feat: add initial NUR repository setup - #1
Conversation
|
Warning Review limit reached
Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (11)
📝 WalkthroughWalkthroughThis change establishes a Nix repository for Mailtrap tooling, packages ChangesMailtrap package foundation
Nix exports and overlays
CI package selection and builds
Documentation and licensing
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-authored-by: Cursor <cursoragent@cursor.com>
ace337f to
a449fc7
Compare
| @@ -0,0 +1,58 @@ | |||
| # This file was generated by GoReleaser. DO NOT EDIT. | |||
There was a problem hiding this comment.
This file would be typically updated by PR from GoReleaser, but for now we're seeding the current version as is to have the package present.
Once the pipeline is fully in place we'll make a new release to do it properly.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
33-43: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winExercise the flake interface in CI.
The current checks only evaluate
default.nixandci.nix; they can pass whileflake.nixoutputs are broken. Add anix flake checkor targeted flake evaluation after fixing the system mismatch.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml around lines 33 - 43, Add a CI step after resolving the system mismatch that runs `nix flake check` (or an equivalent targeted evaluation) against the repository’s flake interface. Keep the existing `Check evaluation` and `Build nix packages` steps intact while ensuring flake outputs are exercised during workflow validation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Around line 22-30: Update the checkout step using actions/checkout@v5 to set
persist-credentials to false, and restrict the workflow’s permissions to
read-only where possible while preserving the existing build behavior.
In `@flake.nix`:
- Around line 7-17: Restrict the forAllSystems systems list used by
legacyPackages and packages to the four platforms declared in mailtrap-local’s
meta.platforms, rather than iterating over nixpkgs.lib.systems.flakeExposed.
Update the shared system-attribute generation near forAllSystems so unsupported
targets cannot evaluate urlMap.${system}; preserve the existing package
filtering and per-system imports for supported platforms.
In `@README.md`:
- Around line 21-40: Update the README flake example’s outputs attrset to expose
mailtrap-local as an actual package output, using the existing
pkgs.mailtrap-local package and the configured system attribute so copied flakes
can build or run it.
- Around line 52-57: Update the non-flake Nix example around the mailtrap
binding so the mailtrap assignment is valid top-level syntax, wrapping it in a
let...in expression or attribute set while preserving the existing pkgs
inheritance and mailtrap.mailtrap-local usage.
---
Nitpick comments:
In @.github/workflows/build.yml:
- Around line 33-43: Add a CI step after resolving the system mismatch that runs
`nix flake check` (or an equivalent targeted evaluation) against the
repository’s flake interface. Keep the existing `Check evaluation` and `Build
nix packages` steps intact while ensuring flake outputs are exercised during
workflow validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 09b726da-1221-494b-99c4-fc323c2f7946
⛔ Files ignored due to path filters (1)
flake.lockis excluded by!**/*.lock
📒 Files selected for processing (11)
.github/workflows/build.ymlLICENSEREADME.mdci.nixdefault.nixflake.nixlib/default.nixnixos-modules/default.nixoverlay.nixoverlays/default.nixpkgs/mailtrap-local/default.nix
| - name: Checkout repository | ||
| uses: actions/checkout@v5 | ||
| - name: Install nix | ||
| uses: cachix/install-nix-action@v31 | ||
| with: | ||
| nix_path: "${{ matrix.nixPath }}" | ||
| extra_nix_config: | | ||
| experimental-features = nix-command flakes | ||
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate workflow =="
fd -a 'build.yml$' .github/workflows 2>/dev/null || true
echo "== build.yml relevant lines =="
if [ -f .github/workflows/build.yml ]; then
nl -ba .github/workflows/build.yml | sed -n '1,140p'
fi
echo "== workflow files outline =="
if [ -d .github/workflows ]; then
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$f" ] || continue
echo "--- $f ---"
rg -n "pull_request|push|permissions:|contents:|actions/checkout|persist-credentials|cabix/install-nix-action|nixPath|nix|eval" "$f" || true
done
fiRepository: mailtrap/mailtrap-nur
Length of output: 302
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== build.yml contents =="
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/build.yml
echo "== workflow permissions and triggers =="
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$f" ] || continue
echo "--- $f ---"
awk '{printf "%6d %s\n", NR, $0}' "$f"
done
echo "== pull_request refs in workflows =="
grep -RInE "pull_request:|pull requests|pull_request" .github/workflows || trueRepository: mailtrap/mailtrap-nur
Length of output: 3915
🌐 Web query:
actions/checkout persist-credentials default pull_request cache token persisted git config user
💡 Result:
In the actions/checkout GitHub Action, persist-credentials is a boolean configuration option that determines whether the authentication token or SSH key used to fetch the repository is configured within the local git config [1][2]. The default value for persist-credentials is true [1][3]. When enabled, this allows subsequent steps in your GitHub Actions workflow to run authenticated git commands (such as git push or git fetch) without needing to manually re-authenticate [1][4]. Regarding technical implementation and security: - Historical Behavior: In earlier versions of the action, these credentials were saved directly into the local.git/config file [1][5]. - Recent Updates (v6+): Starting with version 6.0.0, the action was updated to store these credentials in a separate file under the $RUNNER_TEMP directory instead of the local git config, providing improved credential security [1][5]. - Lifecycle: The persisted credentials are automatically removed during the post-job cleanup step [1][4]. - Opt-out: You can disable this behavior by explicitly setting persist-credentials to false in your workflow definition [1][4]. - Cache Warning: It is important to distinguish this from GitHub's cache action. Users are strictly advised not to store sensitive information, such as access tokens or credentials, in cached paths, as these caches may be accessible by anyone with read access to the repository, including those who can open pull requests [6].
Citations:
- 1: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 2: https://github.com/actions/checkout/blob/de0fac2e4500dabe0009e67214ff5f5447ce83dd/action.yml
- 3: https://github.com/actions/checkout/blob/cbb722410c2e876e24abbe8de2cc27693e501dcb/action.yml
- 4: https://github.com/marketplace/actions/checkout?version=v3.6.0
- 5: actions/checkout@v5.0.1...v6.0.0
- 6: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching
🌐 Web query:
actions/checkout v5 default persist-credentials input documentation
💡 Result:
In actions/checkout v5, the persist-credentials input has a default value of true [1][2]. This setting determines whether the authentication token or SSH key used to check out the repository is configured in the local git configuration [3][4]. When enabled (true), it allows your workflow scripts to execute authenticated git commands (such as git fetch or git push) automatically [3][5]. The token is removed during the post-job cleanup phase [3][5]. To opt out of this behavior, you can set persist-credentials to false in your workflow file [3][5].
Citations:
- 1: https://git.liteyuki.org/actions/checkout/src/tag/v5.0.1/action.yml
- 2: https://git.woni.link/actions/checkout/src/branch/releases/v5/action.yml
- 3: https://git.liteyuki.org/actions/checkout/src/tag/v5/README.md
- 4: https://github.com/actions/checkout/blob/cbb722410c2e876e24abbe8de2cc27693e501dcb/action.yml
- 5: https://github.com/marketplace/actions/checkout?version=v3.6.0
Disable checkout credential persistence.
This workflow runs on pull requests and evaluates repository-controlled Nix code. Set actions/checkout to persist-credentials: false and narrow workflow permissions to read-only where possible.
Proposed fix
- name: Checkout repository
uses: actions/checkout@v5
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@v5 | |
| - name: Install nix | |
| uses: cachix/install-nix-action@v31 | |
| with: | |
| nix_path: "${{ matrix.nixPath }}" | |
| extra_nix_config: | | |
| experimental-features = nix-command flakes | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} | |
| - name: Checkout repository | |
| uses: actions/checkout@v5 | |
| with: | |
| persist-credentials: false | |
| - name: Install nix | |
| uses: cachix/install-nix-action@v31 | |
| with: | |
| nix_path: "${{ matrix.nixPath }}" | |
| extra_nix_config: | | |
| experimental-features = nix-command flakes | |
| access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build.yml around lines 22 - 30, Update the checkout step
using actions/checkout@v5 to set persist-credentials to false, and restrict the
workflow’s permissions to read-only where possible while preserving the existing
build behavior.
Source: Linters/SAST tools
| ```nix | ||
| { | ||
| inputs = { | ||
| nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; | ||
| mailtrap-nur.url = "github:mailtrap/mailtrap-nur"; | ||
| }; | ||
|
|
||
| outputs = { nixpkgs, mailtrap-nur, ... }: | ||
| let | ||
| system = "aarch64-darwin"; # or x86_64-linux, … | ||
| pkgs = import nixpkgs { | ||
| inherit system; | ||
| overlays = [ mailtrap-nur.overlays.default ]; | ||
| }; | ||
| in | ||
| { | ||
| # pkgs.mailtrap-local | ||
| }; | ||
| } | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Expose the package in the flake example.
As written, the example’s outputs attrset contains no actual package output; # pkgs.mailtrap-local is only a comment. A user copying this snippet cannot build or run mailtrap-local from the resulting flake.
Proposed fix
- outputs = { nixpkgs, mailtrap-nur, ... }:
+ outputs = { nixpkgs, mailtrap-nur, ... }:
let
system = "aarch64-darwin"; # or x86_64-linux, …
pkgs = import nixpkgs {
inherit system;
overlays = [ mailtrap-nur.overlays.default ];
};
in
{
- # pkgs.mailtrap-local
+ packages.${system}.mailtrap-local = pkgs.mailtrap-local;
+ packages.${system}.default = pkgs.mailtrap-local;
};📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ```nix | |
| { | |
| inputs = { | |
| nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; | |
| mailtrap-nur.url = "github:mailtrap/mailtrap-nur"; | |
| }; | |
| outputs = { nixpkgs, mailtrap-nur, ... }: | |
| let | |
| system = "aarch64-darwin"; # or x86_64-linux, … | |
| pkgs = import nixpkgs { | |
| inherit system; | |
| overlays = [ mailtrap-nur.overlays.default ]; | |
| }; | |
| in | |
| { | |
| # pkgs.mailtrap-local | |
| }; | |
| } | |
| ``` |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 21 - 40, Update the README flake example’s outputs
attrset to expose mailtrap-local as an actual package output, using the existing
pkgs.mailtrap-local package and the configured system attribute so copied flakes
can build or run it.
| ```nix | ||
| mailtrap = import (builtins.fetchTarball "https://github.com/mailtrap/mailtrap-nur/archive/main.tar.gz") { | ||
| inherit pkgs; | ||
| }; | ||
| # mailtrap.mailtrap-local | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make the non-flake example valid Nix syntax.
The assignment cannot appear at the top level as shown. Wrap it in let ... in (or an attribute set) so users can copy the example directly.
Proposed fix
- mailtrap = import (builtins.fetchTarball "https://github.com/mailtrap/mailtrap-nur/archive/main.tar.gz") {
- inherit pkgs;
- };
- # mailtrap.mailtrap-local
+ let
+ mailtrap = import (builtins.fetchTarball "https://github.com/mailtrap/mailtrap-nur/archive/main.tar.gz") {
+ inherit pkgs;
+ };
+ in
+ mailtrap.mailtrap-local🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 52 - 57, Update the non-flake Nix example around the
mailtrap binding so the mailtrap assignment is valid top-level syntax, wrapping
it in a let...in expression or attribute set while preserving the existing pkgs
inheritance and mailtrap.mailtrap-local usage.
2 participants
What & why
Bootstrap a Mailtrap NUR-style Nix package repo so we can distribute
mailtrap-local(and later other tools) via Nix, with release updates driven from goreleaser.default.nix, flake, overlay, CI eval/build workflow.mailtrap-localas a prebuilt GitHub Releases package (same artifacts as Homebrew), owned by goreleaser PRs on each tag.How to test
nix build github:mailtrap/mailtrap-nur/chore/initial-nur-setup#mailtrap-local(or clone this branch andnix build .#mailtrap-local)./result/bin/mailtrap-local --versionprints0.2.0Summary by CodeRabbit
New Features
Documentation
Chores