release: use the nix flake to pin versions

Author: tembleking

.envrc

@@ -0,0 +1,7 @@
+strict_env
+
+has nix && use flake
+dotenv_if_exists .env # You can create a .env file with your env vars for this project. You can also use .secrets if you are using act. See the line below.
+dotenv_if_exists .secrets # Used by [act](https://nektosact.com/) to load secrets into the pipelines
+
+env_vars_required SYSDIG_SECURE_ENDPOINT SYSDIG_SECURE_TOKEN

.github/workflows/release.yaml

@@ -14,21 +14,9 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Set git identity
-        run: |-
-          git config user.name "github-actions"
-          git config user.email "github-actions@github.com"
-      - name: Check whether it's the latest commit
-        run:  if [[ $(git ls-remote origin -h ${{ github.ref }} | cut -f1) != ${{ github.sha }} ]]; then exit 1; fi
-      - name: Setup Node
-        uses: actions/setup-node@v4.0.2
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}        
-        with:  
-          node-version: 20
-          registry-url: https://registry.npmjs.org
-      - name: Install build dependencies
-        run: npm install -g yarn
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: DeterminateSystems/flake-checker-action@main
       - name: Install dependencies
         run: |
           yarn global add @backstage/cli
@@ -38,8 +26,6 @@ jobs:
         run: |
           yarn tsc --jsx react-jsx
           yarn build
-      - name: Push new changelog to git
-        run: git push --follow-tags
       - name: Release to GitHub releases
         run: errout=$(mktemp); gh release create $(cat  package.json | jq -r .version) -R $GITHUB_REPOSITORY -t $(cat  package.json | jq -r .version) --target $GITHUB_REF 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
         env:

.gitignore

@@ -131,4 +131,7 @@ dist
 yarn.lock
 
 # tsc
-dist-types/
+dist-types/
+
+.direnv
+.secrets

flake.lock

@@ -0,0 +1,46 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+    }:
+    let
+      overlays.default = final: prev: { };
+      flake = flake-utils.lib.eachDefaultSystem (
+        system:
+        let
+          pkgs = import nixpkgs {
+            inherit system;
+            config.allowUnfree = true;
+            overlays = [ self.overlays.default ];
+          };
+        in
+        {
+          devShells.default =
+            with pkgs;
+            mkShell {
+              packages =
+                [
+                  nodejs
+                  typescript
+                  yarn-berry
+                  (python3.withPackages (p: with p; [ gyp ]))
+                ]
+                ++ (with nodePackages; [
+                  typescript-language-server
+                  node-gyp
+                ]);
+            };
+
+          formatter = pkgs.nixfmt-rfc-style;
+        }
+      );
+    in
+    flake // { inherit overlays; };
+}