Use nix develop in CI workflows; provide cs in docker image

jupblb · jupblb · commit 0aa9690ca1ff · 2026-05-25T16:19:49.000+02:00
- docker-setup.sh: install coursier as `cs` (with `coursier` symlink)
  so the docker image exposes the `cs` binary expected by the build.
- flake.nix: add an explicit `jdk11` devShell so workflows can use
  `.#jdk${matrix.java}` uniformly.
- Replace actions/setup-java + sbt/setup-sbt + gradle/setup-gradle +
  coursier/setup-action + yarn-installed bazelisk with
  DeterminateSystems/nix-installer-action + magic-nix-cache-action, and
  run all sbt/mvn/bazelisk/cs invocations via `nix develop`.
- BazelBuildTool: detect bazelisk/bazel on PATH at runtime and prefer
  bazelisk (so it respects the project's .bazelversion).
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -18,21 +18,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v4
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: "temurin"
-          cache: "sbt"
-          java-version: ${{ matrix.java }}
+          summarize: false
 
-      - uses: sbt/setup-sbt@v1
-
-      - name: Setup Gradle 8.10
-        uses: gradle/actions/setup-gradle@v4
-        with:
-          gradle-version: '8.10' 
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
 
       - name: Main project tests
-        run: sbt test 
+        run: nix develop .#jdk${{ matrix.java }} --command sbt test
 
   docker_test:
     runs-on: ${{ matrix.os }}
@@ -42,18 +35,16 @@ jobs:
       matrix:
         os: [ubuntu-latest]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v3
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: "temurin"
-          cache: "sbt"
-          java-version: 17
+          summarize: false
 
-      - uses: sbt/setup-sbt@v1
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
 
       - name: Build Dockerised CLI
-        run: DOCKER_BUILDKIT=0 sbt cli/docker
+        run: nix develop .#jdk17 --command bash -c "DOCKER_BUILDKIT=0 sbt cli/docker"
 
       - name: Test repos
         shell: bash
@@ -76,41 +67,46 @@ jobs:
   bazel:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - run: yarn global add @bazel/bazelisk
-      - run: bazel build //... --//semanticdb-javac:enabled=true
-      - run: bazel run scip-semanticdb:bazel -- --sourceroot "$PWD"
+      - uses: actions/checkout@v4
+
+      - uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          summarize: false
+
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
+
+      - run: nix develop --command bazelisk build //... --//semanticdb-javac:enabled=true
+      - run: nix develop --command bazelisk run scip-semanticdb:bazel -- --sourceroot "$PWD"
       - run: du -h index.scip
-      - run: bazel build //... --@scip_java//semanticdb-javac:enabled=true
+      - run: nix develop "$GITHUB_WORKSPACE" --command bazelisk build //... --@scip_java//semanticdb-javac:enabled=true
         working-directory: examples/bazel-example
-      - run: bazel run @scip_java//scip-semanticdb:bazel -- --sourceroot "$PWD"
+      - run: nix develop "$GITHUB_WORKSPACE" --command bazelisk run @scip_java//scip-semanticdb:bazel -- --sourceroot "$PWD"
         working-directory: examples/bazel-example
       - run: du -h index.scip
         working-directory: examples/bazel-example
 
   bazel_aspect:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - run: yarn global add @bazel/bazelisk
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v3
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: "temurin"
-          cache: "sbt"
-          java-version: 17
+          summarize: false
 
-      - uses: sbt/setup-sbt@v1
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
 
-      - run: sbt build
+      - run: nix develop .#jdk17 --command sbt build
       - run: echo "$PWD/out/bin" >> $GITHUB_PATH
       - name: Auto-index scip-java codebase
         run: |
-          scip-java index --build-tool=bazel --bazel-scip-java-binary=$(which scip-java)
+          nix develop .#jdk17 --command bash -c \
+            'scip-java index --build-tool=bazel --bazel-scip-java-binary=$(which scip-java)'
       - run: du -h index.scip
       - name: Auto-index example/bazel-workspace
         run: |
-          scip-java index --build-tool=bazel --bazel-scip-java-binary=$(which scip-java)
+          nix develop .#jdk17 --command bash -c \
+            'scip-java index --build-tool=bazel --bazel-scip-java-binary=$(which scip-java)'
         working-directory: examples/bazel-example
       - run: du -h index.scip
         working-directory: examples/bazel-example
@@ -121,19 +117,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v4
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: "temurin"
-          cache: "sbt"
-          java-version: 11
+          summarize: false
 
-      - uses: sbt/setup-sbt@v1
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
 
       - name: semanticdb-kotlinc tests
-        run: sbt semanticdbKotlinc/test
+        run: nix develop .#jdk11 --command sbt semanticdbKotlinc/test
 
       - name: Kotlin snapshots
-        run: sbt semanticdbKotlincMinimized/kotlincSnapshots
+        run: nix develop .#jdk11 --command sbt semanticdbKotlincMinimized/kotlincSnapshots
 
       - name: Check snapshot drift
         run: |
@@ -143,20 +137,18 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v3
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: "temurin"
-          java-version: 11
-          cache: "sbt"
+          summarize: false
 
-      - uses: sbt/setup-sbt@v1
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
 
-      - run: sbt --client checkAll
+      - run: nix develop .#jdk11 --command sbt --client checkAll
 
       - name: Run sample benchmarks
-        run: sbt --client 'bench/Jmh/run -i 1 -f1 -t1 -foe true'
+        run: nix develop .#jdk11 --command sbt --client 'bench/Jmh/run -i 1 -f1 -t1 -foe true'
 
 
   maven:
@@ -169,24 +161,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v4
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: "temurin"
-          cache: "sbt"
-          java-version: ${{ matrix.java }}
+          summarize: false
 
-      - uses: sbt/setup-sbt@v1
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
 
       - run: |
-          sbt build publishM2 publishLocal dumpScipJavaVersion
+          nix develop .#jdk${{ matrix.java }} --command sbt build publishM2 publishLocal dumpScipJavaVersion
           echo "SCIP_JAVA_VERSION=$(cat VERSION)" >> $GITHUB_ENV
           echo "SCIP_JAVA_CLI=$PWD/out/bin/scip-java" >> $GITHUB_ENV
 
       - run: |
-          mvn clean verify -DskipTests -Dscip-java.version=$SCIP_JAVA_VERSION sourcegraph:sourcegraphDependencies
+          nix develop "$GITHUB_WORKSPACE#jdk${{ matrix.java }}" --command \
+            mvn clean verify -DskipTests -Dscip-java.version=$SCIP_JAVA_VERSION sourcegraph:sourcegraphDependencies
         working-directory: examples/maven-example
 
-      - run: $SCIP_JAVA_CLI index-semanticdb target/semanticdb-targetroot
+      - run: nix develop "$GITHUB_WORKSPACE#jdk${{ matrix.java }}" --command $SCIP_JAVA_CLI index-semanticdb target/semanticdb-targetroot
         working-directory: examples/maven-example
 
       - run: |
diff --git a/.github/workflows/mdoc.yml b/.github/workflows/mdoc.yml
@@ -7,15 +7,13 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v3
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: 'temurin'
-          java-version: 11
-          cache: 'sbt'
-      - uses: sbt/setup-sbt@v1
-      - run: sbt docs/docusaurusPublishGhpages
+          summarize: false
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
+      - run: nix develop .#jdk11 --command sbt docs/docusaurusPublishGhpages
         env:
           GIT_DEPLOY_KEY: ${{ secrets.GIT_DEPLOY_KEY }}
diff --git a/.github/workflows/release-cli.yml b/.github/workflows/release-cli.yml
@@ -13,18 +13,19 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: nix develop .#jdk11 --command bash -e {0}
     steps:
-      - uses: actions/setup-java@v4
-        with:
-          distribution: 'temurin'
-          java-version: 11
+      - uses: actions/checkout@v4
 
-      - uses: coursier/setup-action@v3
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          apps: ''
+          summarize: false
+
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
 
       - name: Build standalone launcher
-        shell: bash
         env:
           OUT_DIR: ${{ runner.temp }}/release-cli
           TAG: ${{ inputs.tag }}
@@ -67,7 +68,6 @@ jobs:
 
       - name: Check for GitHub release
         id: release
-        shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ inputs.tag }}
@@ -83,7 +83,6 @@ jobs:
 
       - name: Upload release assets
         if: steps.release.outputs.exists == 'true'
-        shell: bash
         env:
           OUT_DIR: ${{ runner.temp }}/release-cli
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml
@@ -8,19 +8,17 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v3
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: 'temurin'
-          java-version: 11
-          cache: 'sbt'
-      - uses: sbt/setup-sbt@v1
-      - uses: docker/setup-buildx-action@v1
+          summarize: false
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
+      - uses: docker/setup-buildx-action@v3
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - run: DOCKER_BUILDKIT=0 sbt cli/dockerBuildAndPush
+      - run: nix develop .#jdk11 --command bash -c "DOCKER_BUILDKIT=0 sbt cli/dockerBuildAndPush"
diff --git a/.github/workflows/release-maven.yml b/.github/workflows/release-maven.yml
@@ -8,17 +8,15 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v3
+      - uses: DeterminateSystems/nix-installer-action@v22
         with:
-          distribution: 'temurin'
-          java-version: 11
-          cache: 'sbt'
-      - uses: sbt/setup-sbt@v1
+          summarize: false
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
       - name: Publish ${{ github.ref }}
-        run: sbt ci-release
+        run: nix develop .#jdk11 --command sbt ci-release
         env:
           PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
           PGP_SECRET: ${{ secrets.PGP_SECRET }}
diff --git a/bin/docker-setup.sh b/bin/docker-setup.sh
@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 set -eux
-curl -fLo /usr/local/bin/coursier https://github.com/coursier/coursier/releases/download/v2.1.5/coursier
-chmod +x /usr/local/bin/coursier
-coursier setup --yes --apps coursier,sbt
+curl -fLo /usr/local/bin/cs https://github.com/coursier/coursier/releases/download/v2.1.5/coursier
+chmod +x /usr/local/bin/cs
+ln -sf /usr/local/bin/cs /usr/local/bin/coursier
+cs setup --yes --apps cs,coursier,sbt
 
 curl -fLo maven.zip https://archive.apache.org/dist/maven/maven-3/3.9.1/binaries/apache-maven-3.9.1-bin.zip 
 unzip -d /opt/maven maven.zip
diff --git a/flake.nix b/flake.nix
@@ -53,6 +53,7 @@
 
         devShells = {
           default = mkDevShell pkgs.jdk11;
+          jdk11 = mkDevShell pkgs.jdk11;
           jdk17 = mkDevShell pkgs.jdk17;
           jdk21 = mkDevShell pkgs.jdk21;
         };
diff --git a/scip-java/src/main/scala/com/sourcegraph/scip_java/buildtools/BazelBuildTool.scala b/scip-java/src/main/scala/com/sourcegraph/scip_java/buildtools/BazelBuildTool.scala
@@ -5,6 +5,7 @@ import java.nio.file.FileSystems
 import java.nio.file.FileVisitResult
 import java.nio.file.Files
 import java.nio.file.Path
+import java.nio.file.Paths
 import java.nio.file.SimpleFileVisitor
 import java.nio.file.StandardOpenOption
 import java.nio.file.attribute.BasicFileAttributes
@@ -31,6 +32,21 @@ class BazelBuildTool(index: IndexCommand) extends BuildTool("Bazel", index) {
     else
       index.buildCommand
 
+  // Prefer `bazelisk` over `bazel` when both are available: bazelisk respects
+  // the project's `.bazelversion`, while `bazel` may be a pinned system version.
+  private def bazelExecutable: String = {
+    val pathDirs = sys
+      .env
+      .getOrElse("PATH", "")
+      .split(java.io.File.pathSeparator)
+      .toList
+    List("bazelisk", "bazel")
+      .find { name =>
+        pathDirs.exists(dir => Files.isExecutable(Paths.get(dir, name)))
+      }
+      .getOrElse("bazel")
+  }
+
   override def generateScip(): Int = {
     val aspectLabel = this.generateAspectFile().getOrElse("")
     if (aspectLabel.isEmpty) {
@@ -60,7 +76,7 @@ class BazelBuildTool(index: IndexCommand) extends BuildTool("Bazel", index) {
 
     val buildCommand =
       List(
-        "bazel",
+        bazelExecutable,
         "build",
         "--noshow_progress",
         // The local strategy is required for now because we write SemanticDB and SCIP files
