Fix deps hash determinism by deleting Maven timestamp files

Maven writes ephemeral files (*.lastUpdated, resolver-status.properties,
_remote.repositories) that contain timestamps, causing hash instability
between builds. Delete these files to make the fixed-output derivation
deterministic, matching the approach used by nixpkgs buildMavenPackage.

Linux hashes set to lib.fakeHash - CI will report correct values.

Author: jcf

.forgejo/workflows/ci.yml

@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  CI: true
+
 jobs:
   lint:
     name: Lint
@@ -58,7 +61,7 @@ jobs:
       - name: Run tests
         env:
           DATABASE_URL: postgres://bits:please@127.0.0.1:5432/bits_test
-        run: devenv test --quiet
+        run: devenv test
 
   build:
     name: Build ${{ matrix.arch }}
@@ -86,7 +89,7 @@ jobs:
         id: build
         run: |
           echo "Building ${{ matrix.output }}..."
-          image_path=$(devenv build --quiet outputs.${{ matrix.output }})
+          image_path=$(devenv build outputs.${{ matrix.output }})
           echo "image_path=$image_path" >> "$GITHUB_OUTPUT"
           echo "Built: $image_path"
 

pkgs/bits-uberjar/default.nix

@@ -28,12 +28,12 @@
 
   # Fixed-output derivation hash for deps, per platform.
   # To update: set your platform's hash to lib.fakeHash, build, copy from error.
-  # Darwin hash is updated locally; Linux hashes from CI output.
+  # Darwin hash updated locally; Linux hashes from CI output.
   depsHash =
     {
-      "aarch64-darwin" = "sha256-eA8CEscn7qsgAtSwJ4ba5SfCN+yDnE+uFo+ucp7oZbo=";
-      "aarch64-linux" = "sha256-XstFJyp7SZe+t4ctVAXI2VssF0O7LjPp6PPzW2gE1n8=";
-      "x86_64-linux" = "sha256-azy37je1iTqryhhe/kluPpltVADTtF+BOFBNmEi73u4=";
+      "aarch64-darwin" = "sha256-egkUQylaFsOWb1LO8FH143/1P6htR6Qvy/Xj4csO/cg=";
+      "aarch64-linux" = lib.fakeHash;
+      "x86_64-linux" = lib.fakeHash;
     }.${
       stdenv.hostPlatform.system
     };
@@ -105,6 +105,13 @@
 
       if [ -d "$HOME/.m2/repository" ]; then
         cp -r $HOME/.m2/repository $out/m2
+
+        # Delete ephemeral Maven files with timestamps (makes hash deterministic)
+        find $out/m2 -type f \( \
+          -name \*.lastUpdated \
+          -o -name resolver-status.properties \
+          -o -name _remote.repositories \) \
+          -delete
       fi
 
       if [ -d "$HOME/.gitlibs" ]; then