vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

nix: single-source frontend npmDepsHash into frontend/npm-deps-hash

Browse source 
The hash was hardcoded independently in nix/packages/frontend.nix,
nix/packages/swarm-ui.nix, and nix/checks.nix's inline
swarm-ui-typecheck derivation, all three building from the one
frontend/package-lock.json. Nothing enforced the three copies staying
in sync, and on a recent PR only some of them got updated when the
lockfile changed.

Moved the hash into a new file, frontend/npm-deps-hash (plain text, no
trailing newline, co-located with package-lock.json so it reads as
the lockfile's other half), and all three derivations now
builtins.readFile it instead of hardcoding their own copy. A lockfile
change now only needs prefetch-npm-deps + one file overwrite; the
other two derivations pick it up automatically.

Verified: nix eval against all three derivations' npmDepsHash
attribute (eval-only, not a build) confirms all three resolve to the
same value read from the one file.
This commit is contained in:
iris 2026-08-16 15:18:53 +02:00 • committed by mara
commit 2a67cc0e69
4 changed files with 25 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/packages/frontend.nix
View file

@ -35,12 +35,15 @@ buildNpmPackage {
version = "0.0.0";
src = ../../frontend;
# Computed from `frontend/package-lock.json` via
# prefetch-npm-deps frontend/package-lock.json
# Update whenever the lockfile changes. Recompute locally with the
# same command (`pkgs.prefetch-npm-deps`), or let the build fail
# and copy the actual hash from the error message.
npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
# Read from `../../frontend/npm-deps-hash`, the single source of
# truth `./swarm-ui.nix` and `../checks.nix`'s `swarm-ui-typecheck`
# also read — all three build from the one `frontend/package-lock.json`,
# so one file keeps them from drifting independently (this used to be
# a hardcoded copy per derivation, and only some of the three got
# updated the one time the lockfile changed). Regenerate with
# `prefetch-npm-deps frontend/package-lock.json` and overwrite the
# file whenever the lockfile changes.
npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
# `npm run build` recurses into all workspaces (`--workspaces
# --if-present`). The workspaces' build scripts each run their own