Add CI and pre-commit hooks for nix files

.envrc

@@ -0,0 +1 @@
+use_flake

.github/workflows/flake-check.yml

@@ -0,0 +1,16 @@
+name: "Lint"
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: cachix/install-nix-action@v25
+      with:
+        nix_path: nixpkgs=channel:nixpkgs-unstable
+    - run: |
+        nix flake check -L

.gitignore

@@ -11,3 +11,6 @@ result
 
 # Colmena --keep-result roots directory
 .gcroots
+
+# pre-commit
+.pre-commit-config.yaml

build/datadog/hydra.nix

@@ -1,4 +1,4 @@
-{config, pkgs, ...}:
+{ pkgs, ...}:
 {
   systemd.services.dd-agent.environment.PYTHONPATH = "${pkgs.pythonPackages.requests}/lib/python2.7/site-packages";
   environment.etc =

build/diffoscope.nix

@@ -1,6 +1,4 @@
-{ config, pkgs, ... }:
-
-with pkgs.lib;
+{ pkgs, ... }:
 
 let
 

build/flake.nix

@@ -26,10 +26,8 @@
   inputs.rfc39.url = "github:NixOS/rfc39";
   inputs.rfc39.inputs.nixpkgs.follows = "nixpkgs";
 
-  outputs = flakes @ { self, agenix, colmena, disko, hydra, hydra-scale-equinix-metal, nix, nixpkgs, nixos-channel-scripts, nix-netboot-serve, rfc39 }:
+  outputs = { self, agenix, colmena, disko, hydra, hydra-scale-equinix-metal, nix, nixpkgs, nixos-channel-scripts, nix-netboot-serve, rfc39 }:
     let
-      inherit (nixpkgs) lib;
-
       flakesModule = {
         imports = [
           agenix.nixosModules.age
@@ -87,13 +85,13 @@
           deployment = {
             targetHost = "${name}.nixos.org";
           };
-        }) (self.nixosConfigurations);
+        }) self.nixosConfigurations;
 
       # TODO: flake-utils.lib.eachDefaultSystem
       devShell.x86_64-linux = let
         pkgs = import nixpkgs { system = "x86_64-linux"; };
       in pkgs.mkShell {
-        buildInputs = with pkgs; [
+        buildInputs = [
           agenix.packages.x86_64-linux.agenix
           colmena.packages.x86_64-linux.colmena
         ];

build/hydra-proxy.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ...}:
+{ config, ...}:
 
 {
   services.nginx = {

build/hydra-scaler.nix

@@ -1,5 +1,3 @@
-{ config, pkgs, lib, ... }:
-
 {
   services.hydra-scale-equinix-metal = {
     enable = true;
@@ -8,7 +6,7 @@
     secretFile = "/root/keys/hydra-scale-equinix-metal-env";
     interval = ["*:0/5"];
     config = let
-      netboot_base = https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main;
+      netboot_base = "https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main";
     in {
       metro = "any";
       tags = ["hydra"];
@@ -24,7 +22,7 @@
         # The netboot URL for arm64 big-parallel is: https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main/c3-large-arm--big-parallel ("Always PXE" enabled, "hydra" tag)
         # The netboot URL for arm64 small is: https://netboot.nixos.org/dispatch/hydra/hydra.nixos.org/equinix-metal-builders/main/c3-large-arm ("Always PXE" enabled, "hydra" tag)
 
-        x86_64-linux = rec {
+        x86_64-linux = {
           bigparallel = {
             divisor = 16;
             minimum = 1;

build/hydra.nix

@@ -62,7 +62,7 @@ in
     '';
 
   # Work around https://github.com/NixOS/hydra/issues/1337
-  services.hydra-dev.package = pkgs.hydra.overrideAttrs(final: prev: {
+  services.hydra-dev.package = pkgs.hydra.overrideAttrs(_: prev: {
     postPatch = ''
       ${prev.postPatch or ""}
       rm src/lib/Hydra/Plugin/DeclarativeJobsets.pm

build/packet-importer.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 let
   importer = pkgs.callPackage ../hydra-packet-importer { };
 in

build/pluto/prometheus/default.nix

@@ -1,7 +1,3 @@
-{ config
-, ...
-}:
-
 {
   imports = [
     ./alertmanager.nix

build/rhea/configuration.nix

@@ -1,4 +1,4 @@
-{ nodes, config, lib, pkgs, ... }:
+{ pkgs, ... }:
 {
   imports =
     [ ./hardware-configuration.nix
@@ -44,9 +44,6 @@
 
   nix.extraOptions = "gc-keep-outputs = false";
 
-  #services.postfix.enable = true;
-  #services.postfix.hostname = "hydra.nixos.org";
-
   # Don't rate-limit the journal.
   services.journald.rateLimitBurst = 0;
 

build/rhea/hardware-configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{ config, lib, modulesPath, ... }:
 
 {
   imports =

channels.nix

@@ -88,5 +88,5 @@ rec {
     };
   };
 
-  channels-with-urls = (builtins.mapAttrs (name: about: about.job) channels);
+  channels-with-urls = builtins.mapAttrs (_: about: about.job) channels;
 }

flake.nix

@@ -0,0 +1,33 @@
+{
+  description = "NixOS Infra";
+
+  inputs = {
+    nixpkgs.url = "github:NIxOS/nixpkgs";
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        nixpkgs-stable.follows = "nixpkgs";
+      };
+    };
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, git-hooks, flake-utils }:
+    flake-utils.lib.eachSystem [ "aarch64-linux" "x86_64-linux" ] (system: {
+      checks = {
+        pre-commit = git-hooks.lib.${system}.run {
+          src = ./.;
+          hooks = {
+            deadnix.enable = true;
+            statix.enable = true;
+          };
+        };
+      };
+      devShells.default = nixpkgs.legacyPackages.${system}.mkShell {
+        buildInputs = self.checks.${system}.pre-commit.enabledPackages;
+        inherit (self.checks.${system}.pre-commit) shellHook;
+      };
+    }
+  );
+}

lib/service-order.nix

@@ -2,7 +2,6 @@
 #
 # Given a set of services, make them run one at a time in a specific
 # order, on a timer.
-{ lib }:
 {
   # Given a list of systemd service, give each one an After
   # attribute, so they start in a specific order. The returned

macs/nix-darwin.nix

@@ -55,9 +55,9 @@ in
   '';
 
   environment.etc."per-user/root/ssh/authorized_keys".text = concatStringsSep "\n"
-    ([
+    [
       (authorizedNixStoreKey sshKeys.hydra-queue-runner)
-    ]);
+    ];
 
 
   system.activationScripts.postActivation.text = ''

non-critical-infra/flake.nix

@@ -40,13 +40,13 @@
   outputs = { self, nixpkgs, flake-utils, colmena, disko, srvos, first-time-contribution-tagger, sops-nix, ... }@inputs:
     let
       importConfig = path: (lib.mapAttrs (name: value: import (path + "/${name}/default.nix")) (lib.filterAttrs (_: v: v == "directory") (builtins.readDir path)));
-      lib = nixpkgs.lib;
+      inherit (nixpkgs) lib;
     in
     {
 
       nixosConfigurations = builtins.mapAttrs
         (name: value: nixpkgs.lib.nixosSystem {
-          lib = lib;
+          inherit lib;
           system = "x86_64-linux";
           specialArgs = {
             inherit inputs;

non-critical-infra/modules/postfix.nix

@@ -10,18 +10,18 @@
     enable = true;
     domains = config.networking.fqdn;
     selector = "mail";
-    user = config.services.postfix.user;
-    group = config.services.postfix.group;
+    inherit (config.services.postfix)
+      user
+      group
+    ;
     keyPath = "/run/opendkim-keys";
   };
 
   systemd.services.opendkim.serviceConfig = {
     ExecStartPre = [
-      (
-        "+${pkgs.writeShellScript "opendkim-keys" ''
-          install -o ${config.services.postfix.user} -g ${config.services.postfix.group} -D -m0700 ${config.sops.secrets.opendkim-private-key.path} /run/opendkim-keys/${config.services.opendkim.selector}.private
-        ''}"
-      )
+      "+${pkgs.writeShellScript "opendkim-keys" ''
+        install -o ${config.services.postfix.user} -g ${config.services.postfix.group} -D -m0700 ${config.sops.secrets.opendkim-private-key.path} /run/opendkim-keys/${config.services.opendkim.selector}.private
+      ''}"
     ];
   };
 

statix.toml

@@ -0,0 +1,6 @@
+disabled = [
+  "repeated_keys"
+]
+nix_version = '2.4'
+ignore = ['.direnv']
+

survey/flake.nix

@@ -10,9 +10,9 @@
   #       https://github.com/NixOS/nixpkgs/pull/157832
   inputs.nixpkgs.url = "github:garbas/nixpkgs/update-limesurvey";
 
-  outputs = flakes @ { self, nixpkgs }: 
+  outputs = { self, nixpkgs }:
     let
-      customOverlay = final: prev: {
+      customOverlay = _: prev: {
         limesurvey = prev.limesurvey.overrideAttrs (old: {
           installPhase = old.installPhase + ''
             mkdir -p $out/share/limesurvey/upload/themes/survey/generalfiles/
@@ -27,7 +27,7 @@
         [
           "${nixpkgs}/nixos/modules/virtualisation/amazon-image.nix"
           ../modules/common.nix
-          ({ config, pkgs, lib, ... }:
+          ({ pkgs, lib, ... }:
           {
             ec2.hvm = true;