chore: use nixpkgs master for ai tools - #774
Conversation
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request updates the project's Nix flake configuration to leverage the latest Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRUpdated AI tools (codex, claude-code, opencode) to use What changed?
Description generated by Mesa. Update settings |
|
Caution Review failedThe pull request is closed. 📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds multiple nixpkgs inputs (stable, unstable, nightly) and makes Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request aims to use nixpkgs/master for certain AI tools by adding a new flake input and an overlay. However, this introduces a medium-severity supply chain risk, as the master branch is not a stable, immutable source, and a security vulnerability has been identified. Additionally, a critical issue causing build failures on Linux due to unwhitelisted unfree packages needs to be addressed, and the new overlay requires refactoring for better code style and consistency.
| codex = final.nightlyPkgs.codex; | ||
| claude-code = final.nightlyPkgs.claude-code; | ||
| opencode = final.nightlyPkgs.opencode; |
There was a problem hiding this comment.
The packages codex and opencode are marked as unfree in nixpkgs. The build will fail on Linux systems because they are not included in the allowUnfreePredicate in lib/nixpkgs-config.nix. Please add them to the list of allowed unfree packages to prevent build failures.
| nixpkgs-nightly = { | ||
| url = "github:NixOS/nixpkgs/master"; | ||
| }; |
There was a problem hiding this comment.
The configuration fetches nixpkgs-nightly directly from the master branch. The master branch is a development branch and can receive frequent, less-vetted updates, including potentially vulnerable or unstable code. While Nix flakes pin dependencies in flake.lock, an update to the flake's inputs will pull the latest commit from master, which could introduce untrusted code. This practice increases the risk of supply chain attacks compared to using tagged releases or more stable channels.
Recommendation: For better security and stability, pin the dependency to a specific, immutable git revision (a commit hash or tag) instead of a floating branch like master. This ensures that you are always using a known, vetted version of the dependency.
| (final: prev: { | ||
| nightlyPkgs = import inputs.nixpkgs-nightly { | ||
| system = prev.system; | ||
| config = prev.config; | ||
| overlays = [ ]; | ||
| }; | ||
| codex = final.nightlyPkgs.codex; | ||
| claude-code = final.nightlyPkgs.claude-code; | ||
| opencode = final.nightlyPkgs.opencode; | ||
| }) |
There was a problem hiding this comment.
This overlay implementation adds nightlyPkgs to the global pkgs namespace, which is likely unintended. Using a let block would make the overlay cleaner and prevent polluting the package set.
Additionally, for consistency with the PR's goal of using nixpkgs-master for AI tools, you should consider also overriding code-cursor (which was added in this PR) to use the version from nixpkgs-nightly.
(final: prev:
let
nightlyPkgs = import inputs.nixpkgs-nightly {
system = prev.system;
config = prev.config;
overlays = [ ];
};
in {
codex = nightlyPkgs.codex;
claude-code = nightlyPkgs.claude-code;
opencode = nightlyPkgs.opencode;
code-cursor = nightlyPkgs.code-cursor;
})
There was a problem hiding this comment.
Pull request overview
This PR introduces a second nixpkgs input pinned to the master branch and uses it to override a small set of AI tooling packages, aiming to pull newer versions for those tools without moving the rest of the system off nixpkgs-unstable.
Changes:
- Add a
nixpkgs-nightlyflake input pointing atNixOS/nixpkgsmaster. - Import
nixpkgs-nightlyin the overlay and overridecodex,claude-code, andopencodefrom it. - Add
code-cursorto the desktop Linux home-manager package list and updateflake.lock.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| overlays/default.nix | Imports nixpkgs-nightly and overrides select AI tools from that package set. |
| home-manager/packages/default.nix | Adds code-cursor to the Linux desktop package set. |
| flake.nix | Declares the new nixpkgs-nightly input. |
| flake.lock | Pins the new nixpkgs-nightly input revision/hash and wires it into the lock graph. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| (final: prev: { | ||
| nightlyPkgs = import inputs.nixpkgs-nightly { | ||
| system = prev.system; | ||
| config = prev.config; | ||
| overlays = [ ]; | ||
| }; | ||
| codex = final.nightlyPkgs.codex; | ||
| claude-code = final.nightlyPkgs.claude-code; | ||
| opencode = final.nightlyPkgs.opencode; | ||
| }) |
There was a problem hiding this comment.
The overlay exports nightlyPkgs into pkgs and then references it via final.nightlyPkgs.*. If the intent is only to override a few packages, consider keeping the imported nixpkgs set as a local let nightlyPkgs = ...; in { ... } binding and referencing nightlyPkgs.<pkg> directly. This avoids adding a new top-level pkgs.nightlyPkgs attribute (API surface) and reduces coupling to overlay evaluation order (e.g., relying on prev.system).
| (final: prev: { | |
| nightlyPkgs = import inputs.nixpkgs-nightly { | |
| system = prev.system; | |
| config = prev.config; | |
| overlays = [ ]; | |
| }; | |
| codex = final.nightlyPkgs.codex; | |
| claude-code = final.nightlyPkgs.claude-code; | |
| opencode = final.nightlyPkgs.opencode; | |
| }) | |
| (final: prev: | |
| let | |
| nightlyPkgs = import inputs.nixpkgs-nightly { | |
| system = prev.system; | |
| config = prev.config; | |
| overlays = [ ]; | |
| }; | |
| in { | |
| codex = nightlyPkgs.codex; | |
| claude-code = nightlyPkgs.claude-code; | |
| opencode = nightlyPkgs.opencode; | |
| }) |
| chromium | ||
| clickup | ||
| cliphist | ||
| code-cursor |
There was a problem hiding this comment.
code-cursor is only included when (stdenv.isLinux && isDesktop) is true, but the repo’s eval checks appear to run with inputs.host.isDesktop = false by default (lib/host.nix), so this addition likely isn’t exercised by nix flake check. Consider extending the evaluation checks (or adding a desktop test config) so the desktop-only package set is evaluated and failures like missing/renamed attributes are caught in CI.
…r-ai-tools' into chore/nixpkgs-master-ai-tools
Changes
Technical Details
Testing
Generated with Codex CLI by OpenAI ChatGPT
Summary by cubic
Build codex, claude-code, and opencode from nixpkgs master via a scoped overlay; everything else stays on nixpkgs-unstable. Also added Hyprland window-swap keybindings and updated inputs/flake.lock.
Written for commit f4715c2. Summary will update on new commits.