circus-evaluator: pin flake evaluation to checkout commit

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I9c1f5447d4865b245b0b85fd1fde3d096a6a6964

Author: NotAShelf

Cargo.lock

@@ -25,6 +25,7 @@ tokio-util.workspace         = true
 toml.workspace               = true
 tracing.workspace            = true
 tracing-subscriber.workspace = true
+url.workspace                = true
 uuid.workspace               = true
 
 # Our crates

crates/evaluator/Cargo.toml

@@ -420,6 +420,7 @@ async fn run_nix_and_record_builds(
   ));
   let result = crate::nix::evaluate(
     repo_path,
+    &eval.commit_hash,
     &jobset.nix_expression,
     jobset.flake_mode,
     nix_timeout,

crates/evaluator/src/eval_loop.rs

@@ -4,6 +4,7 @@ use circus_common::{CiError, InputType, error::Result, models::JobsetInput};
 use circus_config::EvaluatorConfig;
 use tokio::process::Command;
 use tokio_util::sync::CancellationToken;
+use url::Url;
 
 mod eval_command;
 mod flake_lock;
@@ -176,6 +177,7 @@ pub struct EvalResult {
 #[tracing::instrument(skip(config, inputs), fields(flake_mode, nix_expression))]
 pub async fn evaluate(
   repo_path: &Path,
+  commit_hash: &str,
   nix_expression: &str,
   flake_mode: bool,
   timeout: Duration,
@@ -201,8 +203,16 @@ pub async fn evaluate(
   };
 
   if flake_mode {
-    evaluate_flake(repo_path, nix_expression, timeout, config, inputs, cancel)
-      .await
+    evaluate_flake(
+      repo_path,
+      commit_hash,
+      nix_expression,
+      timeout,
+      config,
+      inputs,
+      cancel,
+    )
+    .await
   } else {
     evaluate_legacy(repo_path, nix_expression, timeout, config, inputs, cancel)
       .await
@@ -270,6 +280,7 @@ fn lock_derived_allowed_uris(
 #[tracing::instrument(skip(config, inputs))]
 async fn evaluate_flake(
   repo_path: &Path,
+  commit_hash: &str,
   nix_expression: &str,
   timeout: Duration,
   config: &EvaluatorConfig,
@@ -294,7 +305,7 @@ async fn evaluate_flake(
     );
   }
 
-  let flake_ref = format!("{}#{effective_expr}", repo_path.display());
+  let flake_ref = git_flake_ref(repo_path, commit_hash, &effective_expr)?;
 
   tracing::debug!(flake_ref = %flake_ref, "Running evix evaluation");
 
@@ -333,6 +344,21 @@ async fn evaluate_flake(
   eval_command::run_eval(evix_config, timeout, "flake", cancel).await
 }
 
+fn git_flake_ref(
+  repo_path: &Path,
+  commit_hash: &str,
+  expression: &str,
+) -> Result<String> {
+  let mut url = Url::from_file_path(repo_path).map_err(|()| {
+    CiError::NixEval(format!(
+      "Failed to convert repository path to a file URL: {}",
+      repo_path.display()
+    ))
+  })?;
+  url.query_pairs_mut().append_pair("rev", commit_hash);
+  Ok(format!("git+{url}#{expression}"))
+}
+
 /// Resolve all toplevels in one nix eval.
 async fn evaluate_all_nixos_configs(
   repo_path: &Path,
@@ -891,6 +917,19 @@ mod meta_tests {
     assert!(rewrite_nixos_config_expr("packages").is_none());
   }
 
+  #[test]
+  fn git_flake_ref_pins_the_checked_out_commit() {
+    assert_eq!(
+      git_flake_ref(
+        Path::new("/tmp/circus fixture"),
+        "0123456789abcdef",
+        "packages",
+      )
+      .unwrap(),
+      "git+file:///tmp/circus%20fixture?rev=0123456789abcdef#packages",
+    );
+  }
+
   #[test]
   fn parse_derivation_show_legacy_uses_top_level_drv_key() {
     let v = serde_json::json!({

crates/evaluator/src/nix.rs

@@ -12,19 +12,31 @@ use circus_config::EvaluatorConfig;
 use tempfile::TempDir;
 use tokio_util::sync::CancellationToken;
 
-fn git_stage(dir: &Path) {
+fn git_stage(dir: &Path) -> String {
   for args in [
     &["init", "-q"][..],
     &["config", "user.email", "test@circus"],
     &["config", "user.name", "Circus Test"],
     &["add", "."],
+    &["commit", "-qm", "fixture"],
   ] {
     Command::new("git")
       .args(args)
       .current_dir(dir)
       .status()
       .expect("git command failed");
   }
+  String::from_utf8(
+    Command::new("git")
+      .args(["rev-parse", "HEAD"])
+      .current_dir(dir)
+      .output()
+      .expect("read fixture commit")
+      .stdout,
+  )
+  .expect("fixture commit is UTF-8")
+  .trim()
+  .to_owned()
 }
 
 fn permissive_config() -> EvaluatorConfig {
@@ -54,10 +66,11 @@ async fn eval_minimal_flake_returns_one_job() {
 }"#,
   )
   .unwrap();
-  git_stage(dir.path());
+  let commit = git_stage(dir.path());
 
   let result = circus_evaluator::nix::evaluate(
     dir.path(),
+    &commit,
     "packages",
     true,
     Duration::from_mins(2),
@@ -99,10 +112,11 @@ async fn eval_captures_per_attribute_errors_without_failing_fatally() {
 }"#,
   )
   .unwrap();
-  git_stage(dir.path());
+  let commit = git_stage(dir.path());
 
   let result = circus_evaluator::nix::evaluate(
     dir.path(),
+    &commit,
     "packages",
     true,
     Duration::from_mins(2),
@@ -130,10 +144,11 @@ async fn eval_fatal_parse_error_returns_cierror_nixeval() {
   let dir = TempDir::new().unwrap();
   fs::write(dir.path().join("flake.nix"), "not valid nix syntax at all")
     .unwrap();
-  git_stage(dir.path());
+  let commit = git_stage(dir.path());
 
   let result = circus_evaluator::nix::evaluate(
     dir.path(),
+    &commit,
     "packages",
     true,
     Duration::from_secs(30),
@@ -171,10 +186,11 @@ async fn eval_timeout_returns_cierror_timeout() {
 }",
   )
   .unwrap();
-  git_stage(dir.path());
+  let commit = git_stage(dir.path());
 
   let result = circus_evaluator::nix::evaluate(
     dir.path(),
+    &commit,
     "packages",
     true,
     Duration::from_millis(500),