/npm/cli/issues/4460
|
|
run: |
|
|
node scripts/fix-lockfile.mjs package-lock.json
|
|
git diff --exit-code package-lock.json || {
|
|
echo "ERROR: package-lock.json has missing resolved/integrity fields."
|
|
echo "This is a known npm bug: https://github.com/npm/cli/issues/4460"
|
|
echo "Run 'node scripts/fix-lockfile.mjs' and commit the result."
|
|
exit 1
|
|
}
|
|
|
|
- name: Check npmDepsHash is up to date
|
|
run: ./scripts/update-nix.sh --check
|