flakes: ensure that flake packages don't throw during construction

.github/workflows/ci.yaml

@@ -22,7 +22,8 @@ jobs:
         name: pre-commit-hooks
         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
     - run: rm -rf /opt&
-    - run: nix-build --keep-going
+    - name: Evaluate flake-compat default.nix
+      run: nix eval --show-trace --file ./default.nix run
 
   tests-flakes:
     strategy:
@@ -39,7 +40,8 @@ jobs:
     - run: rm -rf /opt&
 
     - name: Check nixpkgs-unstable
-      run: nix flake check -L --show-trace
+      working-directory: ./dev
+      run: nix flake check -L --show-trace --no-write-lock-file
 
     - run: nix eval .#lib.x86_64-linux.run --show-trace
 
@@ -58,4 +60,5 @@ jobs:
     - run: rm -rf /opt&
 
     - name: Check nixpkgs-stable
+      working-directory: ./dev
       run: nix flake check -L --show-trace --override-input nixpkgs github:NixOS/nixpkgs/nixos-25.05

default.nix

@@ -1,13 +1,15 @@
 let
-  flake = (import
-    (
-      let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
-      fetchTarball {
-        url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
-        sha256 = lock.nodes.flake-compat.locked.narHash;
-      }
-    )
-    { src = ./.; }
-  ).defaultNix;
+  flake =
+    (import
+      (
+        let
+          lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+        in
+        fetchTarball {
+          url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+          sha256 = lock.nodes.flake-compat.locked.narHash;
+        }
+      )
+      { src = ./.; }).defaultNix;
 in
-flake.lib.${builtins.currentSystem} // flake.packages.${builtins.currentSystem}
+flake.lib.${builtins.currentSystem} // flake.legacyPackages.${builtins.currentSystem}

dev/flake.nix

@@ -0,0 +1,15 @@
+{
+  description = "An internal test flake for git-hooks.nix";
+
+  inputs = {
+    git-hooks.url = "path:..";
+  };
+
+  outputs =
+    { git-hooks
+    , ...
+    }:
+    {
+      inherit (git-hooks) legacyPackages checks;
+    };
+}

flake.nix

@@ -40,6 +40,16 @@
         '';
       };
 
+      # The set of tools exposed by git-hooks.
+      # We use legacyPackages because not all tools are derivations that evaluate.
+      legacyPackages = forAllSystems ({ pkgs, exposed, ... }: exposed.tools // {
+        pre-commit = pkgs.pre-commit;
+      });
+
+      # WARN: use `legacyPackages` instead to get error messages for deprecated packages
+      #
+      # Each entry is guaranteed to be a derivation that evaluates.
+      # TODO: this should be deprecated as it exposes a subset of nixpkgs, which is incompatbile with the packages output.
       packages = forAllSystems ({ exposed, ... }: exposed.packages // {
         default = exposed.packages.pre-commit;
       });
@@ -50,10 +60,11 @@
         };
       });
 
-      checks = forAllSystems ({ exposed, ... }: lib.filterAttrs (k: v: v != null) exposed.checks);
+      checks = forAllSystems ({ exposed, ... }: exposed.checks);
 
       lib = forAllSystems ({ exposed, ... }: { inherit (exposed) run; });
 
+      # TODO: remove and expose a `lib` function is needed
       exposed = forAllSystems ({ exposed, ... }: exposed);
     };
 }

modules/hooks.nix

@@ -2618,7 +2618,7 @@ in
             # need version >= 0.4.0 for the --from-stdin flag
             toolVersionCheck = lib.versionAtLeast convco.version "0.4.0";
           in
-          lib.throwIf (convco == null || !toolVersionCheck) "The version of Nixpkgs used by git-hooks.nix does not have the `convco` package (>=0.4.0). Please use a more recent version of Nixpkgs."
+          lib.throwIfNot toolVersionCheck "The version of Nixpkgs used by git-hooks.nix does not have the `convco` package (>=0.4.0). Please use a more recent version of Nixpkgs."
             builtins.toString
             script;
         stages = [ "commit-msg" ];
@@ -3089,9 +3089,7 @@ lib.escapeShellArgs (lib.concatMap (ext: [ "--ghc-opt" "-X${ext}" ]) hooks.fourm
                 "$PRE_COMMIT_COMMIT_MSG_SOURCE" --commit-msg-file "$1"
             '';
           in
-          lib.throwIf (hooks.gptcommit.package == null) "The version of Nixpkgs used by git-hooks.nix does not have the `gptcommit` package. Please use a more recent version of Nixpkgs."
-            toString
-            script;
+          toString script;
         stages = [ "prepare-commit-msg" ];
       };
       hadolint =
@@ -3110,13 +3108,7 @@ lib.escapeShellArgs (lib.concatMap (ext: [ "--ghc-opt" "-X${ext}" ]) hooks.fourm
           ## https://github.com/Frama-C/headache/blob/master/config_builtin.txt
           files = "(\\.ml[ily]?$)|(\\.fmli?$)|(\\.[chy]$)|(\\.tex$)|(Makefile)|(README)|(LICENSE)";
           package = tools.headache;
-          entry =
-            ## NOTE: `headache` made into in nixpkgs on 12 April 2023. At the
-            ## next NixOS release, the following code will become irrelevant.
-            lib.throwIf
-              (hooks.headache.package == null)
-              "The version of nixpkgs used by git-hooks.nix does not have `ocamlPackages.headache`. Please use a more recent version of nixpkgs."
-              "${hooks.headache.package}/bin/headache -h ${hooks.headache.settings.header-file}";
+          entry = "${hooks.headache.package}/bin/headache -h ${hooks.headache.settings.header-file}";
         };
       hindent =
         {
@@ -3646,16 +3638,7 @@ lib.escapeShellArgs (lib.concatMap (ext: [ "--ghc-opt" "-X${ext}" ]) hooks.fourm
       pre-commit-hook-ensure-sops = {
         name = "pre-commit-hook-ensure-sops";
         package = tools.pre-commit-hook-ensure-sops;
-        entry =
-          ## NOTE: pre-commit-hook-ensure-sops landed in nixpkgs on 8 July 2022. Once it reaches a
-          ## release of NixOS, the `throwIf` piece of code below will become
-          ## useless.
-          lib.throwIf
-            (hooks.pre-commit-hook-ensure-sops.package == null)
-            "The version of nixpkgs used by git-hooks.nix does not have the `pre-commit-hook-ensure-sops` package. Please use a more recent version of nixpkgs."
-            ''
-              ${hooks.pre-commit-hook-ensure-sops.package}/bin/pre-commit-hook-ensure-sops
-            '';
+        entry = "${hooks.pre-commit-hook-ensure-sops.package}/bin/pre-commit-hook-ensure-sops";
         files = "^secrets";
       };
       # See all CLI flags for prettier [here](https://prettier.io/docs/en/cli.html).
@@ -4134,25 +4117,17 @@ lib.escapeShellArgs (lib.concatMap (ext: [ "--ghc-opt" "-X${ext}" ]) hooks.fourm
           description = "A universal formatter engine within the Tree-sitter ecosystem, with support for many languages.";
           package = tools.topiary;
           entry =
-            ## NOTE: Topiary landed in nixpkgs on 2 Dec 2022. Once it reaches a
-            ## release of NixOS, the `throwIf` piece of code below will become
-            ## useless.
-            lib.throwIf
-              (hooks.topiary.package == null)
-              "The version of nixpkgs used by git-hooks.nix does not have the `topiary` package. Please use a more recent version of nixpkgs."
-              (
-                let
-                  topiary-inplace = pkgs.writeShellApplication {
-                    name = "topiary-inplace";
-                    text = ''
-                      for file; do
-                        ${hooks.topiary.package}/bin/topiary --in-place --input-file "$file"
-                      done
-                    '';
-                  };
-                in
-                "${topiary-inplace}/bin/topiary-inplace"
-              );
+            let
+              topiary-inplace = pkgs.writeShellApplication {
+                name = "topiary-inplace";
+                text = ''
+                  for file; do
+                    ${hooks.topiary.package}/bin/topiary --in-place --input-file "$file"
+                  done
+                '';
+              };
+            in
+            "${topiary-inplace}/bin/topiary-inplace";
           files = "(\\.json$)|(\\.toml$)|(\\.mli?$)";
         };
       treefmt =
@@ -4257,11 +4232,7 @@ lib.escapeShellArgs (lib.concatMap (ext: [ "--ghc-opt" "-X${ext}" ]) hooks.fourm
         name = "typstyle";
         description = "Beautiful and reliable typst code formatter";
         package = tools.typstyle;
-        entry =
-          lib.throwIf
-            (hooks.typstyle.package == null)
-            "The version of nixpkgs used by git-hooks.nix must contain typstyle"
-            "${hooks.typstyle.package}/bin/typstyle -i";
+        entry = "${hooks.typstyle.package}/bin/typstyle -i";
         files = "\\.typ$";
       };
       uv-check = {

nix/call-tools.nix

@@ -1,7 +1,21 @@
 pkgs:
-pkgs.lib.flip builtins.removeAttrs [ "override" "overrideDerivation" ]
-  (pkgs.callPackage ./tools.nix {
-    cabal-fmt = (pkgs.haskell.lib.enableSeparateBinOutput pkgs.haskellPackages.cabal-fmt).bin;
-    cabal-gild = (pkgs.haskell.lib.enableSeparateBinOutput pkgs.haskellPackages.cabal-gild).bin;
-    hindent = pkgs.haskell.lib.enableSeparateBinOutput pkgs.haskellPackages.hindent;
-  })
+pkgs.lib.flip builtins.removeAttrs [ "override" "overrideDerivation" ] (
+  pkgs.callPackage ./tools.nix {
+    placeholder =
+      name:
+      let
+        errorMsg = ''
+          git-hooks: the package `${name}` is not available in your nixpkgs revision.
+        '';
+      in
+      {
+        # Allows checking without forcing evaluation
+        meta.isPlaceholder = true;
+
+        type = "derivation";
+        name = name + "-placeholder";
+        outPath = throw errorMsg;
+        drvPath = throw errorMsg;
+      };
+  }
+)

nix/default.nix

@@ -19,16 +19,51 @@ let
           ;
       };
 
-      # Filter out any broken or missing packages from our tests.
-      filterBrokenPackages = n: package: package != null && !(package.meta.broken or false);
+      removeInvalidPackage = removeInvalidPackageWith { };
+      removeInvalidPackageQuiet = removeInvalidPackageWith { warn = false; };
+
+      # Filter out broken and placeholder packages.
+      removeInvalidPackageWith =
+        { warn ? true
+        ,
+        }:
+        name: package:
+        let
+          isPlaceholder = package.meta.isPlaceholder or false;
+          isBroken = package.meta.broken or false;
+
+          check = builtins.tryEval (!(isPlaceholder || isBroken));
+          result = check.success && check.value;
+
+          message =
+            if !check.success then
+              ''
+                Skipping ${name} because it failed to evaluate.
+              ''
+            else if !check.value && isPlaceholder then
+              ''
+                Skipping ${name} because it is missing from this nixpkgs revision.
+              ''
+            else if !check.value && isBroken then
+              ''
+                Skipping ${name} because it is marked as broken.
+              ''
+            else
+              ""; # Not used
+
+        in
+        if warn then lib.warnIfNot result message result else result;
     in
     {
       inherit tools run;
-      # Flake style attributes
-      packages = (lib.filterAttrs filterBrokenPackages tools) // {
+
+      # Flake-style attributes
+      # Each should strictly be a valid derivation that evaluates.
+      packages = (lib.filterAttrs removeInvalidPackageQuiet tools) // {
         inherit (pkgs) pre-commit;
       };
-      checks = self.packages // {
+
+      checks = (lib.filterAttrs removeInvalidPackage tools) // {
         # A pre-commit-check for nix-pre-commit itself
         pre-commit-check = run {
           src = ../.;
@@ -57,7 +92,7 @@ let
               f n h.package;
 
             allEntryPoints = lib.pipe allHooks [
-              (lib.filterAttrs (getPackage filterBrokenPackages))
+              (lib.filterAttrs (getPackage (removeInvalidPackageQuiet)))
               (lib.mapAttrsToList getEntry)
             ];
           in