From c6609fee1bbcd9e76485d1da0d8039646c741c9b Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 19 Apr 2026 13:55:06 +0200
Subject: [PATCH] neovim-unwrapped: keep test-only lua modules out of runtime
 closure

Since #509368 flipped doCheck to true, busted/coxpcall/penlight/etc.
are added to neovimLuaEnv, which sits in buildInputs and has its lib
path baked into bin/nvim. busted's wrapper references
luarocks_bootstrap, whose own wrapper carries cmake/zip/unzip on PATH,
so cmake (61M) ends up in neovim's runtime closure.

Split the lua package set: neovimLuaEnv (runtime, in buildInputs)
gets only lpeg/luabitop/mpack; the check-only modules go into
neovimLuaEnvOnBuild (LUA_PRG, build-time only). Add the build env to
disallowedRequisites so this can't regress.

Closure: 192M -> 94M.
---
 pkgs/by-name/ne/neovim-unwrapped/package.nix | 51 ++++++++++++--------
 1 file changed, 31 insertions(+), 20 deletions(-)

diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index 1990d31ae0d8..693d34d9d909 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -64,26 +64,29 @@ stdenv.mkDerivation (
         }))
       else
         luapkgs.lpeg;
-    requiredLuaPkgs =
+    runtimeLuaPkgs = ps: [
+      (nvim-lpeg-dylib ps)
+      ps.luabitop
+      ps.mpack
+    ];
+    checkLuaPkgs =
       ps:
-      (
-        with ps;
-        [
-          (nvim-lpeg-dylib ps)
-          luabitop
-          mpack
-        ]
-        ++ lib.optionals finalAttrs.finalPackage.doCheck [
-          luv
-          coxpcall
-          busted
-          luafilesystem
-          penlight
-          inspect
-        ]
-      );
-    neovimLuaEnv = lua.withPackages requiredLuaPkgs;
-    neovimLuaEnvOnBuild = lua.luaOnBuild.withPackages requiredLuaPkgs;
+      runtimeLuaPkgs ps
+      ++ (with ps; [
+        luv
+        coxpcall
+        busted
+        luafilesystem
+        penlight
+        inspect
+      ]);
+    # neovimLuaEnv ends up in buildInputs and its lib path is baked into the
+    # nvim binary, so it must only contain runtime modules; otherwise
+    # busted -> luarocks -> cmake leak into the runtime closure.
+    neovimLuaEnv = lua.withPackages runtimeLuaPkgs;
+    neovimLuaEnvOnBuild = lua.luaOnBuild.withPackages (
+      if finalAttrs.finalPackage.doCheck then checkLuaPkgs else runtimeLuaPkgs
+    );
     codegenLua =
       if lua.luaOnBuild.pkgs.isLuaJIT then
         let
@@ -207,7 +210,15 @@ stdenv.mkDerivation (
         -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
     '';
     # check that the above patching actually works
-    disallowedRequisites = [ stdenv.cc ] ++ lib.optional (lua != codegenLua) codegenLua;
+    disallowedRequisites = [
+      stdenv.cc
+    ]
+    ++ lib.optional (lua != codegenLua) codegenLua
+    # Ensure test-only lua modules (busted, ...) don't leak into the
+    # runtime closure via LUA_PRG. When doCheck is off (and we're not
+    # cross-compiling) the two envs are the same derivation, hence the
+    # guard.
+    ++ lib.optional (neovimLuaEnvOnBuild != neovimLuaEnv) neovimLuaEnvOnBuild;
 
     cmakeFlags = [
       # Don't use downloaded dependencies. At the end of the configurePhase one