From a70ab58960c254c58c5289b18b769c9d2311dce7 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 26 Jun 2024 01:07:09 +0200
Subject: [PATCH] root: shell.nix for nixfmt

This uses the reusable pinned Nixpkgs from the parent commit to create a
shell.nix file for an environment with a pinned nixfmt version.
---
 .github/CODEOWNERS                |  3 ++-
 .github/workflows/check-shell.yml | 29 +++++++++++++++++++++++++++++
 shell.nix                         | 30 ++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/check-shell.yml
 create mode 100644 shell.nix

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 89d8d57cd73d..ebdefd539999 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -15,8 +15,9 @@
 /.github/workflows @NixOS/Security @Mic92 @zowoq
 /ci @infinisil
 
-# EditorConfig
+# Develompent support
 /.editorconfig @Mic92 @zowoq
+/shell.nix @infinisil @NixOS/Security
 
 # Libraries
 /lib                        @infinisil
diff --git a/.github/workflows/check-shell.yml b/.github/workflows/check-shell.yml
new file mode 100644
index 000000000000..01ea97dfff20
--- /dev/null
+++ b/.github/workflows/check-shell.yml
@@ -0,0 +1,29 @@
+name: "Check shell"
+
+on:
+  pull_request_target:
+
+permissions: {}
+
+jobs:
+  x86_64-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      - name: Build shell
+        run: nix-build shell.nix
+
+  aarch64-darwin:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      - name: Build shell
+        run: nix-build shell.nix
diff --git a/shell.nix b/shell.nix
new file mode 100644
index 000000000000..d9e94eb2816d
--- /dev/null
+++ b/shell.nix
@@ -0,0 +1,30 @@
+# A shell to get tooling for Nixpkgs development
+#
+# Note: We intentionally don't use Flakes here,
+# because every time you change any file and do another `nix develop`,
+# it would create another copy of the entire ~500MB tree in the store.
+# See https://github.com/NixOS/nix/pull/6530 for the future
+{
+  system ? builtins.currentSystem,
+}:
+let
+  pinnedNixpkgs = builtins.fromJSON (builtins.readFile ci/pinned-nixpkgs.json);
+
+  nixpkgs = fetchTarball {
+    url = "https://github.com/NixOS/nixpkgs/archive/${pinnedNixpkgs.rev}.tar.gz";
+    sha256 = pinnedNixpkgs.sha256;
+  };
+
+  pkgs = import nixpkgs {
+    inherit system;
+    config = {};
+    overlays = [];
+  };
+in
+pkgs.mkShellNoCC {
+  packages = [
+    # The default formatter for Nix code
+    # https://github.com/NixOS/nixfmt
+    pkgs.nixfmt-rfc-style
+  ];
+}