From 29ac8b84fb827c39a8a27ff2ff753777910edbae Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 24 May 2025 15:01:44 +0200
Subject: [PATCH] workflows/nixpkgs-vet: use nixpkgs-vet from pinned nixpkgs

We have added nixpkgs-vet as a regular package to nixpkgs a while ago,
so we can now use it from pinned nixpkgs. This avoids pulling a
platform-specific binary version from upstream.

This change also allows to run the tool easily locally, the same way as
other tools:

  nix-build ci -A nixpkgs-vet

This will do a full check of the repo with the exception of
nixpkgs-vet's "ratchet" checks: Those depend on having two branches to
compare, but the default is to only look at the head branch. Those
ratchet checks will still be run in CI, though.

(cherry picked from commit 942c377476675848155e860b9d41d869589b8a47)
(cherry picked from commit 8eef7754077b467e2b17d6fdd14387c1d73ac4d3)
---
 .github/workflows/nixpkgs-vet.yml | 18 ++----------------
 ci/default.nix                    |  1 +
 ci/nixpkgs-vet.nix                | 31 +++++++++++++++++++++++++++++++
 ci/nixpkgs-vet.sh                 |  4 +---
 4 files changed, 35 insertions(+), 19 deletions(-)
 create mode 100644 ci/nixpkgs-vet.nix

diff --git a/.github/workflows/nixpkgs-vet.yml b/.github/workflows/nixpkgs-vet.yml
index aefed2b267ce..dffa9b63dd89 100644
--- a/.github/workflows/nixpkgs-vet.yml
+++ b/.github/workflows/nixpkgs-vet.yml
@@ -19,8 +19,7 @@ permissions: {}
 jobs:
   check:
     name: nixpkgs-vet
-    # This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases.
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04-arm
     # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
     timeout-minutes: 10
     steps:
@@ -44,25 +43,12 @@ jobs:
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
-      - name: Fetching the pinned tool
-        # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh
-        run: |
-          # The pinned version of the tooling to use.
-          toolVersion=$(<untrusted/ci/nixpkgs-vet/pinned-version.txt)
-
-          # Fetch the x86_64-linux-specific release artifact containing the gzipped NAR of the pre-built tool.
-          toolPath=$(curl -sSfL https://github.com/NixOS/nixpkgs-vet/releases/download/"$toolVersion"/x86_64-linux.nar.gz \
-            | gzip -cd | nix-store --import | tail -1)
-
-          # Adds a result symlink as a GC root.
-          nix-store --realise "$toolPath" --add-root result
-
       - name: Running nixpkgs-vet
         env:
           # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
           CLICOLOR_FORCE: 1
         run: |
-          if result/bin/nixpkgs-vet --base trusted untrusted; then
+          if nix-build untrusted/ci -A nixpkgs-vet --arg base "./trusted" --arg head "./untrusted"; then
             exit 0
           else
             exitCode=$?
diff --git a/ci/default.nix b/ci/default.nix
index dd39e082a6fb..939e8411d27a 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -84,6 +84,7 @@ in
   manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
   manual-nixpkgs = (import ../pkgs/top-level/release.nix { }).manual;
   manual-nixpkgs-tests = (import ../pkgs/top-level/release.nix { }).manual.tests;
+  nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix { };
   parse = pkgs.lib.recurseIntoAttrs {
     latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
     lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
diff --git a/ci/nixpkgs-vet.nix b/ci/nixpkgs-vet.nix
new file mode 100644
index 000000000000..1ceec363c347
--- /dev/null
+++ b/ci/nixpkgs-vet.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  nix,
+  nixpkgs-vet,
+  runCommand,
+}:
+{
+  base ? ../.,
+  head ? ../.,
+}:
+let
+  filtered =
+    with lib.fileset;
+    path:
+    toSource {
+      fileset = (gitTracked path);
+      root = path;
+    };
+in
+runCommand "nixpkgs-vet"
+  {
+    nativeBuildInputs = [
+      nixpkgs-vet
+    ];
+    env.NIXPKGS_VET_NIX_PACKAGE = nix;
+  }
+  ''
+    nixpkgs-vet --base ${filtered base} ${filtered head}
+
+    touch $out
+  ''
diff --git a/ci/nixpkgs-vet.sh b/ci/nixpkgs-vet.sh
index 7aabdfb6b8c5..b62e04fe0177 100755
--- a/ci/nixpkgs-vet.sh
+++ b/ci/nixpkgs-vet.sh
@@ -65,7 +65,5 @@ trace -n "Reading pinned nixpkgs-vet version from pinned-version.txt.. "
 toolVersion=$(<"$tmp/merged/ci/nixpkgs-vet/pinned-version.txt")
 trace -e "\e[34m$toolVersion\e[0m"
 
-trace -n "Building tool.. "
-nix-build https://github.com/NixOS/nixpkgs-vet/tarball/"$toolVersion" -o "$tmp/tool" -A build
 trace "Running nixpkgs-vet.."
-"$tmp/tool/bin/nixpkgs-vet" --base "$tmp/base" "$tmp/merged"
+nix-build ci -A nixpkgs-vet --argstr base "$tmp/base" --argstr head "$tmp/merged"