Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add package list metadata to Terraform build output via nvd #460

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: Add package list metadata to Terraform build output via nvd #460

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion terraform/nix-build/nix-build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,20 @@ else
# inject `special_args` into nixos config's `specialArgs`
# shellcheck disable=SC2086
out=$(nix build --no-link --json ${options} --expr "${nix_expr}" "${config_attribute}")
output_path=$(echo "$out" | jq -r '.[].outputs.out')
packages_json=$(nvd list --selected --root "$output_path" | awk '
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe add some conditional if nvd is not present?

if command -v nvd; then
fi

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently we don't enable pipefail but I think we should

BEGIN { first=1; printf "[" }
{
if (match($0, /^\[I\*\]\s+#([0-9]+)\s+([^ ]+)\s+(.*)$/, arr)) {
if (!first) { printf "," }
first=0
printf "{\"name\": \"%s\", \"versions\": \"%s\"}", arr[2], arr[3]
}
}
END { print "]" }
')
fi
printf '%s' "$out" | jq -c '.[].outputs'
jq -n \
--arg out "$output_path" \
--arg packages "$packages_json" \
'{ "out": $out, "packages": $packages }'
1 change: 1 addition & 0 deletions terraform/nixos-rebuild/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
resource "null_resource" "nixos-rebuild" {
triggers = {
store_path = var.nixos_system
packages_list = var.nixos_system_packages
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not quite getting, why we need this trigger? Is the store_path not enough?

Copy link
Author

@oneingan oneingan Feb 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I'm not mistaken, you need it for package_list diff to be displayed during the plan, though I could be wrong.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see. Actually the terraform option description is a bit misleading in this case, which was also the initial source of my confusion. Could you change that and also add to nixos-rebuild.md how to wire things up i.e. use nix-build output and feed it into the nixos-rebuild module?

}
provisioner "local-exec" {
environment = {
Expand Down
6 changes: 6 additions & 0 deletions terraform/nixos-rebuild/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,12 @@ variable "nixos_system" {
description = "The nixos system to deploy"
}

variable "nixos_system_packages" {
Mic92 marked this conversation as resolved.
Show resolved Hide resolved
type = string
description = "The array of nixos system packages to deploy"
default = ""
}

variable "target_host" {
type = string
description = "DNS host to deploy to"
Expand Down