Integrate nixpks build

.github/workflows/ci.yml

@@ -146,6 +146,21 @@ jobs:
           fi
           echo "clean: no EXPLAIN ANALYZE"
 
+  nix:
+    name: nix build
+    # vendorHash changes with every dependency bump, so this job is
+    # informational — a red nix build must not block an otherwise green PR.
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - run: nix build .#pgbot
+      # proves the ldflags version stamp reached the packaged binary
+      - run: ./result/bin/pgbot --version | grep -q 'pgbot version 0\.'
+
   build:
     name: build ${{ matrix.goos }}/${{ matrix.goarch }}
     runs-on: ubuntu-latest

.gitignore

@@ -8,3 +8,5 @@ pgrun_metrcis2.mp4
 
 # npm packaging build output (assembled by npm/build.mjs)
 npm/staging/
+
+result

flake.nix

@@ -0,0 +1,44 @@
+{
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forAllSystems =
+        f:
+        nixpkgs.lib.genAttrs systems (
+          system:
+          f (
+            import nixpkgs {
+              inherit system;
+              overlays = [ self.overlays.default ];
+            }
+          )
+        );
+    in
+    {
+      overlays.default = final: prev: {
+        pgbot = final.callPackage ./package.nix { };
+      };
+
+      packages = forAllSystems (pkgs: rec {
+        pgbot = pkgs.pgbot;
+        default = pgbot;
+      });
+
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = with pkgs; [
+            go_1_27
+            golangci-lint
+          ];
+        };
+      });
+    };
+}

package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  go_1_27,
+}:
+(buildGoModule.override { go = go_1_27; }) (finalAttrs: {
+  pname = "pgbot";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "pgrundev";
+    repo = "pgbot";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QJWJTSS92g7Ay2r5yckbRX5/JOUIBDTKGXpEzerZyKI=";
+  };
+
+  vendorHash = "sha256-iN6SE0ehjVVXkw8hHsUrCNXPV1Xchw6gxt92kVCQTV4=";
+
+  subPackages = [ "cmd/pgbot" ];
+
+  env.CGO_ENABLED = "0";
+
+  ldflags = [
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "In-database observability for PostgreSQL";
+    longDescription = ''
+      pgbot is a read-only PostgreSQL observability CLI. A single static
+      binary connects with a read-only role, reads Postgres's own
+      statistics views, and prints findings-first health reports plus
+      diffs against previous runs. No agent, no external service, no
+      write privilege anywhere in the path.
+    '';
+    homepage = "https://github.com/pgrundev/pgbot";
+    changelog = "https://github.com/pgrundev/pgbot/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    mainProgram = "pgbot";
+  };
+})

scripts/gate.sh

@@ -22,7 +22,9 @@ tmp="$(mktemp -d)"
 trap 'rm -rf "$tmp"' EXIT
 
 # (2) Build and test from HEAD, isolated from the working tree.
-git clone --quiet --local . "$tmp"
+# --no-hardlinks: TMPDIR is often tmpfs (e.g. under `nix develop`) and
+# hardlinking the clone fails across filesystems.
+git clone --quiet --local --no-hardlinks . "$tmp"
 pushd "$tmp" >/dev/null
 echo "→ gating HEAD ($head) in an isolated clone"
 CGO_ENABLED=0 go build ./...