flake.nix

{
  description = "dev-kit";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";

    git-hooks = {
      url = "github:cachix/git-hooks.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    go-overlay = {
      url = "github:purpleclay/go-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.git-hooks.follows = "git-hooks";
      inputs.flake-utils.follows = "flake-utils";
    };

    gomod2nix = {
      url = "github:nix-community/gomod2nix";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.flake-utils.follows = "flake-utils";
    };
  };

  outputs = { self, nixpkgs, flake-utils, git-hooks, go-overlay, gomod2nix, ... }@inputs: {
    lib.mkShell = { system, name ? "dev-shell", packages ? [], inputsFrom ? [], preCommitHooks ? {}, goVersion ? null, shellHook ? "", env ? {}, ... }:
    let
      pkgs = import nixpkgs {
        inherit system;
        overlays = [
          go-overlay.overlays.default
          gomod2nix.overlays.default
        ];
      };
      lib = pkgs.lib;
      mkDefaultAttrs = value:
        if lib.isAttrs value then
          builtins.mapAttrs (_: v: mkDefaultAttrs v) value
        else
          lib.mkDefault value;

      defaultPkgs = with pkgs; [
        curl
        git
        gnumake
        jq
        kind
        kubectl
        kubernetes-helm
        (mdformat.withPlugins (ps: [ ps.mdformat-gfm ]))
        shellcheck
        shfmt
        treefmt
        unzip
        yamlfmt
        yq-go
      ];

      defaultHooks = {
        fmt = mkDefaultAttrs {
          enable = true;
          entry = "make fmt";
          pass_filenames = false;
        };
        lint = mkDefaultAttrs {
          enable = true;
          entry = "make lint";
          pass_filenames = false;
        };
        # Disabled by default: `make scan` resolves every dependency against
        # the osv.dev API, which adds ~1min to any commit touching a manifest
        # file. Vulnerability scanning belongs in CI, where it runs on a
        # schedule and on every pull request without blocking a commit.
        # Projects without a CI-side scan can opt back in per-project.
        osv-scanner = mkDefaultAttrs {
          enable = false;
          entry = "make scan";
          files = "\\.(mod|sum)$|requirements\\.txt$";
          pass_filenames = false;
        };
        commitlint = mkDefaultAttrs {
          enable = false;
          entry = "${pkgs.commitlint}/bin/commitlint --edit";
          stages = ["commit-msg"];
          pass_filenames = false;
        };
      };
      gitHooks = git-hooks.lib.${system}.run {
        src = nixpkgs.path;
        hooks = lib.recursiveUpdate defaultHooks preCommitHooks;
      };
    in
      pkgs.mkShell {
        inherit name env inputsFrom;

        shellHook = gitHooks.shellHook + ''
          [[ -f .git/hooks/pre-commit.legacy ]] && rm -v .git/hooks/pre-commit.legacy
        '' + shellHook;

        packages = defaultPkgs ++ packages ++ lib.optionals (goVersion != null) [
          # go-overlay only carries versions it has a manifest for, and the
          # overlay is pinned by flake.lock — so a freshly released Go patch
          # does not exist here until the lock is refreshed. Without this the
          # failure is `attribute '1.27.1' missing`, which points at the
          # overlay's internals rather than at the fix, and it takes down every
          # workflow at shell-evaluation time before any job runs.
          (pkgs.go-bin.versions.${goVersion} or (throw ''
            dev-kit: Go ${goVersion} is not in the locked go-overlay.
            Available ${lib.versions.majorMinor goVersion}.x: ${
              let
                inMinor = builtins.filter
                  (v: lib.hasPrefix (lib.versions.majorMinor goVersion + ".") v)
                  (builtins.attrNames pkgs.go-bin.versions);
              in
                if inMinor == [] then "none" else lib.concatStringsSep ", " inMinor
            }
            Either refresh the overlay:  nix flake update go-overlay
            or set goVersion to a version listed above.
          ''))
          pkgs.gotools
        ];
      };
  } // flake-utils.lib.eachDefaultSystem (system: {
    devShells.default = self.lib.mkShell {
      inherit system;
      preCommitHooks = {
        osv-scanner.enable = false;
        commitlint.enable = true;
      };
    };
  });
}