feat(internal): add nix flake dev shell

.github/actions/setup-nix/action.yml

@@ -0,0 +1,17 @@
+name: "Setup Nix"
+description: "Setup Nix"
+
+runs:
+  using: "composite"
+
+  steps:
+    - name: Install Nix
+      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+
+    - name: Setup Nix cache
+      uses: DeterminateSystems/magic-nix-cache-action@cec65ff6f104850203b152861d3f9e5f1747885d
+      with:
+        use-flakehub: false
+        flakehub-api-server: ""
+        flakehub-cache-server: ""
+        diagnostic-endpoint: ""

.github/workflows/linux-build.yml

@@ -38,6 +38,10 @@ jobs:
       GLIDE_COMPAT: ${{ matrix.arch }}
       MOZ_BUILD_DATE: ${{ inputs.MOZ_BUILD_DATE }}
 
+    defaults:
+      run:
+        shell: nix develop --command bash -e {0}
+
     strategy:
       fail-fast: false
       matrix:
@@ -54,20 +58,14 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/setup-nix
+
       - name: Configure git
         run: |
           git config --global \
             url."https://github.com/mozilla-firefox/firefox.git".insteadOf \
             "git@github.com:mozilla-firefox/firefox.git"
 
-      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: "24"
-          cache: "pnpm"
-
       - name: Run sccache-cache
         uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
         with:
@@ -80,13 +78,6 @@ jobs:
             core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
             core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
 
-      - name: Install system dependencies
-        run: |
-          set -x
-          sudo apt-get update --fix-missing
-          sudo apt-get update
-          sudo apt-get install -y python3 python3-pip dos2unix yasm nasm build-essential libgtk2.0-dev libpython3-dev m4 uuid libasound2-dev libcurl4-openssl-dev libdbus-1-dev libdrm-dev libdbus-glib-1-dev libgtk-3-dev libpulse-dev libx11-xcb-dev libxt-dev xvfb lld llvm
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -95,16 +86,11 @@ jobs:
           pnpm bootstrap
 
           cd engine
-          export PATH="$(python3 -m site --user-base)/bin":$PATH
           ./mach --no-interactive bootstrap --application-choice browser --no-system-changes || true
           cd ..
 
-      - name: Fix Rust version
+      - name: Configure rust
         run: |
-          # Install a rust version compatible with LLVM 18
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.89
-          source $HOME/.cargo/env
-
           if test "$GLIDE_COMPAT" = "aarch64"; then
             rustup target add aarch64-unknown-linux-gnu
           else

.github/workflows/macos-build.yml

@@ -1,6 +1,9 @@
 name: macOS Build
 
 on:
+  push:
+    branches:
+      - feat/nix-flake-devshell
   workflow_dispatch:
     inputs:
       tag:
@@ -29,7 +32,7 @@ jobs:
   macos-build:
     name: Build - ${{ matrix.arch }}
 
-    runs-on: depot-macos-14
+    runs-on: depot-macos-15
     env:
       CARGO_TERM_COLOR: always
       GLIDE_PLATFORM: macos
@@ -39,35 +42,33 @@ jobs:
       GLIDE_COMPAT: ${{ matrix.arch }}
       MOZ_BUILD_DATE: ${{ inputs.MOZ_BUILD_DATE }}
 
+    defaults:
+      run:
+        shell: nix develop --command bash -e {0}
+
     strategy:
       fail-fast: false
       matrix:
         arch: [aarch64, x86_64]
 
     steps:
-      - name: Debug
-        run: |
-          xcrun --show-sdk-version
-
       - name: Checkout repository
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/setup-nix
+
+      - name: Debug
+        run: |
+          xcrun --show-sdk-version
+
       - name: Configure git
         run: |
           git config --global \
             url."https://github.com/mozilla-firefox/firefox.git".insteadOf \
             "git@github.com:mozilla-firefox/firefox.git"
 
-      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: "24"
-          cache: "pnpm"
-
       - name: Run sccache-cache
         uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
         with:
@@ -80,31 +81,12 @@ jobs:
             core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
             core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
 
-      - name: Install system dependencies
+      - name: Configure rust
         run: |
-          brew update
-          brew install cairo gnu-tar mercurial
-
-          brew uninstall --ignore-dependencies python3.12 -f
-
-          export PATH="$(python3 -m site --user-base)/bin":$PATH
-
-          rm '/usr/local/bin/2to3-3.11' '/usr/local/bin/2to3-3.12' '/usr/local/bin/2to3' || true
-          rm '/usr/local/bin/idle3.11' '/usr/local/bin/idle3.12' '/usr/local/bin/idle3' || true
-          rm '/usr/local/bin/pydoc3.11' '/usr/local/bin/pydoc3.12' '/usr/local/bin/pydoc3' || true
-          rm '/usr/local/bin/python3.11' '/usr/local/bin/python3.12' '/usr/local/bin/python3' || true
-          rm '/usr/local/bin/python3.11-config' '/usr/local/bin/python3.12-config' '/usr/local/bin/python3-config' || true
-
-          brew install watchman
-
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.89
-          source $HOME/.cargo/env
-
           if test "$GLIDE_COMPAT" = "aarch64"; then
             rustup target add aarch64-apple-darwin
           else
             rustup target add x86_64-apple-darwin
-            brew install nasm
           fi
 
       - name: Install dependencies
@@ -115,7 +97,6 @@ jobs:
           pnpm bootstrap
 
           cd engine
-          export PATH="$(python3 -m site --user-base)/bin":$PATH
           ./mach --no-interactive bootstrap --application-choice browser --no-system-changes || true
           cd ..
 

flake.nix

@@ -0,0 +1,83 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils?ref=main";
+  };
+
+  outputs = {
+    nixpkgs,
+    flake-utils,
+    ...
+  }:
+    flake-utils.lib.eachDefaultSystem (
+      system: let
+        pkgs = import nixpkgs {
+          inherit system;
+        };
+
+        # Target the LLVM version that rustc is built with for LTO.
+        llvmPackages0 = pkgs.rustc.llvmPackages;
+        llvmPackagesBuildBuild0 = pkgs.pkgsBuildBuild.rustc.llvmPackages;
+
+        # Force the use of lld and other llvm tools for LTO
+        llvmPackages = llvmPackages0.override {
+          bootBintoolsNoLibc = null;
+          bootBintools = null;
+        };
+        llvmPackagesBuildBuild = llvmPackagesBuildBuild0.override {
+          bootBintoolsNoLibc = null;
+          bootBintools = null;
+        };
+      in {
+        devShell = pkgs.mkShell {
+          buildInputs = with pkgs;
+            [
+              (pnpm.override {nodejs = nodejs_24;})
+              nodejs_24
+              python314
+              uv
+              rustc
+              cargo
+              watchman
+              cairo
+              gnutar
+              mercurial
+              nasm
+              rust-cbindgen
+              rustPlatform.bindgenHook
+              llvm
+              pkg-config
+              lld
+              gnumake
+              curl
+              gcc
+              m4
+            ]
+            ++ pkgs.lib.optionals pkgs.stdenv.isDarwin (with pkgs; [
+              apple-sdk_26
+            ])
+            ++ pkgs.lib.optionals pkgs.stdenv.isLinux (with pkgs; [
+              yasm
+              gtk2
+              util-linux
+              alsa-lib
+              dbus
+              libdrm
+              dbus-glib
+              gtk3
+              libpulseaudio
+              libX11
+              libxcb
+              libXt
+              xvfb-run
+              dos2unix
+            ]);
+
+          shellHook = ''
+            export HOST_CC="${llvmPackagesBuildBuild.stdenv.cc}/bin/cc"
+            export HOST_CXX="${llvmPackagesBuildBuild.stdenv.cc}/bin/c++"
+          '';
+        };
+      }
+    );
+}

src/build/moz.configure/toolchain-configure.patch

@@ -0,0 +1,13 @@
+diff --git a/build/moz.configure/toolchain.configure b/build/moz.configure/toolchain.configure
+index 47061339da913be4adde21702df86fa21958156f..23a6df47b55c2aed3bcbe79e01f5cb6e6271bd70 100644
+--- a/build/moz.configure/toolchain.configure
++++ b/build/moz.configure/toolchain.configure
+@@ -240,7 +240,7 @@ with only_when(host_is_osx | target_is_osx):
+     )
+
+     def mac_sdk_min_version():
+-        return "26.2"
++        return "26.0"
+
+     @depends(
+         "--with-macos-sdk",