nix-gitlab-ci/flake.nix

{
  outputs = {
    flake-parts,
    systems,
    ...
  } @ inputs:
    flake-parts.lib.mkFlake {inherit inputs;} {
      imports = [
        inputs.devenv.flakeModule
        inputs.treefmt-nix.flakeModule
        ./lib/flakeModule.nix
      ];
      systems = import systems;
      flake = {};
      perSystem = {
        pkgs,
        config,
        system,
        ...
      }: rec {
        treefmt = {
          projectRootFile = "flake.nix";
          programs = {
            alejandra.enable = true;
            mdformat.enable = true;
            yamlfmt.enable = true;
          };
          settings.formatter.yamlfmt.excludes = ["templates/nix-gitlab-ci.yml"];
        };
        devenv.shells.default = {
          containers = pkgs.lib.mkForce {};
          packages = with pkgs; [dive skopeo];

          pre-commit = {
            hooks = {
              treefmt = {
                enable = true;
                packageOverrides.treefmt = config.treefmt.build.wrapper;
              };
            };
          };
        };
        # should set the "default" pipeline
        ci = {
          stages = ["test"];
          jobs = {
            "test" = {
              stage = "test";
              nix = {
                deps = [pkgs.hello pkgs.curl];
                enable-runner-cache = true;
              };
              variables = {
                TEST = "test";
                TEST_WITH_DERIVATION = "${pkgs.hello}/test";
              };
              script = [
                "hello"
                "curl google.de"
                "echo $TEST $TEST_WITH_DERIVATION"
              ];
            };
            "test-default" = {
              stage = "test";
              nix.deps = [pkgs.hello];
              script = ["hello"];
            };
            "test-non-nix" = {
              nix.enable = false;
              stage = "test";
              image = "alpine:latest";
              script = [
                "echo \"This job will not be modified to use nix\""
              ];
            };
          };
        };
        pipelines."non-default" = {
          stages = ["test"];
          jobs = {
            "test" = {
              stage = "test";
              script = [
                "echo Hello from another pipeline"
              ];
            };
          };
        };

        packages = let
          setupScript = pkgs.writeShellScriptBin "setup_nix_ci" (builtins.readFile ./scripts/setup_nix_ci.sh);
          finalizeScript = pkgs.writeShellScriptBin "finalize_nix_ci" (builtins.readFile ./scripts/finalize_nix_ci.sh);
        in {
          setup-script = setupScript;
          finalize-script = finalizeScript;
          image = pkgs.dockerTools.buildImage {
            name = "nix-ci";
            fromImage = let
              hashes = {
                "x86_64-linux" = "sha256-kJ7dqje5o1KPr3RDZ7/THbhMSoiCU1C/7HshDrNfwnM=";
                "aarch64-linux" = "sha256-jz+Z3Ji+hy5d9ImOh/YOKCqy9P9/cseSov+5J/O95bg=";
              };
              # check digest of tags like nixos-24.11-aarch64-linux etc.
              digests = {
                "x86_64-linux" = "sha256:345f210dea4cbd049e2d01d13159c829066dfb6e273cdd49ea878186d17b19f7";
                "aarch64-linux" = "sha256:66163fdf446d851416dd4e9be28c0794d9c2550214a57a846957699a3f5747f6";
              };
              hash = hashes.${system} or (throw "Unsupported system");
              imageDigest = digests.${system} or (throw "Unsupported system");
            in
              pkgs.dockerTools.pullImage {
                imageName = "nixpkgs/nix-flakes";
                inherit hash imageDigest;
              };
            copyToRoot = pkgs.buildEnv {
              name = "image-root";
              paths = with pkgs;
                [
                  gitMinimal
                  gnugrep
                  gnused
                  coreutils
                  diffutils
                  cachix
                  attic-client
                ]
                ++ [
                  setupScript
                  finalizeScript
                ];
              pathsToLink = ["/bin"];
            };
          };
        };

        checks = packages;
      };
    };

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";

    # flake & devenv related
    flake-parts.url = "github:hercules-ci/flake-parts";
    systems.url = "github:nix-systems/default-linux";
    devenv.url = "github:cachix/devenv";
    treefmt-nix.url = "github:numtide/treefmt-nix";
  };

  nixConfig = {
    extra-substituters = [
      "https://cache.nixos.org/"
      "https://nix-community.cachix.org"
      "https://devenv.cachix.org"
    ];

    extra-trusted-public-keys = [
      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
    ];
  };
}