Generate the package list from pkgs/ instead of a sed script

[tashian]

Fixes EFF-623.

NixOS customers cannot install any release from 0.68.0 through 0.69.1-rc1 by attribute, including current stable 0.69.0. The derivation files are on disk and build fine; they just have no name in default.nix.

Root cause

addpkg.sh never learned which release triggered it. It registered whichever file sorted highest:

pkg_with_version=$(basename $(ls -1 pkgs/${pkg}/${pkg}_* | sort -Vr | head -n 1) .nix)

Once 0.70.0-rc1 landed on 07-25, every subsequent release on the 0.69 line saw it as the max, found it already registered, added nothing, and left git add default.nix && git commit to fail on a clean tree. From the 0.69.0 run:

Non stable release step-agent_0.70.0-rc1, skipping default package update.
nothing to commit, working tree clean
##[error]Process completed with exit code 1.

Four build.yml runs are red for exactly this (07-27, 07-30, 07-31, 08-01).

Two further faults compounded it:

• sort -V ranks 0.68.0-rc1 above 0.68.0, so a stable release could be skipped in favour of its own release candidate — which is why step-agent_0_68_0-rc1 is registered but 0.68.0 is not.
• The stable-release check tested _[0-9]+_[0-9]+_[0-9]+$ against a dotted filename (step-agent_0.69.0). It can never match, so the script always printed "Non stable release" and returned before touching the default attribute. That branch has never once executed, which is why the bare step-agent attribute is frozen at 0.65.0-rc11 and only resolves at all because the step-agent-plugin → step-agent repo redirect is still up.
• The release-check gate's regex has no -dev alternation, so dev → rc promotion commits skipped the job outright. Those runs are green, which is why this never looked broken.

Fix

default.nix now reads pkgs/<name>/ directly. The attribute set cannot drift from what goreleaser committed, so the 21 orphaned derivations register themselves and no future release can be missed. The unsuffixed step-agent resolves to the highest stable version via builtins.compareVersions — currently 0.69.0, sourced from smallstep/step-agent directly rather than through the old redirect.

addpkg.sh and the add-pkg job are deleted. With the commit-back step gone, the release-check gate that guarded it has no remaining purpose, so the nix evaluation and build now run on pull requests instead of only on goreleaser release commits. That is the "fail loudly next time" coverage the ticket asked for, and it is what would catch a broken generator.

Four derivations are pruned: two 0.0.0-nightly.* and two 0.64.0-dev*. All four point at smallstep/agent release assets that now 404, so registering them would turn CI red. Nightly and dev artifacts go to nur-dev.

Verification

Run in a nixos/nix container against this branch:

• CI's exact eval command (nix-env -f . -qa with --option restrict-eval true) returns 49 items. builtins.readDir working under restricted eval was the one real unknown.
• nix-build ci.nix -A cacheOutputs exits 0 with 48 store paths, including the 17 previously-orphaned derivations CI had never built. 0.65.0, 0.68.0 and 0.69.0 all build.
• step-agent evaluates to step-agent-plugin-0.69.0.
• Every source URL across all 48 remaining files returns 200.

Also here

Action CI had failed at workflow-creation time on every run since 2026-05-25, so actionlint and zizmor were not examining this repo at all — including the workflow rewritten above. smallstep/workflows f47abc3 gave the reusable zizmor job actions: read, and a reusable workflow cannot be granted more than its caller has; this caller granted only contents: read and security-events: write, so the run was rejected before any job existed. That reports as startup_failure with no jobs and no annotations, which is why it never surfaced as a failing check. gateway, inventory and agent all grant the full set.

With the linter running again it immediately flagged SC2046 and SC2086 on the evaluation step, both carried over unchanged from the previous workflow. Quoting them is behaviour-preserving on the runner.

Notes for review

• Conflicts with Add the step-agent NixOS module, and align with the upstream NUR layout #17, which renames modules → nixos-modules in the same header block. I kept main's spelling verbatim. Suggest merging this first — Add the step-agent NixOS module, and align with the upstream NUR layout #17's tests check is currently SKIPPED, so it would otherwise merge with no nix evaluation at all; after this lands it gets real PR coverage.
• Evaluating through flake.nix fails with Function called without required argument "tpm2-openssl". This reproduces identically on unmodified main — flake.lock pins nixpkgs from April 2024, before that package existed. Out of scope here; flake.lock lockstep #13 is aimed at it.

🤖 Generated with Claude Code