feat: add direnv gitignore, migrate flake to use pnpm, and create automatic hash update script (added to github action `made bot sign the cla`) #366

connerohnesorge · 2025-04-18T22:07:53Z

This pull request updates the flake.nix file to improve its structure and maintainability. The most important changes include reformatting the outputs attribute for better readability and updating the codex-cli package definition to use a local path and a new hash for npmDepsHash.

Structural improvements:

Reformatted the outputs attribute to use a block-style layout, making it more readable and consistent with common Nix practices.

Package definition updates:

Updated the codex-cli package definition to use a local path (./codex-cli) for the src attribute instead of a relative reference (self + "/codex-cli").
Changed the npmDepsHash for codex-cli to a new value (sha256-UkvkaM7tvVlio0st8UA45x8wQ+q423BTzshsmdmmO2o=), reflecting updated dependencies.

Autonomous Update for the future:

Created a github action step and bash script for updating the npmHash in the flake.nix if the package-lock.json changes in ./codex-cli

github-actions · 2025-04-18T22:08:04Z

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

I have read the CLA Document and I hereby sign the CLA

1 out of 2 committers have signed the CLA.
✅ (conneroisu)[https://github.com/conneroisu]
❌ @actions-user
_{You can retrigger this bot by commenting recheck in this Pull Request.}_{Posted by the CLA Assistant Lite bot.}

connerohnesorge · 2025-04-18T22:09:28Z

I have read the CLA Document and I hereby sign the CLA

…flake.nix

tibo-openai · 2025-04-18T23:21:44Z

Thanks! One CODEX.md, why would we want to add it to .gitignore? It should be pretty universal, so what is the thinking here?

connerohnesorge · 2025-04-19T17:34:06Z

Ope. thought the idea was to add more specific context to a goal in CODEX.md. I'll remove it from gitignore

remove CODEX.md from .gitignore

tibo-openai · 2025-04-21T05:30:26Z

This change is based on the package-lock.json, however we are using pnpm since #287. Could you update the logic to reflect?

connerohnesorge · 2025-04-21T13:46:00Z

Yes I will update the logic to reflect. Thanks for switching to pnpm I like it alot more!

jonchurch · 2025-04-21T17:32:57Z

.github/workflows/ci.yml

+  update-nix-hash:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: write  # Needed for push access
+      pull-requests: write  # Needed for PR creation


Just flagging this for awareness, this job introduces write access from CI for the first time (excluding the CLA Assistant, which already operates with elevated perms via pull_request_target).

It’s scoped well (only runs on push to main) so it won’t run on PRs or forks. That said, it does slightly shift the trust boundary, merging into main will now trigger a job that can push branches and open PRs back to the repo.

No action needed here, but it might be worth making sure folks reviewing automation changes are aware of that shift. If main isn’t already protected, enabling “require PRs before merging” and disallowing force-pushes/deletion would be good hardening steps for this kind of setup.

since this job is the only one in ci.yml with write permissions, it might be worth considering moving it to a separate workflow file (e.g. update-nix-hash.yml). That could make it easier to see at a glance which workflows mutate the repo and which are strictly read-only CI.

Also worth noting, the script update-nix-hash.sh will be run with elevated permissions and therefore also needs special attention during review to ensure it is not going to smuggle a secret, accidentally commit something, and that it’s not vulnerable to input injection (e.g. using PR metadata like branch names in shell commands without quoting).

connerohnesorge · 2025-04-22T14:15:26Z

I updated the flake and hash updater to use pnpm, let me know if the github action step to update the flake hash should be it's own action.

Conneroisu/main

connerohnesorge · 2025-04-24T16:46:15Z

I updated the flake to use pnpm. Please let me know if you want any other changes

connerohnesorge · 2025-04-25T17:40:20Z

Just updated the bot to sign the CLA since the CLA is failing

…updates use pnpm

peteringram0 · 2025-04-28T12:55:37Z

@conneroisu Sorry im still new to nix/flakes so if this question is beside the point of this PR then please ignore it but if if i run

~ ❯ nix run github:conneroisu/codex --extra-experimental-features nix-command --extra-experimental-features flakes

error: unable to execute '/nix/store/z4cwhcbj786xlw82y3mx1w3m5nxy1l4g--openai-codex-0.1.2504251709/bin/@openai/codex': No such file or directory

Additionally when i include this in my flake it seems to download correctly and runs without any errors however codex/codex-cli are not available in PATH. I use the helix flake and this seems to add to PATH correctly.

connerohnesorge · 2025-04-28T14:04:41Z

@peteringram0 You are correct. Additionally, it should now add to the path correctly. Thanks!

peteringram0 · 2025-04-28T14:32:39Z

@peteringram0 You are correct. Additionally, it should now add to the path correctly. Thanks!

That update is working now! I notice though that it it exports 'codex-cli' rather than just default. This requires people to look into the flake and out what thats needed. Maybe an idea to make .default work?

codex-cli.packages.${pkgs.system}.codex-cli
# codex-cli.packages.${pkgs.system}.default

peteringram0 · 2025-04-28T14:54:38Z

@conneroisu i think in packages you can have a 'default' and just equal to 'codex-cli'. Like this: https://github.com/helix-editor/helix/blob/master/flake.nix#L50

connerohnesorge · 2025-04-28T20:05:54Z

@peteringram0 yep, didn't even see your comment, but updated to have both codex-cli, default, and the update nix hash script. Thanks again

peteringram0 · 2025-04-28T20:13:27Z

@peteringram0 yep, didn't even see your comment, but updated to have both codex-cli, default, and the update nix hash script. Thanks again

latest version doesnt seem to support .default but does still work with .codex-cli

cla

This automated commit updates the pnpm deps hash hash in flake.nix to match the latest hash of the workspace's pnpm-lock.yaml file. This ensures that Nix's store is consistent with the latest dependencies.

connerohnesorge added 2 commits April 18, 2025 17:04

add .direnv and CODEX.md to .gitignore

9edead0

update hash in flake.nix

008c314

github-actions bot added a commit that referenced this pull request Apr 18, 2025

@conneroisu has signed the CLA in #366

9ae942c

connerohnesorge and others added 3 commits April 18, 2025 18:02

added update-nix-hash script to automatically update nix hash in the …

29ab478

…flake.nix

Merge branch 'main' into main

5322cb9

fix update script after testing more in act

53f2a2e

connerohnesorge added 3 commits April 19, 2025 12:34

Merge branch 'main' into main

c213427

Update .gitignore

a092608

remove CODEX.md from .gitignore

Merge branch 'main' into main

8b44533

connerohnesorge added 2 commits April 21, 2025 08:46

Merge branch 'main' into main

64c6c59

Merge branch 'main' into main

f56b426

jonchurch reviewed Apr 21, 2025

View reviewed changes

connerohnesorge and others added 4 commits April 22, 2025 09:04

working pnpm package building and automatic hash update

b536496

working and tested fully automated update of nix hash

a2f81de

get pnpm globally in flake

7cc6cc9

Merge branch 'main' into main

3594a7f

connerohnesorge added 2 commits April 22, 2025 09:18

Merge pull request #1 from conneroisu/conneroisu/main

954fe5e

Conneroisu/main

Merge branch 'main' into main

28e8e95

tibo-openai changed the title ~~Add direnv and CODEX.md to gitignore and update flake deps hash~~ feat: add direnv and CODEX.md to gitignore and update flake deps hash Apr 22, 2025

connerohnesorge added 2 commits April 22, 2025 14:35

Merge branch 'main' into main

e52569c

Merge branch 'main' into main

f5d3827

connerohnesorge changed the title ~~feat: add direnv and CODEX.md to gitignore and update flake deps hash~~ feat: add direnv gitignore, migrate flake to use pnpm, and create automatic hash update script (added to github action) Apr 24, 2025

connerohnesorge requested a review from jonchurch April 25, 2025 17:40

Merge branch 'main' into main

ff6b388

connerohnesorge and others added 5 commits April 26, 2025 11:23

Merge branch 'main' into main

93e56f6

update name fo workflow to update the pnpm hash in the flake.nix file

9b9e566

fix typo in name for updating nix npm hash to be pnpm hash since the …

b3f4a57

…updates use pnpm

simpler check if changes are needed

96aa34e

Merge branch 'main' into main

67a78bd

fix workspace filters and proper binary path

1d697e2

add a packages.default package that also point to the codex-cli package

f1c2c6f

update depreciated devShell to devShells.default

60b6d83

Merge branch 'main' into main

9ef360a

connerohnesorge and others added 9 commits April 29, 2025 07:55

Merge branch 'main' into main

070d6bb

added temporary sign-cla workflow

8759fa3

missed conditional if in temporary workflow so that the bot signs the

2358527

cla

remove the temporary sign workflow for the bot to sign the cla

78bd16e

Merge branch 'main' into main

7619c38

Merge branch 'main' into main

61e8c38

chore: Update pnpm deps hash in flake.nix

94a30de

This automated commit updates the pnpm deps hash hash in flake.nix to match the latest hash of the workspace's pnpm-lock.yaml file. This ensures that Nix's store is consistent with the latest dependencies.

Merge branch 'main' into main

c94df9d

Merge branch 'main' into main

ac9d6eb

connerohnesorge closed this May 6, 2025

github-actions bot locked and limited conversation to collaborators May 6, 2025

feat: add direnv gitignore, migrate flake to use pnpm, and create automatic hash update script (added to github action made bot sign the cla) #366

feat: add direnv gitignore, migrate flake to use pnpm, and create automatic hash update script (added to github action made bot sign the cla) #366

Uh oh!

Conversation

connerohnesorge commented Apr 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Structural improvements:

Package definition updates:

Autonomous Update for the future:

Uh oh!

github-actions bot commented Apr 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

connerohnesorge commented Apr 18, 2025

Uh oh!

tibo-openai commented Apr 18, 2025

Uh oh!

connerohnesorge commented Apr 19, 2025

Uh oh!

tibo-openai commented Apr 21, 2025

Uh oh!

connerohnesorge commented Apr 21, 2025

Uh oh!

jonchurch Apr 21, 2025

Choose a reason for hiding this comment

Uh oh!

jonchurch Apr 21, 2025

Choose a reason for hiding this comment

Uh oh!

connerohnesorge commented Apr 22, 2025

Uh oh!

connerohnesorge commented Apr 24, 2025

Uh oh!

connerohnesorge commented Apr 25, 2025

Uh oh!

peteringram0 commented Apr 28, 2025

Uh oh!

connerohnesorge commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

peteringram0 commented Apr 28, 2025

Uh oh!

peteringram0 commented Apr 28, 2025

Uh oh!

connerohnesorge commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

peteringram0 commented Apr 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

feat: add direnv gitignore, migrate flake to use pnpm, and create automatic hash update script (added to github action `made bot sign the cla`) #366

feat: add direnv gitignore, migrate flake to use pnpm, and create automatic hash update script (added to github action `made bot sign the cla`) #366

connerohnesorge commented Apr 18, 2025 •

edited

Loading

github-actions bot commented Apr 18, 2025 •

edited

Loading

connerohnesorge commented Apr 28, 2025 •

edited

Loading

connerohnesorge commented Apr 28, 2025 •

edited

Loading