feat: add Nix flake and package by Rooffeell · Pull Request #381 · pgplex/pgschema

Rooffeell · 2026-03-27T18:42:37Z

Closes #333

Summary:

add flake.nix + default.nix for Nix packaging
add nix/pgschema.nix buildGoModule derivation
document Nix usage in README

greptile-apps · 2026-03-27T18:45:58Z

Greptile Summary

This PR adds Nix packaging support (flake.nix, default.nix, nix/pgschema.nix) and a brief README section, enabling users to build and run pgschema via nix build / nix run. The overall structure is sound — the flake covers all four major platforms, version is read directly from internal/version/VERSION, and the non-flake default.nix fallback is correct.

Key findings:

vendorHash is likely a placeholder (nix/pgschema.nix:18). The inline comment "Replace with the real hash from nix build output" strongly implies the hash was never actually computed against the live dependency set. Because proxyVendor = true requires an exact hash match, nix build will fail immediately for every user until the correct hash is provided. This should be resolved before merging.
Go toolchain mismatch: go.mod pins toolchain go1.24.7, but the derivation forces pkgs.go_1_25. Go is backward-compatible so this likely works, but a fallback expression (pkgs.go_1_24 or pkgs.go_1_25) would better respect the upstream toolchain preference.
Missing version ldflags: The canonical build (per CLAUDE.md) injects GitCommit and BuildDate. The Nix derivation omits these, so pgschema version will show empty metadata for Nix-built binaries.
nixos-unstable input: Pinned in flake.lock today, but future nix flake update calls will roll to the latest unstable commit; a stable channel would be less surprising for maintainers.
README nix run example lacks the -- separator needed to pass arguments to pgschema (e.g. nix run . -- plan).

Confidence Score: 4/5

Not safe to merge as-is — nix build will fail for all users until the vendorHash is properly computed.

One P1 issue blocks the primary use-case: the vendorHash in nix/pgschema.nix appears to be an unverified placeholder, meaning nix build will hard-fail immediately. All other findings are P2 style/improvement suggestions that don't affect correctness. Resolving the vendorHash issue would raise this to 5/5.

nix/pgschema.nix — the vendorHash must be computed and verified before the package is usable.

Important Files Changed

Filename	Overview
nix/pgschema.nix	Core buildGoModule derivation; likely has a placeholder vendorHash that will break nix build, and pins Go 1.25 while go.mod targets 1.24.
flake.nix	Well-structured flake supporting four platforms; uses nixos-unstable which is pinned in the lock but could drift on nix flake update.
default.nix	Minimal non-flake entry point delegating to nix/pgschema.nix; correct pattern.
flake.lock	Auto-generated lock file pinning nixos-unstable to a specific commit; provides reproducibility.
README.md	Adds a Nix installation section; the nix run example lacks the -- separator needed to pass arguments to pgschema.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A([User runs nix build / nix run]) --> B{Flake or legacy?}
    B -- flake --> C[flake.nix\nresolves nixpkgs from flake.lock]
    B -- legacy --> D[default.nix\nimports nixpkgs from channel]
    C --> E[callPackage ./nix/pgschema.nix]
    D --> E
    E --> F[Read internal/version/VERSION\nfor version string]
    E --> G[lib.cleanSource ..\nfilters repo source]
    F --> H[buildGoModule]
    G --> H
    H --> I{proxyVendor = true\nFetch Go modules via proxy}
    I --> J{Verify vendorHash}
    J -- hash matches --> K[go build -ldflags '-s -w'\noutput: bin/pgschema]
    J -- hash mismatch --> L([Build fails ❌\nnix prints correct hash])
    K --> M([result/bin/pgschema ✅])

_{Reviews (1): Last reviewed commit: "feat: add nix flake/package" | Re-trigger Greptile}

greptile-apps · 2026-03-27T18:46:01Z

nix/pgschema.nix

+  # Replace with the real hash from `nix build` output.
+  vendorHash = "sha256-3nV7AEsWyEvIbxHetoEsA8PPXJ6ENvU/sz7Wn5aysss=";


Unverified placeholder vendorHash will break the build

The inline comment — "Replace with the real hash from nix build output" — strongly indicates this hash was never actually computed from the live dependency set. With proxyVendor = true, Nix fetches all Go modules from the proxy and checks them against vendorHash; a wrong hash causes an immediate, hard build failure:

error: hash mismatch in fixed-output derivation wanted: sha256-3nV7AEsWyEvIbxHetoEsA8PPXJ6ENvU/sz7Wn5aysss= got: sha256-<actual>

The standard Nix workflow is to set vendorHash = lib.fakeHash; (or ""), run nix build, then replace it with the hash printed in the error. That step appears not to have been done here, so nix build will fail out of the box for every user.

greptile-apps · 2026-03-27T18:46:02Z

nix/pgschema.nix

+  # go_1_24 is not available in some nixpkgs revisions; use the closest newer toolchain.
+  go = pkgs.go_1_25;


Go toolchain version overrides go.mod toolchain directive

go.mod declares go 1.24.0 (minimum) and toolchain go1.24.7 (preferred). Pinning go = pkgs.go_1_25 overrides that toolchain directive entirely. Go 1.25 is backward-compatible, so this won't break compilation in practice, but it silently ignores the upstream-pinned toolchain.

A more future-proof option is to omit the go attribute entirely and let buildGoModule use nixpkgs' default Go toolchain, or check for pkgs.go_1_24 first:

go = pkgs.go_1_24 or pkgs.go_1_25;

This way the derivation respects the author-specified toolchain when available and only falls back when it isn't.

greptile-apps · 2026-03-27T18:46:03Z

nix/pgschema.nix

+  ldflags = [
+    "-s"
+    "-w"
+  ];


Missing version-injection ldflags

According to CLAUDE.md, the canonical build injects GitCommit and BuildDate into the binary:

-X github.com/pgplex/pgschema/cmd.GitCommit=... -X 'github.com/pgplex/pgschema/cmd.BuildDate=...'

The Nix derivation only passes -s -w. As a result, pgschema version (or any version display) will show empty values for commit and build date. Nix exposes the revision via self.rev (or self.shortRev) in the flake, which can be threaded through to the derivation, e.g.:

# In flake.nix, pass rev to the package: pgschema = pkgs.callPackage ./nix/pgschema.nix { rev = self.shortRev or "dirty"; }; # In nix/pgschema.nix, receive and use it: { pkgs ? import <nixpkgs> {}, rev ? "unknown" }: ... ldflags = [ "-s" "-w" "-X github.com/pgplex/pgschema/cmd.GitCommit=${rev}" ];

greptile-apps · 2026-03-27T18:46:05Z

flake.nix

+  description = "pgschema";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";


Tracking nixos-unstable may cause silent regressions on nix flake update

The lock file pins the flake to a specific nixos-unstable commit today, so the build is reproducible now. However, every nix flake update will roll to the latest nixos-unstable, which can change the Go toolchain, library versions, or even remove go_1_25, causing unexpected build breaks for downstream users.

Consider targeting a stable channel (nixos-24.11 or nixos-25.05) in the inputs URL to make future updates more predictable:

Suggested change

nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";

greptile-apps · 2026-03-27T18:46:05Z

README.md

+### Nix (flake)
+


nix run without argument separator won't forward CLI flags

nix run by itself runs the binary with no arguments. To pass arguments to pgschema (e.g. pgschema plan), users need to separate nix flags from program flags with --. The example could be more helpful:

Suggested change

### Nix (flake)

nix run . -- plan

or at minimum a note like:

Use nix run . -- <pgschema args> to pass arguments to the binary (e.g. nix run . -- plan).

Copilot

Pull request overview

Adds first-class Nix packaging support for pgschema (Issue #333), enabling users to build/run the CLI via Nix flakes or legacy default.nix.

Changes:

Introduces a buildGoModule derivation for pgschema under nix/.
Adds flake.nix / flake.lock to expose Nix packages and apps for common systems.
Documents basic nix build / nix run usage in the README.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
nix/pgschema.nix	Adds Nix derivation for building the Go CLI with ldflags metadata.
flake.nix	Adds flake outputs for packages/apps across Linux/Darwin systems.
flake.lock	Pins nixpkgs input revision used by the flake.
default.nix	Enables non-flake Nix builds via `callPackage`.
README.md	Documents Nix flake usage.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-30T02:18:35Z

nix/pgschema.nix

+  # Prefer Go 1.24 when available; fall back to the closest newer toolchain.
+  go = if pkgs ? go_1_24 then pkgs.go_1_24 else pkgs.go_1_25;
+  subPackages = [ "." ];


The Go toolchain fallback isn’t safe: if pkgs doesn’t provide go_1_24, this expression unconditionally references pkgs.go_1_25, which may not exist in many nixpkgs revisions (especially when using default.nix with an arbitrary <nixpkgs>), causing an evaluation failure. Consider falling back to pkgs.go (or checking pkgs ? go_1_25 as well), and ensure the selected Go version is compatible with go.mod’s go 1.24/toolchain go1.24.7 settings (often also requiring GOTOOLCHAIN=local to prevent network toolchain downloads in sandboxed builds).

Copilot · 2026-03-30T02:18:35Z

nix/pgschema.nix

+
+  env = {
+    CGO_ENABLED = "0";
+  };


buildGoModule runs go test ./... by default, and this repo has many integration tests that start embedded Postgres unless testing.Short() is enabled. In Nix sandbox builds this can be very slow and may fail (e.g., due to embedded-postgres downloading binaries). Consider setting checkFlags = [ "-short" ] (preferred to still run unit tests) or doCheck = false to make nix build reliable.

Suggested change

};

};

# Run Go tests in short mode to avoid slow or flaky integration tests

# (e.g., those that start embedded Postgres) during Nix builds.

checkFlags = [ "-short" ];

feat: add nix flake/package

b181810

greptile-apps bot reviewed Mar 27, 2026

View reviewed changes

fix: update nix package inputs and add rev/buildDate parameters

36d28b1

tianzhou requested a review from Copilot March 30, 2026 02:15

Copilot started reviewing on behalf of tianzhou March 30, 2026 02:16 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add Nix flake and package#381

feat: add Nix flake and package#381
Rooffeell wants to merge 2 commits intopgplex:mainfrom
Rooffeell:codex/nix-package

Rooffeell commented Mar 27, 2026

Uh oh!

greptile-apps bot commented Mar 27, 2026

Uh oh!

greptile-apps bot Mar 27, 2026

Uh oh!

greptile-apps bot Mar 27, 2026

Uh oh!

greptile-apps bot Mar 27, 2026

Uh oh!

greptile-apps bot Mar 27, 2026

Uh oh!

greptile-apps bot Mar 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 30, 2026

Uh oh!

Copilot AI Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		# Replace with the real hash from `nix build` output.
		vendorHash = "sha256-3nV7AEsWyEvIbxHetoEsA8PPXJ6ENvU/sz7Wn5aysss=";

		# go_1_24 is not available in some nixpkgs revisions; use the closest newer toolchain.
		go = pkgs.go_1_25;

	nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
	nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";

-  };
+  };
+  # Run Go tests in short mode to avoid slow or flaky integration tests
+  # (e.g., those that start embedded Postgres) during Nix builds.
+  checkFlags = [ "-short" ];

Conversation

Rooffeell commented Mar 27, 2026

Uh oh!

greptile-apps bot commented Mar 27, 2026

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants