nix: single-source frontend npmDepsHash into frontend/npm-deps-hash

The hash was hardcoded independently in nix/packages/frontend.nix,
nix/packages/swarm-ui.nix, and nix/checks.nix's inline
swarm-ui-typecheck derivation, all three building from the one
frontend/package-lock.json. Nothing enforced the three copies staying
in sync, and on a recent PR only some of them got updated when the
lockfile changed.

Moved the hash into a new file, frontend/npm-deps-hash (plain text, no
trailing newline, co-located with package-lock.json so it reads as
the lockfile's other half), and all three derivations now
builtins.readFile it instead of hardcoding their own copy. A lockfile
change now only needs prefetch-npm-deps + one file overwrite; the
other two derivations pick it up automatically.

Verified: nix eval against all three derivations' npmDepsHash
attribute (eval-only, not a build) confirms all three resolve to the
same value read from the one file.
This commit is contained in:
iris 2026-08-16 15:18:53 +02:00 committed by mara
commit 2a67cc0e69
4 changed files with 25 additions and 18 deletions

View file

@ -149,10 +149,12 @@ in
version = "0.0.0";
src = ../frontend;
# Same lockfile as `frontend`/`swarm-ui` above — recompute in
# lockstep with those two whenever `frontend/package-lock.json`
# changes (`prefetch-npm-deps frontend/package-lock.json`).
npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
# Same lockfile as `frontend`/`swarm-ui` above — reads the same
# `frontend/npm-deps-hash` file both of those do, so this stays in
# lockstep automatically. Regenerate that file with
# `prefetch-npm-deps frontend/package-lock.json` when the lockfile
# changes.
npmDepsHash = builtins.readFile ../frontend/npm-deps-hash;
buildPhase = ''
runHook preBuild