From 77ecd8d4cece95c8781a14abee1fc70138fef528 Mon Sep 17 00:00:00 2001
From: Malte Poll <1780588+malt3@users.noreply.github.com>
Date: Thu, 15 Feb 2024 17:59:57 +0100
Subject: [PATCH] nix: fix bazel under NixOS

---
 flake.nix              |  6 ++--
 nix/packages/bazel.nix | 64 ++++++++++++++++++++++++++++++++++++++++++
 nix/shells/default.nix |  6 ++--
 3 files changed, 71 insertions(+), 5 deletions(-)
 create mode 100644 nix/packages/bazel.nix

diff --git a/flake.nix b/flake.nix
index 437359123..7738047f8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -57,6 +57,8 @@
 
       openssl-static = pkgsUnstable.openssl.override { static = true; };
 
+      bazel_7 = callPackage ./nix/packages/bazel.nix { pkgs = pkgsUnstable; nixpkgs = nixpkgsUnstable; };
+
     in
     {
       packages.mkosi = mkosiDev;
@@ -75,13 +77,13 @@
 
       packages.awscli2 = pkgsUnstable.awscli2;
 
-      packages.bazel_7 = pkgsUnstable.bazel_7;
+      packages.bazel_7 = bazel_7;
 
       packages.createrepo_c = pkgsUnstable.createrepo_c;
 
       packages.dnf5 = pkgsUnstable.dnf5;
 
-      devShells.default = import ./nix/shells/default.nix { pkgs = pkgsUnstable; };
+      devShells.default = callPackage ./nix/shells/default.nix { inherit bazel_7; };
 
       formatter = nixpkgsUnstable.legacyPackages.${system}.nixpkgs-fmt;
     });
diff --git a/nix/packages/bazel.nix b/nix/packages/bazel.nix
new file mode 100644
index 000000000..ccda28f89
--- /dev/null
+++ b/nix/packages/bazel.nix
@@ -0,0 +1,64 @@
+{ nixpkgs
+, symlinkJoin
+, pkgs
+, bazel_7
+, lib
+, substituteAll
+, writeShellScriptBin
+, bash
+, coreutils
+, diffutils
+, file
+, findutils
+, gawk
+, gnugrep
+, gnupatch
+, gnused
+, gnutar
+, gzip
+, python3
+, unzip
+, which
+, zip
+}:
+let
+  defaultShellUtils = [
+    bash
+    coreutils
+    diffutils
+    file
+    findutils
+    gawk
+    gnugrep
+    gnupatch
+    gnused
+    gnutar
+    gzip
+    python3
+    unzip
+    which
+    zip
+  ];
+  bazel_with_action_env = bazel_7.overrideAttrs (oldAttrs: {
+    # https://github.com/NixOS/nixpkgs/pull/262152#issuecomment-1879053113
+    patches = (oldAttrs.patches or [ ]) ++ [
+      (substituteAll {
+        src = "${nixpkgs}/pkgs/development/tools/build-managers/bazel/bazel_6/actions_path.patch";
+        actionsPathPatch = lib.makeBinPath defaultShellUtils;
+      })
+    ];
+  });
+in
+symlinkJoin {
+  name = "bazel_7";
+  paths = [ bazel_with_action_env ];
+  buildInputs = [ pkgs.makeWrapper ];
+  # This wrapper is required in Nix shells to make them work with
+  # bazel's --incompatible_sandbox_hermetic_tmp flag.
+  # See https://github.com/bazelbuild/bazel/issues/5900
+  postBuild = ''
+    wrapProgram $out/bin/bazel \
+      --unset TMPDIR \
+      --unset TMP
+  '';
+}
diff --git a/nix/shells/default.nix b/nix/shells/default.nix
index ba787e2b4..3d6e5a3c0 100644
--- a/nix/shells/default.nix
+++ b/nix/shells/default.nix
@@ -1,6 +1,6 @@
-{ pkgs, ... }:
-pkgs.mkShell {
-  nativeBuildInputs = with pkgs; [
+{ mkShell, git, bazel_7 }:
+mkShell {
+  nativeBuildInputs = [
     bazel_7
     git
   ];