introduce npv_169 to detect top level withs

[lucasew]

• add problem npv_169
• preparations to detect npv_169

The plan is to detect open withs that have the chance of shadowing variable.

[infinisil]

I'm just taking a look myself, I'll try to create a trampoline for the kind of ratchet you'll need

[infinisil]

As discussed on Matrix, this should really be a ratchet check. I've now made #144 for the basic structure to support file ratchet checks (without introducing any checks), and #145 to show how this PR can take advantage of it :)

[lucasew]

I was playing on how to implement the validation itself and, after a lot of rust struggle, there it is: https://github.com/lucasew/playground/tree/master/projetos/20250108-with-detector-rust

I may start using it more tho.

[lucasew]

I rebased from #144 for the primitives

[lucasew]

here

[infinisil]

Take a closer look at #145, which is pretty much what you need, except that

nixpkgs-vet/src/files.rs

Lines 19 to 34 in 003a4ad

	let file_is_str = match nix_file.syntax_root.expr() {
	// This happens if the file can't be parsed, in which case we can't really decide
	// whether it's a string or not
	None => ratchet::RatchetState::NonApplicable,
	// The expression is a string, not allowed for new files and for existing files to be
	// changed to a string
	Some(Str(_)) => ratchet::RatchetState::Loose(
	npv_170::FileIsAString::new(
	RelativePathBuf::from_path(nix_file.path.strip_prefix(nixpkgs_path).unwrap())
	.unwrap(),
	)
	.into(),
	),
	// This is good
	Some(_) => ratchet::RatchetState::Tight,
	};

will be different (but similar). file_is_str (or a different name in your case) will be a RatchetState, which should be Tight if the code is as desired and it can't be improved further, and Loose if there's an improvement to make.

[lucasew]

The xrefcheck fail is related to a non-related test to this PR, a broken symlink but it seems on purpose to test a scenario

[infinisil]

I'm only reviewing the diff to #144 with this comparison. My feedback:

• You should document the new check here, describing exactly how it behaves. Based on that I also feel like the error message should be changed, because it doesn't seem to be just about top-level with's.
• You should add a test that ensures an existing top-level with doesn't give an error if it still exists after a PR, similar to this test from Introduce bogus ratchet check ensuring that no new Nix string files are introduced #145
• The code should have more code comments explaining what it does

However, I guess most importantly, I don't think there's yet any consensus among Nixpkgs committers as to whether such a check is wanted or how exactly it should behave. Of course with the code here already written, it's easy to change the behavior, so I'd engage in NixOS/nixpkgs#371862, emphasising that you can easily change the code as desired, and maybe even make a Discourse post to get more input.

Sorry for the delayed reviews, am quite busy, but already thanks a lot for moving forward with improving CI, this is very valuable work!

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/best-practices-with-with/58857/6