Build Databricks CLI from source following nixpkgs pattern

Rework the derivation to use buildGoModule + fetchFromGitHub instead of
downloading a pre-built binary tarball. This follows the upstream nixpkgs
package.nix pattern with version bumped to 0.286.0.

Changes:
- Build from source with buildGoModule for reproducibility
- Add meta.license = lib.licenses.databricks
- Add databricks-cli to allowUnfreePredicate in flake.nix
- Exclude tools/testmask (new in v0.286.0, not a distributable package)
- Skip TestCacheDirEnvVar (fails in nix sandbox, no home directory)

Author: luketchang

flake.nix

@@ -31,9 +31,10 @@
           fenix.overlays.default
           replit-rtld-loader.overlays.default
         ];
-        # replbox has an unfree license
+        # replbox and databricks-cli have unfree licenses
         config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [
           "@replit/replbox"
+          "databricks-cli"
         ];
       };
 

pkgs/modules/databricks-cli/default.nix

@@ -2,30 +2,85 @@
 
 let
   version = "0.286.0";
-  databricks-cli = pkgs.stdenvNoCC.mkDerivation {
+  databricks-cli = pkgs.buildGoModule {
     pname = "databricks-cli";
     inherit version;
 
-    src = pkgs.fetchurl {
-      url = "https://github.com/databricks/cli/releases/download/v${version}/databricks_cli_${version}_linux_amd64.tar.gz";
-      hash = "sha256-lf6q0c9iZVNvIzLVrptTe0YudpFDVDdZXMWR8lOObw8=";
+    src = pkgs.fetchFromGitHub {
+      owner = "databricks";
+      repo = "cli";
+      rev = "v${version}";
+      hash = "sha256-iCmxHjIYznqed6BMQKtuYHJNFPy+3XrNzSXfhtyzPJk=";
     };
 
-    sourceRoot = ".";
+    vendorHash = "sha256-TNUI2VQVKnxTiKQg9Bj3qDK2w3oOjO0rdrtTlFIhTzA=";
 
-    dontConfigure = true;
-    dontBuild = true;
+    excludedPackages = [
+      "bundle/internal"
+      "acceptance"
+      "integration"
+      "tools/testrunner"
+      "tools/testmask"
+    ];
 
-    unpackPhase = ''
-      tar -xzf $src
+    postPatch = ''
+      substituteInPlace bundle/deploy/terraform/init_test.go \
+        --replace-fail "cli/0.0.0-dev" "cli/${version}"
     '';
 
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      install -m755 databricks $out/bin/databricks
-      runHook postInstall
+    ldflags = [
+      "-X github.com/databricks/cli/internal/build.buildVersion=${version}"
+    ];
+
+    postBuild = ''
+      mv "$GOPATH/bin/cli" "$GOPATH/bin/databricks"
     '';
+
+    checkFlags =
+      "-skip="
+      + (lib.concatStringsSep "|" [
+        # Need network
+        "TestConsistentDatabricksSdkVersion"
+        "TestTerraformArchiveChecksums"
+        "TestExpandPipelineGlobPaths"
+        "TestRelativePathTranslationDefault"
+        "TestRelativePathTranslationOverride"
+        "TestWorkspaceVerifyProfileForHost"
+        "TestWorkspaceVerifyProfileForHost/default_config_file_with_match"
+        "TestWorkspaceResolveProfileFromHost"
+        "TestWorkspaceResolveProfileFromHost/no_config_file"
+        "TestBundleConfigureDefault"
+        # Use uv venv which doesn't work with nix
+        # https://github.com/astral-sh/uv/issues/4450
+        "TestVenvSuccess"
+        "TestPatchWheel"
+        # Fails in nix sandbox due to missing home/cache directory
+        "TestCacheDirEnvVar"
+      ]);
+
+    nativeCheckInputs = [
+      pkgs.gitMinimal
+      (pkgs.python3.withPackages (
+        ps: with ps; [
+          setuptools
+          wheel
+        ]
+      ))
+    ];
+
+    preCheck = ''
+      # Some tests depend on git and remote url
+      git init
+      git remote add origin https://github.com/databricks/cli.git
+    '';
+
+    meta = {
+      description = "Databricks CLI";
+      mainProgram = "databricks";
+      homepage = "https://github.com/databricks/cli";
+      changelog = "https://github.com/databricks/cli/releases/tag/v${version}";
+      license = lib.licenses.databricks;
+    };
   };
 in
 {