chore: replace GNUmakefile with justfile, provision CI via Nix - #752
Open
tembleking wants to merge 8 commits into
Open
chore: replace GNUmakefile with justfile, provision CI via Nix#752tembleking wants to merge 8 commits into
tembleking wants to merge 8 commits into
Conversation
Makefile syntax and per-line shell semantics made variable defaults, lazy shell evaluation, and multi-line scripts increasingly awkward to maintain. justfile keeps the same recipes and the same env-var override interface (TEST, TEST_SUITE, SWEEP, ...) so nothing downstream breaks, while picking up recipe grouping, doc comments, and a [confirm] guard on the destructive sweep recipe for free.
actions/setup-go, hashicorp/setup-terraform, golangci-lint-action, and
goreleaser-action each pinned their own tool version independently of
what the rest of the pipeline used, so lint/build/release could silently
drift from what devs ran locally via the flake devShell. Route every
job through DeterminateSystems/nix-installer-action + magic-nix-cache
instead, with a job-level 'defaults.run.shell: nix develop --command
bash -e {0}' so recipe invocations stay plain (just test, goreleaser
release --clean) instead of prefixing nix develop everywhere.
Go itself now tracks go-overlay's latestStable (same pattern as
sysdig-mcp-server) rather than nixpkgs' versioned go_1_NN package, so
bumping go.mod doesn't have to wait on nixpkgs to catch up.
Tag refs (@v4, @v1, @V3) are mutable pointers a compromised or re-tagged upstream release can move without our knowledge. Add pinact to the flake devShell and wire 'just update' to re-pin on every dependency bump, then run it once to convert every 'uses:' across the workflows to '@<sha> # vX'. pinact's -u flag also bumps to each action's latest release while it pins, which is why github/codeql-action jumped v1 -> v4.37.9 and actions/stale jumped v3 -> v11.0.0 in the same pass. Checked both against their action.yml at the pinned SHA: same input names, no renamed/removed fields, so existing config keeps working as-is.
Routine 'go get -u -t -v ./... && go mod tidy' pass. Notable bumps: aws-sdk-go-v2 v1.41.3 -> v1.45.1, terraform-plugin-sdk/v2 v2.40.0 -> v2.40.1, go-containerregistry v0.21.2 -> v0.22.1, docker/cli v29.3.0 -> v29.8.0, grpc v1.79.2 -> v1.83.2, protobuf v1.36.11 -> v1.36.12. Verified build, go vet, and unit tests all pass against the bumped tree before committing.
prek is a Rust reimplementation of pre-commit, drop-in compatible with the same .pre-commit-config.yaml, and noticeably faster on cold runs. Keep the config file as-is; just swap the tool in the flake devShell and add 'prek autoupdate' to 'just update' to keep hook versions current (same pattern as sysdig-mcp-server).
tfproviderdocs is already provisioned via the flake devShell; the 'go install ...@latest' line in 'provider-docs' was a leftover from before nix-installer-action, and the only non-nix tool install left reachable from a GitHub Actions workflow (ci-provider-docs.yaml runs this recipe directly). Verified 'just provider-docs' still passes with only the nix-provided binary on PATH.
install-tools (stringer), fmt (gofumpt), and junit-report (go-junit-report) each fetched their own copy of a tool via 'go install ...@latest' at runtime, duplicating what the flake devShell already provides. Add gotools (stringer) and go-junit-report to the flake, drop install-tools entirely, and remove the redundant installs from fmt and junit-report. errcheck stays on its go-install fallback: nixpkgs' build lags behind our go.mod's 'go 1.27' directive, and go/packages refuses to load a module declaring a newer Go version than the tool was built with. Also export $(go env GOPATH)/bin on PATH in the shellHook, since nix develop doesn't inherit it and the errcheck fallback needs it to find what it just installed.
Explain why nix develop is the entry point for tooling: same versions locally and in CI, no per-machine PATH drift.
tembleking
requested review from
a team,
draraksysdig and
mbarbieri
as code owners
September 4, 2026 17:28
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
There are concrete workflow/tooling breakages (e.g., CodeQL job not provisioning the required Go toolchain, missing mkdir -p for provider-docs output path, and devShell/recipes mismatches like missing make and non-pipefail test pipelines) that can cause CI or local commands to pass incorrectly or fail unexpectedly.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR modernizes the repo’s developer and CI tooling by replacing the Make-based workflow with a justfile and centralizing toolchain/version management in a Nix flake devShell, aiming to keep local development and CI using the same pinned tool versions.
Changes:
- Replaced
GNUmakefilewith ajustfileand updated docs/scripts/CI to calljustcommands. - Provisioned CI jobs via
nix develop(plus pinned GitHub Actions to SHAs) and updated the Nix devShell tool set. - Bumped the Go toolchain directive to
go 1.27and refreshed module dependencies (go.mod/go.sum).
File summaries
| File | Description |
|---|---|
| scripts/gofmtcheck.sh | Updates formatting check guidance from make to just. |
| scripts/errcheck.sh | Adds context for errcheck installation and updates guidance to just. |
| README.md | Updates developer instructions to use Nix + just and replaces make commands. |
| justfile | Introduces just recipes to replace Make targets for build/test/lint/docs/release flows. |
| Jenkinsfile | Migrates Jenkins steps from make to just. |
| go.mod | Bumps Go directive and updates dependency versions. |
| go.sum | Syncs checksums with updated module set. |
| GNUmakefile | Removes Make-based workflow definition. |
| flake.nix | Switches devShell to go-overlay latest stable Go, replaces pre-commit with prek, and adds CI/dev tools. |
| flake.lock | Updates/pins flake inputs for the new Nix setup. |
| AGENTS.md | Updates repository agent guidance from make to just. |
| .pre-commit-config.yaml | Updates hooks to run just recipes instead of make. |
| .github/workflows/test.yml | Routes lint/unit/acceptance test jobs through nix develop and just, pins actions. |
| .github/workflows/stale.yml | Pins actions/stale to a commit SHA. |
| .github/workflows/release.yml | Routes release job through nix develop, pins actions, runs GoReleaser from the devShell. |
| .github/workflows/issues-slack-notify.yml | Pins Slack-related actions to commit SHAs. |
| .github/workflows/codeql-analysis.yml | Pins checkout + CodeQL actions to commit SHAs (but does not yet adopt the Nix toolchain pattern). |
| .github/workflows/ci.yml | Routes multi-arch build through nix develop and pins actions. |
| .github/workflows/ci-scheduled-tests.yml | Pins Slack action to a commit SHA. |
| .github/workflows/ci-provider-docs.yaml | Routes docs validation through nix develop and just, pins actions. |
Review details
Suppressed comments (1)
.github/workflows/codeql-analysis.yml:38
- This workflow no longer sets up any Go toolchain or Nix devShell, but the repo now requires a newer Go toolchain (per
go.mod).codeql-action/autobuildwill typically invokegoand can fail with "go.mod requires go >= …". To match the PR goal of running CI jobs with the flake toolchain, add Nix setup and expose the devShell PATH before CodeQL init/autobuild.
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# We must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head.
fetch-depth: 2
- Files reviewed: 18/20 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+66
to
+70
| #!/usr/bin/env bash | ||
| set -eu | ||
| CGO_ENABLED=1 TF_ACC=1 TF_LOG=DEBUG go test {{ test }} -v {{ test_args }} -tags={{ test_suite }} -timeout 120m -race -parallel=1 2>&1 | tee output.txt | ||
| ! grep -q "\[build failed\]" output.txt | ||
| go-junit-report -in output.txt -out junit-report.xml |
Comment on lines
41
to
+47
| gofumpt | ||
| gotools | ||
| go-junit-report | ||
| jq | ||
| gnumake | ||
| pre-commit | ||
| just | ||
| pinact | ||
| prek |
Comment on lines
50
to
53
| shellHook = '' | ||
| pre-commit install | ||
| export PATH="$(go env GOPATH)/bin:$PATH" | ||
| prek install | ||
| ''; |
Comment on lines
+106
to
+108
| goos=$(go env GOOS) | ||
| goarch=$(go env GOARCH) | ||
| go build -o "terraform-plugin-dir/registry.terraform.io/sysdiglabs/sysdig/99.99.99/${goos}_${goarch}/terraform-provider-sysdig" . |
| # nixpkgs' errcheck build lags behind our go.mod version (go/packages refuses to | ||
| # load a module declaring a newer 'go' directive than the errcheck binary was | ||
| # built with), so it isn't in the flake devShell. Install it on demand instead. | ||
| if ! which errcheck > /dev/null; then |
|
Nice work pinning all actions to SHAs and mirroring the recipes cleanly. Two things before merge: flake.nix uses go_latest instead of a pinned Go, which conflicts with the README's "same versions everywhere" claim, and please confirm goreleaser is in the nix shell and the release job stays green. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make's per-line shell semantics and Make-flavored variable expansion were getting in the way (lazy shell evaluation, no recipe grouping, awkward multi-line scripts), and every job in CI pinned its own tool version independently (setup-go,setup-terraform,golangci-lint-action,goreleaser-action) instead of using what devs actually run locally.Replaces
GNUmakefilewith ajustfile(same recipes, same env-var override interface), and routes every CI job throughnix developoff a single flake devShell instead of per-tool setup actions — so local dev and CI always run the exact same toolchain versions. Along the way:go-overlay'slatestStable(same pattern assysdig-mcp-server) instead of nixpkgs' versionedgo_1_NN, so bumping doesn't wait on nixpkgs.pinact, wired intojust update.pre-commitswapped forprek(same.pre-commit-config.yaml, faster).go install ...@latestthat was duplicating a tool the flake already provides (tfproviderdocs,gofumpt,stringer,go-junit-report);errcheckkeeps its install-on-demand fallback since nixpkgs' build currently lags behind ourgo 1.27directive.