WIP: feat: hermetic build for enola #1730 (buildBazelPackage)

flake.nix

@@ -63,6 +63,25 @@
         # NB: This doesn't actually use tools/version/version-out.bash (like the non-Nix build does)
         gitRev = toString (self.shortRev or self.dirtyShortRev or self.lastModified or "DEVELOPMENT");
 
+        # `buildBazelPackage` expects to call `.override` on the `bazel`
+        # attribute, but that one is missing for bazel_8.
+        # We construct a new attribute set that contains the final derivation's
+        # attributes and adds a custom `override` function.
+        originalBazel = pkgs.bazel_8;
+        bazelForBuildBazelPackage = originalBazel // {
+          # This override function is called by `buildBazelPackage` with arguments
+          # like `{ enableNixHacks = true; }`.
+          # It ignores the arguments and simply returns the original derivation.
+          # This satisfies the interface required by `buildBazelPackage`.
+          override = args: originalBazel;
+        };
+
+        bazel-central-registry = pkgs.fetchFromGitHub {
+          owner = "bazelbuild";
+          repo = "bazel-central-registry";
+          rev = "4fcc47180cfe24915dae5705074c3994c60dc6b7";
+          hash = "sha256-Th7gamXEzJnoA65VKVfARCDnLup5URJT0R1g2Jw3S/0=";
+        };
       in
       {
         # TODO: for https://nix-bazel.build, replace with mkShellNoCC.
@@ -93,35 +112,75 @@
           # $ nix build .#enola
           # $ result/bin/enola --help
           default = enola;
-          enola = pkgs.stdenv.mkDerivation {
+          # https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/build-bazel-package/default.nix
+          enola = pkgs.buildBazelPackage {
             pname = "enola";
             version = gitRev;
 
-            buildInputs = [ jdk' ];
-            nativeBuildInputs = buildTools ++ [
-              pkgs.cacert
-              pkgs.makeWrapper
-              pkgs.which
-            ];
+            #
+            # Shared settings.
+            #
             src = ./.;
-
-            buildPhase = ''
-              # class dev.enola.common.Version reads VERSION
-              echo -n "${gitRev}" >tools/version/VERSION
-
-              # See https://github.com/NixOS/nix/issues/14024
+            bazel = bazelForBuildBazelPackage;
+            bazelTargets = [ "//java/dev/enola/cli:enola_deploy.jar" ];
+            bazelFlags = [ "--registry=file://${bazel-central-registry}" ];
+            preBuild = ''
               bash tools/protoc/protoc.bash
-
-              export HOME=$TMPDIR
-              bazel build //java/dev/enola/cli:enola_deploy.jar
             '';
 
-            installPhase = ''
-              mkdir -p "$out/share/java"
-              cp bazel-bin/java/dev/enola/cli/enola_deploy.jar "$out/share/java"
-              makeWrapper ${jdk'}/bin/java $out/bin/enola \
-                --add-flags "-jar $out/share/java/enola_deploy.jar"
-            '';
+            #
+            # "fetch" aka "download dependencies".
+            #
+
+            # Use "bazel fetch" rather than "bazel build --no-build".
+            fetchConfigured = false;
+            # Do not remove too many files from bazel-fetched dependencies.
+            removeRulesCC = false;
+            removeLocalConfigCc = false;
+            removeLocalConfigSh = false;
+            removeLocal = false;
+            fetchAttrs = {
+              nativeBuildInputs = [
+                jdk'
+                pkgs.protoc-gen-grpc-java
+                pkgs.protobuf
+                pkgs.which
+              ];
+
+              # installPhase here is removing some volatile files to keep final
+              # cache consistent. For some reason, few files can not be removed
+              # (permission denied). Fixup.
+              preInstall = ''
+                chmod -R 777 $bazelOut/external
+              '';
+
+              sha256 = "sha256-j3LtqTYqklkxE8mK10JiFAmrRBIjJTXyfiy/cbJbnIg=";
+            };
+
+            bazelBuildFlags = [
+              "--verbose_failures"
+              "--nofetch"
+            ];
+            buildAttrs = {
+              nativeBuildInputs = [
+                jdk'
+                pkgs.protoc-gen-grpc-java
+                pkgs.protobuf
+                pkgs.which
+              ];
+
+              # Probably broken but we're very far from it anyway.
+              installPhase = ''
+                runHook preInstall
+
+                mkdir -p "$out/share/java"
+                cp $bazelOut/java/dev/enola/cli/enola_deploy.jar "$out/share/java"
+                makeWrapper ${jdk'}/bin/java $out/bin/enola \
+                  --add-flags "-jar $out/share/java/enola_deploy.jar"
+
+                runHook postInstall
+              '';
+            };
           };
         };