tools: improve nix-changes coverage

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: aduh95

.github/workflows/nix-changes.yml

@@ -11,10 +11,12 @@ on:
       - v[0-9]+.x
     paths:
       - '**.nix'
+      - tools/nix/list-requesites.sh
       - .github/workflows/nix-changes.yml
   pull_request:
     paths:
       - '**.nix'
+      - tools/nix/list-requesites.sh
       - .github/workflows/nix-changes.yml
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -47,7 +49,9 @@ jobs:
         with:
           fetch-depth: 2
           persist-credentials: false
-          sparse-checkout: '*.nix'
+          sparse-checkout: |
+            ./tools/nix/list-requesites.sh
+            '*.nix'
           sparse-checkout-cone-mode: false
 
       - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
@@ -60,39 +64,12 @@ jobs:
           name: nodejs
 
       - name: Compute requisites after change
-        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
-        run: |
-          nix-store --query --references "$(
-            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
-              --arg devTools "
-                (import ./tools/nix/devTools.nix {})
-                ++ builtins.attrValues (
-                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
-                  // import ./tools/nix/openssl-matrix.nix {}
-                  // import ./tools/nix/pkcs11.nix {}
-                )")" \
-          | xargs nix-store --realise \
-          | xargs nix-store --query --requisites \
-          | sort -k1.45 \
-          > requisites-${{ matrix.system }}-after.list
+        run: ./tools/nix/list-requesites.sh > requisites-${{ matrix.system }}-after.list
 
       - name: Compute requisites before change
-        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
         run: |
           git reset HEAD^ --hard
-          nix-store --query --references "$(
-            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
-              --arg devTools "
-                (import ./tools/nix/devTools.nix {})
-                ++ builtins.attrValues (
-                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
-                  // import ./tools/nix/openssl-matrix.nix {}
-                  // import ./tools/nix/pkcs11.nix {}
-                )")" \
-          | xargs nix-store --realise \
-          | xargs nix-store --query --requisites \
-          | sort -k1.45 \
-          > requisites-${{ matrix.system }}-before.list
+          ./tools/nix/list-requesites.sh > requisites-${{ matrix.system }}-before.list
 
       - name: Output diff
         run: |

tools/nix/list-requesites.sh

@@ -0,0 +1,70 @@
+#!/bin/sh
+
+set -ex
+
+OPTIONAL_FLAGS=$(nix-instantiate \
+  --eval --strict --json -E '
+    builtins.filter
+      (n: builtins.match "with[A-Z].+" n != null)
+      (builtins.attrNames (builtins.functionArgs (import ./shell.nix)))
+  ' | jq -r 'map("--arg \(.) true") | join(" ")')
+
+PIPEFAIL="$(mktemp)"
+
+cleanup () {
+  EXIT_CODE=$?
+  rm "$PIPEFAIL"
+  exit $EXIT_CODE
+}
+
+trap cleanup INT TERM EXIT
+
+{
+  # shellcheck disable=SC2086
+  nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+    $OPTIONAL_FLAGS \
+    --arg sharedLibDeps '{
+      # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo).
+      # We pass the shared deps as devTools below so they are still accounted for.
+    }' \
+    --arg pkcs11 'import ./tools/nix/pkcs11.nix {
+      # Passing an import call rather than "true" to workaround sharedLibDeps being empty.
+    }' \
+    --arg devTools '
+      let
+        pkgs = import <nixpkgs> { };
+        sharedLibDepsFn = import ./tools/nix/sharedLibDeps.nix;
+      in
+      (import ./tools/nix/devTools.nix { })
+      ++ pkgs.lib.flatten (
+        with (pkgs.callPackage ./tools/nix/v8.nix { });
+        [
+          # We do not want to build V8 here, but still want to list its requisites.
+          buildInputs
+          nativeBuildInputs
+          propagatedBuildInputs
+          propagatedNativeBuildInputs
+          (pkgs.callPackage ./tools/nix/non-v8-deps-mock.nix { })
+        ]
+      )
+      ++ builtins.attrValues (
+        {
+          # Additional packages we are using across the codebase
+          inherit (pkgs) nixfmt-tree sccache;
+        }
+        // import ./tools/nix/openssl-matrix.nix { }
+        // sharedLibDepsFn (
+          pkgs.lib.filterAttrs (n: v: builtins.match "with[A-Z].+" n != null) (
+            builtins.functionArgs sharedLibDepsFn
+          )
+        )
+      )' || echo > "$PIPEFAIL"
+} | {
+  xargs nix-store --query --references || echo > "$PIPEFAIL"
+} | {
+  xargs nix-store --realise || echo > "$PIPEFAIL"
+} | {
+  xargs nix-store --query --requisites || echo > "$PIPEFAIL"
+} | {
+  sort -k1.45 || echo > "$PIPEFAIL"
+} && [ ! -s "$PIPEFAIL" ]