3b1de422c6
Eight classifications in .hyperhive/review-classifier.yml: no AI advertising in commit messages, no committed secrets, no clippy allow attributes, no debug leftovers, no dead code, tests with behaviour changes, docs with operator-facing changes, one purpose per PR. A swarm-controller test parses the real file so it can't rot, and the rust source fileset in nix/rust.nix includes it so the test finds it in the build sandbox.
101 lines
4.6 KiB
Nix
101 lines
4.6 KiB
Nix
# Shared crane wiring for the rust workspace: the cargo source
|
|
# filter, the once-built dependency artifacts, and the native build
|
|
# inputs every rust derivation (packages + checks) consumes.
|
|
# Imported per system from flake.nix.
|
|
{ pkgs, craneLib }:
|
|
let
|
|
inherit (pkgs) lib;
|
|
in
|
|
rec {
|
|
# Shared between buildDepsOnly + buildPackage + cargoClippy/cargoTest
|
|
# so every derivation in the chain sees the same toolchain shape.
|
|
# git: hive-c0re's `lifecycle::tests::setup_proposed_*` shell out to
|
|
# `git init` + commit under `cargo test` in the sandbox.
|
|
# sqlite: matrix-sdk's `sqlite` feature (`hive-matrix-mcp` workspace
|
|
# member) — the matrix-sdk-sqlite + rusqlite stack links against
|
|
# system libsqlite3 by default.
|
|
# cmake: builds `aws-lc-sys` (BoringSSL) from source — pulled in by
|
|
# the `rustls` (aws-lc-rs) crypto provider under the OTLP/reqwest
|
|
# stack in `hive-metric`.
|
|
nativeBuildInputs = [
|
|
pkgs.git
|
|
pkgs.sqlite
|
|
pkgs.pkg-config
|
|
pkgs.cmake
|
|
];
|
|
|
|
# Narrowed source tree the rust derivations consume: everything
|
|
# cargo cares about (Cargo.toml/Cargo.lock + *.rs/*.toml), selected
|
|
# via `lib.fileset` rather than crane's `cleanCargoSource` filter —
|
|
# filesets drop directories that contain no selected files, so
|
|
# adding or renaming a non-rust directory (nix modules, docs, …)
|
|
# does NOT bust this src hash (an empty dir under a plain source
|
|
# filter would). All non-rust runtime assets — branding + the claude
|
|
# prompt template + claude-settings.json — live in the separate
|
|
# `hyperhive-assets` derivation and are loaded by the binaries at
|
|
# runtime from `$HIVE_ASSETS_DIR`. Net effect: only `*.rs` /
|
|
# `*.toml` / `Cargo.lock` edits rebuild the rust derivations.
|
|
#
|
|
# The one other file in it is the repo's own review-classifier rules: a
|
|
# `swarm-controller` test parses them, so they must be in the sandbox.
|
|
cleanSrc = lib.fileset.toSource {
|
|
root = ../.;
|
|
fileset = lib.fileset.unions [
|
|
(craneLib.fileset.commonCargoSources ../.)
|
|
../.hyperhive/review-classifier.yml
|
|
];
|
|
};
|
|
|
|
# The workspace's dependency tree, built once and cached as its own
|
|
# derivation so a workspace-only edit doesn't rebuild deps. Every
|
|
# consumer passes the same `cleanSrc`, keeping the input hash
|
|
# consistent across the chain.
|
|
#
|
|
# Two dep caches, one per audience, and the split is not premature:
|
|
# crane's `buildDepsOnly` defaults `doCheck = true`, which adds
|
|
# `--all-targets` to the check and a `cargo test --no-run`, so the cache
|
|
# compiles every dev-dependency and test harness in the tree. The CHECKS
|
|
# need exactly that. A DEPLOY never runs a test binary and never links
|
|
# one, so on the deploy path that work is compiled and thrown away.
|
|
#
|
|
# They are separate rather than shared because they were never actually
|
|
# shared: CI evaluates against hyperhive's own nixpkgs pin, while a host
|
|
# overrides it (security patches cannot wait on a lock bump upstream),
|
|
# so the two closures differ and neither substitutes for the other. One
|
|
# cache per audience therefore costs nobody a second build — it just
|
|
# stops the deploy paying for artifacts only CI consumes.
|
|
#
|
|
# ⚠️ `buildDepsOnly` builds from `mkDummySrc`, so both hashes key on
|
|
# Cargo.toml/Cargo.lock rather than on `.rs` files: a code edit rebuilds
|
|
# neither, a dependency or toolchain change rebuilds both.
|
|
cargoArtifacts = craneLib.buildDepsOnly {
|
|
src = cleanSrc;
|
|
# Workspace Cargo.toml is virtual (no `[package].name`), so crane
|
|
# can't auto-derive a name. Spell it out explicitly — keeps the
|
|
# derivation name stable across crane bumps + silences the
|
|
# placeholder warning. Same `pname` for the dep + check
|
|
# derivations so they share a clean naming family.
|
|
pname = "hyperhive-workspace";
|
|
version = "0.1.0";
|
|
inherit nativeBuildInputs;
|
|
};
|
|
|
|
# The deploy path's cache: same deps, no test targets. `doCheck = false`
|
|
# drops crane's `--all-targets` and its `cargo test --no-run`, so
|
|
# dev-dependencies and test harnesses are never compiled here.
|
|
#
|
|
# Only `packages` consume this. Anything that needs to *run* a test —
|
|
# `checks.cargo-test` — or lint one — `checks.clippy --all-targets` —
|
|
# takes `cargoArtifacts` above instead, and would rebuild what it needs
|
|
# if it were pointed here by mistake.
|
|
cargoArtifactsBinOnly = craneLib.buildDepsOnly {
|
|
src = cleanSrc;
|
|
# Distinct pname so the two are told apart in build logs and store
|
|
# paths; a shared name would make the useful question ("which cache
|
|
# is this rebuild?") unanswerable at a glance.
|
|
pname = "hyperhive-workspace-bin";
|
|
version = "0.1.0";
|
|
doCheck = false;
|
|
inherit nativeBuildInputs;
|
|
};
|
|
}
|