[nix] Migrate linter installation to nix

Author: maru-ava

.github/workflows/ci.yml

@@ -122,19 +122,18 @@ jobs:
       #     loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
   Lint:
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: nix develop --command bash -x {0}
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
+      - uses: ./.github/actions/install-nix
       - name: Run static analysis tests
-        shell: bash
         run: scripts/lint.sh
       - name: Run actionlint
-        shell: bash
-        run: scripts/actionlint.sh
-      - uses: ./.github/actions/install-nix
+        run: actionlint
       - name: Run shellcheck
-        shell: bash
-        run: nix develop --command bash -x scripts/shellcheck.sh
+        run: scripts/shellcheck.sh
   buf-lint:
     name: Protobuf Lint
     runs-on: ubuntu-latest

flake.nix

@@ -8,7 +8,7 @@
 
   # Flake inputs
   inputs = {
-    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.2405.*.tar.gz";
+    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.2411.*.tar.gz";
   };
 
   # Flake outputs
@@ -47,6 +47,8 @@
             self.packages.${system}.kind-with-registry # Script installing kind configured with a local registry
 
             # Linters
+            (import ./nix/golangci-lint.nix { inherit pkgs; })
+            actionlint
             shellcheck
           ] ++ lib.optionals stdenv.isDarwin [
             # macOS-specific frameworks

nix/golangci-lint.nix

@@ -0,0 +1,47 @@
+{ pkgs }:
+let
+  # Helper functions to derive Go arch from Nix arch
+  nixArchToGoArch = arch: {
+    "x86_64" = "amd64";
+    "aarch64" = "arm64";
+  }.${arch} or arch;
+
+  # Split system into arch and os
+  parseSystem = system:
+    let
+      parts = builtins.split "-" system;
+      arch = builtins.elemAt parts 0;
+      os = builtins.elemAt parts 2;
+    in {
+      osArch = "${os}-${nixArchToGoArch arch}";
+    };
+
+
+  # Update the following to change the version:
+
+  # 1.63.4 is the only binary release compatible with go1.23.
+  # Newer versions are built with go1.24.x and consume memory until OOMkilled.
+  lintVersion = "1.63.4";
+  lintSHA256s = {
+    "linux-amd64" = "01abb14a4df47b5ca585eff3c34b105023cba92ec34ff17212dbb83855581690";
+    "linux-arm64" = "51f0c79d19a92353e0465fb30a4901a0644a975d34e6f399ad2eebc0160bbb24";
+    "darwin-amd64" = "878d017cc360e4fb19510d39852c8189852e3c48e7ce0337577df73507c97d68";
+    "darwin-arm64" = "a2b630c2ac8466393f0ccbbede4462387b6c190697a70bc2298c6d2123f21bbf";
+  };
+
+  targetSystem = parseSystem pkgs.system;
+in
+pkgs.stdenv.mkDerivation {
+  name = "golangci-lint-${lintVersion}";
+  version = lintVersion;
+
+  src = pkgs.fetchurl {
+    url = "https://github.com/golangci/golangci-lint/releases/download/v${lintVersion}/golangci-lint-${lintVersion}-${targetSystem.osArch}.tar.gz";
+    sha256 = lintSHA256s.${targetSystem.osArch} or (throw "Unsupported system: ${pkgs.system}");
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -r ./golangci-lint $out/bin
+  '';
+}

scripts/actionlint.sh

@@ -32,7 +32,6 @@ fi
 TESTS=${TESTS:-"golangci_lint license_header require_error_is_no_funcs_as_params single_import interface_compliance_nil require_no_error_inline_func import_testing_only_in_tests"}
 
 function test_golangci_lint {
-  go install -v github.com/golangci/golangci-lint/cmd/[email protected]
   golangci-lint run --config .golangci.yml
 }
 
@@ -41,6 +40,7 @@ function test_golangci_lint {
 # TESTS='license_header' ADDLICENSE_FLAGS="--debug" ./scripts/lint.sh
 _addlicense_flags=${ADDLICENSE_FLAGS:-"--verify --debug"}
 function test_license_header {
+  # TODO(marun) Migrate to a nix package
   go install -v github.com/palantir/[email protected]
   local files=()
   while IFS= read -r line; do files+=("$line"); done < <(find . -type f -name '*.go' ! -name '*.pb.go' ! -name 'mock_*.go' ! -name 'mocks_*.go' ! -path './**/*mock/*.go' ! -name '*.canoto.go')