···231231 # We resolve $(pwd) to get the absolute workspace path.
232232 WORKSPACE="$(pwd)"
233233234234+ # In a Nixery container, <nixpkgs> is NOT on NIX_PATH by default.
235235+ # We need to discover the nixpkgs path from the Nix store.
236236+ # Nixery builds images from a pinned nixpkgs checkout that lives in
237237+ # the store. We find it by tracing any installed package back to its
238238+ # nixpkgs source.
239239+ echo "=== Discovering nixpkgs path ==="
240240+ NIXPKGS_PATH=""
241241+242242+ # Method 1: Check if NIX_PATH is already set and valid
243243+ if [ -n "${NIX_PATH:-}" ]; then
244244+ echo "NIX_PATH is set: ${NIX_PATH}"
245245+ NIXPKGS_PATH=$(echo "$NIX_PATH" | tr ':' '\n' | grep 'nixpkgs=' | head -1 | sed 's/nixpkgs=//')
246246+ fi
247247+248248+ # Method 2: Find nixpkgs in the Nix store via a known package derivation
249249+ if [ -z "$NIXPKGS_PATH" ] || [ ! -d "$NIXPKGS_PATH" ]; then
250250+ echo "Searching Nix store for nixpkgs source..."
251251+ # nix-instantiate --find-file resolves <nixpkgs> but only if NIX_PATH is set.
252252+ # Instead, find the nixpkgs checkout that Nixery used by looking at
253253+ # the .drv files for a package we know is installed (coreutils).
254254+ NIXPKGS_PATH=$(find /nix/store -maxdepth 1 -name '*-nixpkgs-src' -type d 2>/dev/null | head -1)
255255+ fi
256256+257257+ # Method 3: Look for a channel-style nixpkgs directory
258258+ if [ -z "$NIXPKGS_PATH" ] || [ ! -d "$NIXPKGS_PATH" ]; then
259259+ NIXPKGS_PATH=$(find /nix/store -maxdepth 1 -name '*-nixos-*' -type d 2>/dev/null | grep -v '\.drv$' | head -1)
260260+ fi
261261+262262+ # Method 4: Find any path containing a top-level pkgs/top-level/all-packages.nix
263263+ if [ -z "$NIXPKGS_PATH" ] || [ ! -d "$NIXPKGS_PATH" ]; then
264264+ NIXPKGS_PATH=$(find /nix/store -maxdepth 3 -path '*/pkgs/top-level/all-packages.nix' 2>/dev/null | head -1 | sed 's|/pkgs/top-level/all-packages.nix||')
265265+ fi
266266+267267+ # Method 5: Use nix-instantiate --eval to locate nixpkgs from the registry
268268+ if [ -z "$NIXPKGS_PATH" ] || [ ! -d "$NIXPKGS_PATH" ]; then
269269+ echo "Trying nix-instantiate with flake registry..."
270270+ NIXPKGS_PATH=$(nix-instantiate --eval -E 'builtins.fetchTarball { url = "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz"; }' 2>/dev/null | tr -d '"') || true
271271+ fi
272272+273273+ if [ -z "$NIXPKGS_PATH" ] || [ ! -d "$NIXPKGS_PATH" ]; then
274274+ echo "ERROR: Could not discover nixpkgs in the Nix store."
275275+ echo "Contents of /nix/store (first 30 entries):"
276276+ ls /nix/store | head -30
277277+ echo ""
278278+ echo "Attempting build with -I nixpkgs=channel:nixos-unstable as fallback..."
279279+ NIXPKGS_FLAG="-I nixpkgs=channel:nixos-unstable"
280280+ PKG_ARG="import <nixpkgs> {}"
281281+ else
282282+ echo "Found nixpkgs at: ${NIXPKGS_PATH}"
283283+ NIXPKGS_FLAG=""
284284+ PKG_ARG="import ${NIXPKGS_PATH} {}"
285285+ fi
286286+234287 nix-build nix/docker-image.nix \
235235- --arg pkgs 'import <nixpkgs> {}' \
288288+ --arg pkgs "$PKG_ARG" \
236289 --argstr appVersion "${SHORT_SHA}" \
237290 --arg venvPath "${WORKSPACE}/.venv" \
238291 --arg appSrc "${WORKSPACE}" \
239292 --out-link result \
240293 --show-trace \
241241- --option sandbox false
294294+ --option sandbox false \
295295+ ${NIXPKGS_FLAG}
242296243297 echo ""
244298 echo "=== Build complete ==="
+7-1
care/CLAUDE.md
···428428- Flake is pinned to `nixos-unstable` (rev `5e2a59a5b1a82f89f2c7e598302a9cacebb72a67`)
429429- Python 3.13 is available in this channel
430430- All packages referenced in the dev shell are available
431431-- In CI, `nix-build` uses `<nixpkgs>` from the Nixery environment (which also uses nixpkgs)
431431+- In CI (Nixery), `<nixpkgs>` is **NOT** on `NIX_PATH` — the `nix-build` step must
432432+ discover the nixpkgs store path at runtime and pass it as an absolute path via
433433+ `--arg pkgs 'import /nix/store/…-source {}'`. The build step uses a multi-method
434434+ discovery sequence (check `NIX_PATH`, search for `*-nixpkgs-src`, search for
435435+ `*-nixos-*`, locate `pkgs/top-level/all-packages.nix`, and finally fall back to
436436+ `-I nixpkgs=channel:nixos-unstable`). Using the bare `import <nixpkgs> {}` form
437437+ will fail with `error: file 'nixpkgs' was not found in the Nix search path`.
432438433439---
434440