Narrow sudoers to runAs=root

[auto-upgrade-with-pinch] / overlays / pinch.nix

diff --git a/overlays/pinch.nix b/overlays/pinch.nix
index 29d229385d9f48ae2f530e4cd768a7d9b4e21869..d71672068917bbd625fe67347a71e00bc3f1996f 100644 (file)
--- a/overlays/pinch.nix
+++ b/overlays/pinch.nix
@@ -1,14 +1,66 @@
-self: super: {
-  pinch = if builtins.hasAttr "pinch" super then
-    super.pinch
-  else
-    super.writeShellScriptBin "pinch" ''
-      exec ${self.python3}/bin/python3 ${
-        super.fetchgit {
-          url = "https://scottworley.com/pinch.git";
-          rev = "1.3";
-          sha256 = "1l2pq0pqmjh5q8ggmz6sw6bz0nnz0jy92l5qgax8bmpm1qcszmxf";
-        }
-      }/pinch.py "$@"
-    '';
+self: super:
+let
+  fallback-git-cache = self.python3Packages.callPackage (
+    {
+      buildPythonPackage,
+      fetchgit,
+      setuptools,
+      git,
+      backoff,
+      mypy,
+    }:
+    buildPythonPackage rec {
+      pname = "git-cache";
+      version = "1.5.0";
+      src = fetchgit {
+        url = "https://git.scottworley.com/pub/git/git-cache";
+        rev = "v${version}";
+        hash = "sha256-g4TS/zX3e29Q3ThsCAX2wLLlYbi8fdux5uqAc+b/Oww=";
+      };
+      pyproject = true;
+      build-system = [ setuptools ];
+      propagatedBuildInputs = [ backoff ];
+      nativeCheckInputs = [
+        git
+        mypy
+      ];
+      doCheck = true;
+      checkPhase = "./test.sh";
+    }
+  ) { };
+
+  fallback-pinch = self.python3Packages.callPackage (
+    {
+      buildPythonPackage,
+      fetchgit,
+      setuptools,
+      nix,
+      git,
+      mypy,
+      git-cache,
+    }:
+    buildPythonPackage rec {
+      pname = "pinch";
+      version = "3.3.2";
+      src = fetchgit {
+        url = "https://git.scottworley.com/pub/git/pinch";
+        rev = "v${version}";
+        hash = "sha256-UB1hAEX7bD2TfdDv5EOWH1aaLluvzvpW80EjdCBuCCU=";
+      };
+      pyproject = true;
+      build-system = [ setuptools ];
+      propagatedBuildInputs = [ git-cache ];
+      nativeCheckInputs = [
+        nix
+        git
+        mypy
+      ];
+      doCheck = true;
+      checkPhase = "./test.sh";
+    }
+  ) { git-cache = self.python3Packages.git-cache or fallback-git-cache; };
+
+in
+{
+  pinch = super.pinch or fallback-pinch;
 }