feat: add nix flake for reproducible builds#162

classic-ally

Summary

Adds a flake.nix that exposes the CLI as a Nix package. Nix users can install or run the CLI directly from this repository without Homebrew or npm, with reproducibility on Linux, macOS, and other Unix-like systems.

nix build github:kernel/cli                # produces ./result/bin/kernel
nix run  github:kernel/cli -- --help       # one-shot run
nix profile install github:kernel/cli      # add to user profile

The flake mirrors the ldflags from .goreleaser.yaml so kernel --version reports the pinned version. The output binary matches make build semantically. No Go source is touched — addition is flake.nix + flake.lock only.

Test plan

make test — passes (go vet + go test ./...)
nix build on aarch64-darwin — produces a working kernel binary
Built binary reports correct version: kernel 0.19.0 (none) go1.26.2 unknown
nix run .# -- --version works
Production smoke: kernel auth, kernel browsers create --stealth, kernel browsers list all work against prod with the nix-built binary

Notes

version and vendorHash are pinned in flake.nix and will need to be bumped per release alongside the existing goreleaser bump. nix-update is the standard tool for automating this.
Minimal scope: no devShell, no flake-check CI job, no README changes. Easy to extend later if there's demand.

Note

Low Risk
Adds Nix packaging metadata only; no Go/runtime behavior changes beyond how the binary is built and versioned.

Overview
Adds a new Nix flake (flake.nix + flake.lock) that packages the Go-based kernel CLI using buildGoModule across default systems.

The flake pins nixpkgs/flake-utils, sets a fixed vendorHash, and applies ldflags (including -X main.version=0.19.0) so Nix-built binaries report the expected version and can be exposed via packages.default and apps.default.

Reviewed by Cursor Bugbot for commit 032ab59. Bugbot is set up for automated code reviews on this repo. Configure here.

firetiger-agent

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR only adds Nix build configuration files (flake.nix, flake.lock) and does not modify API endpoints (packages/api/cmd/api/) or Temporal workflows (packages/api/lib/temporal).

To monitor this PR anyway, reply with @firetiger monitor this.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add nix flake for reproducible builds#162