From f58b11edad28c69a000837ef701583b85b7149fc Mon Sep 17 00:00:00 2001 From: Samuel Dionne-Riel Date: Mon, 26 Jan 2026 21:33:41 -0500 Subject: [PATCH] workflows/eval: Ensure NixOS modules meta is valid MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As observed in #484155, it was possible for broken meta information to slip its way into the NixOS modules system. It looks like that data was never checked. At this point I wonder if it ever was *used* in a programmatic manner, given how long it took for it to get noticed. This simple check causes the results to be evaluated in a format that isn't "Nix-brained". Not using `--json` *could* allow `` to be in the output, which is AFAICT undesirable. ``` $ nix-instantiate --strict --eval --expr '{ x = a: a; }' { x = ; } $ nix-instantiate --strict --eval --expr --json '{ x = a: a; }' error: … while evaluating attribute 'x' at «string»:1:3: 1| { x = a: a; } | ^ error: cannot convert a function to JSON at «string»:1:3: 1| { x = a: a; } | ^ ``` --- .github/workflows/eval.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index 7a059230138a..6949cb1ca35b 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -459,3 +459,7 @@ jobs: - name: Query nixpkgs with aliases enabled to check for basic syntax errors run: | time nix-env -I ./nixpkgs/untrusted -f ./nixpkgs/untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null + + - name: Ensure NixOS modules meta is valid + run: | + time nix-instantiate -I ./nixpkgs/untrusted --strict --eval --json ./nixpkgs/untrusted/nixos --arg configuration '{}' --attr config.meta --option restrict-eval true --option allow-import-from-derivation false