Fix store-copied package updaters and update linear-cli to 2.5.0

[cameronraysmith]

Summary

Update scripts exposed as flake apps are copied into the Nix store before execution. Scripts that derive their package directory from $0 or BASH_SOURCE consequently resolve /nix/store/...-update.sh rather than the repository package directory, so package.nix cannot be read. The correct convention is to resolve the repository root with git rev-parse --show-toplevel, then address pkgs/by-name/<package> beneath that root.

The affected scripts were:

• pkgs/by-name/chrome-devtools-axi/update.sh
• pkgs/by-name/dbt-fusion/update.sh
• pkgs/by-name/gh-axi/update.sh
• pkgs/by-name/hindsight/update.sh
• pkgs/by-name/lavish-axi/update.sh
• pkgs/by-name/linear-cli/update.sh
• pkgs/by-name/quota-axi/update.sh
• pkgs/by-name/tasks-axi/update.sh
• pkgs/by-name/uncomment-bin/update.sh
• pkgs/by-name/worktrunk-bin/update.sh

All ten scripts now use repository-root-relative package paths. Updaters that newly invoke Git in the pure flake-app environment also declare Git as a runtime dependency.

nix run .#update-linear-cli now completes through the supported entry point and updates linear-cli from 2.0.0 to 2.5.0, including its source hash, two Darwin artifact hashes, and Linux source-build dependency hash.

Linux dependency output

Nixbot build 118 exposed that the original updater refreshed three of the four fixed-output hashes and silently retained the 2.0.0 denoDeps.outputHash. Darwin did not detect the stale value because linear-cli installs upstream binaries on aarch64-darwin and x86_64-darwin; x86_64-linux is the only supported system that consumes the source-build dependency derivation.

The vendored dependency output is platform-dependent in both 2.0.0 and 2.5.0. Deno retains the host-selected optional lefthook package: lefthook-darwin-arm64 on aarch64-darwin and lefthook-linux-x64 on x86_64-linux. A forced 2.0.0 Linux build also produced a different hash from the retained Darwin-generated 2.0.0 value. Because only Linux consumes denoDeps, the package needs one Linux-generated dependency hash rather than a per-system map.

After the Linux hash matched, the remote builder exposed an absolute deno_dir/node_compat_bin/node shim referencing the Deno store path. Nix rejects such a reference in fixed-output content. The dependency derivation now removes that regenerable, non-npm cache artifact before hashing; the cleaned output has no store references.

The updater now replaces the dependency pin with a probe hash, builds the derivation explicitly as x86_64-linux through the configured magnetite fleet builder, extracts the produced digest, and fails if no digest is available. The cleaned 2.5.0 Linux hash was generated by rerunning nix run .#update-linear-cli -- 2.5.0; a second run was idempotent. A pinned magnetite build completed the Linux package and its install check reported linear 2.5.0.

Recurrence checks

The flake check in modules/checks/hooks.nix scans every pkgs/by-name/*/update.sh, rejects package-path resolution from script identity, explains the repository-root convention, and verifies that scripts using Git declare it in the updater runtime. The check accepts the existing atomic updater as the working pattern. It also rejects packaged updaters that own an outputHash without updating that hash, preventing another partial update from silently retaining a stale fixed-output pin.

Related updater results

• nix run .#update-hindsight completes and would update 0.9.1 to 0.9.2. Its generated package change was restored and is not part of this pull request.
• nix run .#update-worktrunk-bin completes and would update 0.65.0 to 0.75.0. Its generated package change was restored and is not part of this pull request.

Verification

• nix eval --raw .#checks.aarch64-darwin.updater-repository-paths.drvPath
• nix build .#checks.aarch64-darwin.updater-repository-paths
• shellcheck pkgs/by-name/linear-cli/update.sh
• nix build --no-link --print-out-paths .#linear-cli
• Built Darwin binary: linear 2.5.0
• Pinned magnetite x86_64-linux build and install check: linear 2.5.0
• Supported updater repeated with no worktree change
• bash -n for all ten affected updater scripts
• git diff --check 4ff7508dff8d7d3959fc1eee4ee8afdfe78bbb06..HEAD
• Nixbot build 121 succeeded for commit 15efb95c5; checks.x86_64-linux.package-linear-cli was skipped_local because the pinned magnetite build had already populated the CI store, and all six home-manager plus five NixOS consumers succeeded.

The full parallel check set was not run locally. Nixbot build 121 supplied the x86_64-linux integration result.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request