skret/flake.nix at main · n24q02m/skret · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
{
  description = "skret — cloud-provider secret manager CLI";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, flake-utils }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = import nixpkgs { inherit system; };
        version = "1.0.0";
      in
      {
        packages.default = pkgs.buildGoModule {
          pname = "skret";
          inherit version;

          src = pkgs.lib.cleanSource ./.;

          # vendorHash placeholder. First `nix build` prints the real
          # hash in the error message — paste it here and commit. Keep
          # `pkgs.lib.fakeHash` when bumping module versions so nix
          # surfaces the new hash instead of silently reusing cache.
          vendorHash = pkgs.lib.fakeHash;

          subPackages = [ "cmd/skret" ];

          ldflags = [
            "-s"
            "-w"
            "-X github.com/n24q02m/skret/internal/version.Version=${version}"
          ];

          doCheck = false;  # Full Go suite runs via CI, not nix build.

          meta = with pkgs.lib; {
            description = "Cloud-provider secret manager CLI with Doppler/Infisical-grade DX";
            homepage = "https://skret.n24q02m.com";
            license = licenses.mit;
            maintainers = [ ];
            mainProgram = "skret";
            platforms = platforms.unix ++ platforms.windows;
          };
        };

        devShells.default = pkgs.mkShell {
          buildInputs = [
            pkgs.go_1_26 or pkgs.go
            pkgs.golangci-lint
            pkgs.gofumpt
            pkgs.pre-commit
          ];
        };
      });
}