ci(nix): build with crane and cache to atuin.cachix.org (atuinsh/atuin#4348)

.buildkite/pipeline.yml

@@ -346,17 +346,19 @@ steps:
 
   - label: ":nix: Nix build"
     key: nix-build
-    # main only: buildRustPackage builds atuin and every dependency in one
-    # derivation, so every change rebuilds from scratch (~4 min). The flake
-    # check and nixfmt steps still run on PRs.
+    # main only, so the cache only ever holds main's builds. Pushes everything
+    # it builds to atuin.cachix.org, including crane's dependency-only
+    # derivation, which isn't in the result's runtime closure.
     if: *main-only
     agents: *linux-large
     timeout_in_minutes: 45
+    secrets:
+      CACHIX_AUTH_TOKEN: CACHIX_AUTH_TOKEN
     command:
       - source .buildkite/scripts/lib.sh
       - 'section ":nix: Install Nix" install_nix'
-      - 'section ":nix: nix build" nix build --print-build-logs'
-      - 'section ":nix: Run the built binary" ./result/bin/atuin --version'
+      - 'section ":nix: nix build" nix run --inputs-from . nixpkgs#cachix -- watch-exec atuin -- nix build --print-build-logs'
+      - 'section ":nix: Run the built binary" env -u CACHIX_AUTH_TOKEN ./result/bin/atuin --version'
 
   - label: ":nix: nixfmt"
     key: nixfmt

.buildkite/scripts/lib.sh

@@ -126,7 +126,9 @@ install_nix() {
   fetch_verified "https://dl.tty0.dev/DeterminateSystems/nix-installer/releases/download/v${NIX_INSTALLER_VERSION}/nix-installer-x86_64-linux" \
     "$NIX_INSTALLER_SHA256" /tmp/nix-installer
   chmod +x /tmp/nix-installer
-  $sudo /tmp/nix-installer install linux --no-confirm --init none --prefer-upstream-nix
+  $sudo /tmp/nix-installer install linux --no-confirm --init none --prefer-upstream-nix \
+    --extra-conf "extra-substituters = https://atuin.cachix.org" \
+    --extra-conf "extra-trusted-public-keys = atuin.cachix.org-1:aNJ8IU+udXIYNtrF+LHH8yIzXqgmva4hVnuHq2REgK0="
   export PATH="/nix/var/nix/profiles/default/bin:$PATH"
   nix --version
 }

Cargo.toml

@@ -49,20 +49,7 @@ crossterm = "0.29"
 crypto_secretbox = "0.1"
 daemonix = "0.1"
 dashmap = "6"
-derive_more = {
-    version = "2",
-    features = [
-        "add",
-        "add_assign",
-        "as_ref",
-        "deref",
-        "display",
-        "error",
-        "from",
-        "into",
-        "debug",
-    ],
-}
+derive_more = { version = "2", features = ["add", "add_assign", "as_ref", "deref", "display", "error", "from", "into", "debug"] }
 dirs = "6"
 divan = "0.1"
 # easy-cast 0.5.5+ raises its MSRV to 1.96.
@@ -125,11 +112,7 @@ rand = { version = "0.8", features = ["std"] }
 ratatui = "0.30"
 ratatui-core = "0.1"
 regex = "1"
-reqwest = {
-    version = "0.13",
-    default-features = false,
-    features = ["json", "native-tls", "stream", "gzip", "zstd"],
-}
+reqwest = { version = "0.13", default-features = false, features = ["json", "native-tls", "stream", "gzip", "zstd"] }
 reqwest-middleware = "0.5"
 rmcp = { version = "3", default-features = false, features = ["server", "transport-io", "schemars"] }
 rmp = "0.8"
@@ -180,10 +163,7 @@ tower-http = { version = "0.6", features = ["trace"] }
 tracing-appender = "0.2"
 tracing-futures = { version = "0.2", features = ["futures-03"] }
 tracing-opentelemetry = "0.33"
-tracing-subscriber = {
-    version = "0.3",
-    features = ["ansi", "fmt", "registry", "env-filter", "json"],
-}
+tracing-subscriber = { version = "0.3", features = ["ansi", "fmt", "registry", "env-filter", "json"] }
 tracing-tree = "0.4"
 tree-sitter = "0.27"
 tree-sitter-bash = "0.25"
@@ -198,15 +178,7 @@ url = { version = "2", features = ["serde"] }
 # Explicitly 1.6 is necessary because the v7 UUID was only added then.
 uuid = { version = "1.6", features = ["v4", "v7", "serde"] }
 whoami = "2"
-windows-sys = {
-    version = "0.61",
-    features = [
-        "Win32_System_Console",
-        "Win32_System_Threading",
-        "Win32_Foundation",
-        "Win32_Storage_FileSystem",
-    ],
-}
+windows-sys = { version = "0.61", features = ["Win32_System_Console", "Win32_System_Threading", "Win32_Foundation", "Win32_Storage_FileSystem"] }
 wiremock = "0.6"
 xxhash-rust = { version = "0.8", features = ["xxh3"] }
 # held at 0.11: 0.12 pulls hashlink 0.12 (a 2nd copy vs sqlx's 0.11) + an encoding_rs/multiversion subtree

atuin.nix

@@ -1,66 +1,74 @@
 # Atuin package definition
 #
-# This file will be similar to the package definition in nixpkgs:
-#     https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/at/atuin/package.nix
+# Built with crane rather than buildRustPackage (as nixpkgs does:
+#     https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/at/atuin/package.nix)
+# so dependencies are cached separately from atuin itself.
 #
-# Helpful documentation: https://github.com/NixOS/nixpkgs/blob/master/doc/languages-frameworks/rust.section.md
+# Helpful documentation: https://crane.dev
 {
   lib,
   stdenv,
   installShellFiles,
-  rustPlatform,
+  craneLib,
   libiconv,
   pkg-config,
   openssl,
 }:
-rustPlatform.buildRustPackage {
-  name = "atuin";
+let
+  # Shared by the dependency-only build and the final build, so the cached
+  # dependency artifacts match what the final build expects.
+  commonArgs = {
+    pname = "atuin";
+    version = (lib.importTOML ./Cargo.toml).workspace.package.version;
 
-  src = lib.cleanSource ./.;
+    src = lib.cleanSource ./.;
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    # Allow dependencies to be fetched from git and avoid having to set the outputHashes manually
-    allowBuiltinFetchGit = true;
+    nativeBuildInputs = [
+      installShellFiles
+      pkg-config
+    ];
+
+    buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
+
+    OPENSSL_NO_VENDOR = 1;
+
+    # native-tls pulls OpenSSL into the sqlx-macros proc-macro, which rustc dlopens at
+    # build time. With OPENSSL_NO_VENDOR it links libssl.so.3 dynamically, so the loader
+    # needs it on LD_LIBRARY_PATH while the proc-macro is loaded.
+    preBuild = ''
+      export LD_LIBRARY_PATH="${lib.makeLibraryPath [ openssl ]}''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+    '';
+
+    doCheck = false;
   };
+in
+craneLib.buildPackage (
+  commonArgs
+  // {
+    # Dependencies build in their own derivation, keyed only on Cargo.toml and
+    # Cargo.lock, so source changes reuse them from the binary cache.
+    cargoArtifacts = craneLib.buildDepsOnly commonArgs;
 
-  nativeBuildInputs = [
-    installShellFiles
-    pkg-config
-  ];
+    # The linked binary records no RPATH for OpenSSL, so once it leaves the build
+    # sandbox it fails with "libssl.so.3: cannot open shared object file". The
+    # build never notices, because LD_LIBRARY_PATH above is still exported when
+    # postInstall runs the binary to generate completions.
+    postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf --add-rpath ${lib.makeLibraryPath [ openssl ]} $out/bin/atuin
+    '';
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
+    postInstall = ''
+      installShellCompletion --cmd atuin \
+        --bash <($out/bin/atuin gen-completions -s bash) \
+        --fish <($out/bin/atuin gen-completions -s fish) \
+        --zsh <($out/bin/atuin gen-completions -s zsh)
+    '';
 
-  OPENSSL_NO_VENDOR = 1;
-
-  # native-tls pulls OpenSSL into the sqlx-macros proc-macro, which rustc dlopens at
-  # build time. With OPENSSL_NO_VENDOR it links libssl.so.3 dynamically, so the loader
-  # needs it on LD_LIBRARY_PATH while the proc-macro is loaded.
-  preBuild = ''
-    export LD_LIBRARY_PATH="${lib.makeLibraryPath [ openssl ]}''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-  '';
-
-  # The linked binary records no RPATH for OpenSSL, so once it leaves the build
-  # sandbox it fails with "libssl.so.3: cannot open shared object file". The
-  # build never notices, because LD_LIBRARY_PATH above is still exported when
-  # postInstall runs the binary to generate completions.
-  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
-    patchelf --add-rpath ${lib.makeLibraryPath [ openssl ]} $out/bin/atuin
-  '';
-
-  postInstall = ''
-    installShellCompletion --cmd atuin \
-      --bash <($out/bin/atuin gen-completions -s bash) \
-      --fish <($out/bin/atuin gen-completions -s fish) \
-      --zsh <($out/bin/atuin gen-completions -s zsh)
-  '';
-
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Replacement for a shell history which records additional commands context with optional encrypted synchronization between machines";
-    homepage = "https://github.com/atuinsh/atuin";
-    license = licenses.mit;
-    mainProgram = "atuin";
-  };
-}
+    meta = with lib; {
+      description = "Replacement for a shell history which records additional commands context with optional encrypted synchronization between machines";
+      homepage = "https://github.com/atuinsh/atuin";
+      license = licenses.mit;
+      mainProgram = "atuin";
+    };
+  }
+)

crates/atuin-server/Cargo.toml

@@ -58,12 +58,7 @@ uuid = { workspace = true }
 # binary crate stays free of server/postgres deps (see issue #2884).
 [dev-dependencies]
 # TODO(taylordotfish): in Rust 1.99 we can change this to `workspace = true`
-atuin-client = {
-    path = "../atuin-client",
-    version = "18.23.0",
-    default-features = false,
-    features = ["sync"],
-}
+atuin-client = { path = "../atuin-client", version = "18.23.0", default-features = false, features = ["sync"] }
 futures-util = { workspace = true }
 regex = { workspace = true }
 rstest = { workspace = true }

docs/docs/guide/installation.md

@@ -95,6 +95,8 @@ If you don't wish to use the installer, the manual installation steps are as fol
     nix profile install "github:atuinsh/atuin"
     ```
 
+    Linux builds of `main` are cached on [Cachix](https://atuin.cachix.org). Run `cachix use atuin` first to download them instead of building from source.
+
 === "Pacman"
 
     Atuin is available in the Arch Linux [extra repository](https://archlinux.org/packages/extra/x86_64/atuin/):

flake.lock

@@ -1,5 +1,20 @@
 {
   "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1790899423,
+        "narHash": "sha256-THGtz65UGJU+sonZidRboyCMk+9DclpMF7pwL4uDV4M=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "47b6b27ed9a3a9181415e4367d0c30ab2a0e0250",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "fenix": {
       "inputs": {
         "nixpkgs": [
@@ -88,6 +103,7 @@
     },
     "root": {
       "inputs": {
+        "crane": "crane",
         "fenix": "fenix",
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",

flake.nix

@@ -2,6 +2,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     flake-parts.url = "github:hercules-ci/flake-parts";
+    crane.url = "github:ipetkov/crane";
     flake-compat = {
       url = "github:edolstra/flake-compat";
       flake = false;
@@ -12,7 +13,12 @@
     };
   };
   outputs =
-    inputs@{ flake-parts, fenix, ... }:
+    inputs@{
+      flake-parts,
+      fenix,
+      crane,
+      ...
+    }:
     flake-parts.lib.mkFlake { inherit inputs; } {
       systems = [
         "x86_64-linux"
@@ -28,10 +34,7 @@
             sha256 = "sha256-P30Tm3O7vQAE725YtDCDHGjNrSsfZO4us11UwJGZSJo=";
           };
           atuin = pkgs.callPackage ./atuin.nix {
-            rustPlatform = pkgs.makeRustPlatform {
-              cargo = toolchain;
-              rustc = toolchain;
-            };
+            craneLib = (crane.mkLib pkgs).overrideToolchain toolchain;
           };
         in
         {