nix: fix bazel under NixOS

flake.nix

@@ -57,6 +57,8 @@
 
       openssl-static = pkgsUnstable.openssl.override { static = true; };
 
+      bazel_7 = callPackage ./nix/packages/bazel.nix { pkgs = pkgsUnstable; nixpkgs = nixpkgsUnstable; };
+
     in
     {
       packages.mkosi = mkosiDev;
@@ -75,13 +77,13 @@
 
       packages.awscli2 = pkgsUnstable.awscli2;
 
-      packages.bazel_7 = pkgsUnstable.bazel_7;
+      packages.bazel_7 = bazel_7;
 
       packages.createrepo_c = pkgsUnstable.createrepo_c;
 
       packages.dnf5 = pkgsUnstable.dnf5;
 
-      devShells.default = import ./nix/shells/default.nix { pkgs = pkgsUnstable; };
+      devShells.default = callPackage ./nix/shells/default.nix { inherit bazel_7; };
 
       formatter = nixpkgsUnstable.legacyPackages.${system}.nixpkgs-fmt;
     });

nix/packages/bazel.nix

@@ -0,0 +1,64 @@
+{ nixpkgs
+, symlinkJoin
+, pkgs
+, bazel_7
+, lib
+, substituteAll
+, writeShellScriptBin
+, bash
+, coreutils
+, diffutils
+, file
+, findutils
+, gawk
+, gnugrep
+, gnupatch
+, gnused
+, gnutar
+, gzip
+, python3
+, unzip
+, which
+, zip
+}:
+let
+  defaultShellUtils = [
+    bash
+    coreutils
+    diffutils
+    file
+    findutils
+    gawk
+    gnugrep
+    gnupatch
+    gnused
+    gnutar
+    gzip
+    python3
+    unzip
+    which
+    zip
+  ];
+  bazel_with_action_env = bazel_7.overrideAttrs (oldAttrs: {
+    # https://github.com/NixOS/nixpkgs/pull/262152#issuecomment-1879053113
+    patches = (oldAttrs.patches or [ ]) ++ [
+      (substituteAll {
+        src = "${nixpkgs}/pkgs/development/tools/build-managers/bazel/bazel_6/actions_path.patch";
+        actionsPathPatch = lib.makeBinPath defaultShellUtils;
+      })
+    ];
+  });
+in
+symlinkJoin {
+  name = "bazel_7";
+  paths = [ bazel_with_action_env ];
+  buildInputs = [ pkgs.makeWrapper ];
+  # This wrapper is required in Nix shells to make them work with
+  # bazel's --incompatible_sandbox_hermetic_tmp flag.
+  # See https://github.com/bazelbuild/bazel/issues/5900
+  postBuild = ''
+    wrapProgram $out/bin/bazel \
+      --unset TMPDIR \
+      --unset TMP
+  '';
+}

nix/shells/default.nix

@@ -1,6 +1,6 @@
-{ pkgs, ... }:
-pkgs.mkShell {
-  nativeBuildInputs = with pkgs; [
+{ mkShell, git, bazel_7 }:
+mkShell {
+  nativeBuildInputs = [
     bazel_7
     git
   ];