feat(nixidy-switch): Support multiple environments #50

martin · 2026-09-29T17:33:03Z

martin commented

2026-09-29 17:33:03 +00:00

Summary

Add PLUGIN_ENVIRONMENTS_FILE to switch multiple Nixidy environments from a whitespace-separated file.
Keep the existing single-environment setting and validate that exactly one mode is configured.
Document both usage modes and clarify that caching and Git operations remain workflow responsibilities.

Verification

nix build .#nixidy-switch
bash -n ./result/bin/nixidy-switch
git diff --check

## Summary - Add `PLUGIN_ENVIRONMENTS_FILE` to switch multiple Nixidy environments from a whitespace-separated file. - Keep the existing single-environment setting and validate that exactly one mode is configured. - Document both usage modes and clarify that caching and Git operations remain workflow responsibilities. ## Verification - `nix build .#nixidy-switch` - `bash -n ./result/bin/nixidy-switch` - `git diff --check`

martin added 1 commit

2026-09-29 17:33:03 +00:00

feat(nixidy-switch): Support multiple environments

ci/woodpecker/pr/verify-nix Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

f2a49c7ce0

martin requested review from clank-bot

2026-09-29 17:33:03 +00:00

clank-bot commented

2026-09-30 06:18:15 +00:00

Review Summary

Strengths

Exclusive single/multi-mode validation with actionable errors, and it runs before the git config/cd side effects.
File-supplied names are charset-restricted ([A-Za-z0-9_-]), then quoted with an explicit .# prefix — no shell or flake-ref injection.
Loop logic is sound: blank lines are skipped, count rejects an empty file with a friendly message, and while read -ra … || [ "${#environments[@]}" -gt 0 ] correctly picks up a final line with no trailing newline without looping forever (bash clears a -a array even on EOF) and is set -u-safe (the @-subscript exemption covers an unset array).
Single-environment behavior is unchanged; README covers both modes, the exclusivity rule, and the name charset.

Blocking

plugins/nixidy-switch/default.nix:31 vs :55: the environments file is checked before cd "$CI_WORKSPACE" but opened after it, so the two resolve relative paths against different directories whenever the container's initial working directory differs from CI_WORKSPACE (a step-level directory:, or running the image manually where CWD is the image WORKDIR). README:34-35 promises the path is "resolved before changing to CI_WORKSPACE", which only describes the check. See comment 1 — please make code and docs consistent (one-line fix either way).

Optional / non-blocking

Redirect the loop body's child stdin so nixidy switch can never consume the remaining entries.
CRLF-terminated files fail validation with an invisible \r in the error message; strip it or document LF-only files.
Nice-to-haves: accept an optional .# prefix in the file for symmetry with environment, and consider an integration.yaml covering the multi-env path (flake-checker sets the precedent in this repo).

*🤖 Review by opencode (opencode/mimo-v2.6-flash-free) — verdict: changes

# Review Summary **Strengths** - Exclusive single/multi-mode validation with actionable errors, and it runs *before* the `git config`/`cd` side effects. - File-supplied names are charset-restricted (`[A-Za-z0-9_-]`), then quoted with an explicit `.#` prefix — no shell or flake-ref injection. - Loop logic is sound: blank lines are skipped, `count` rejects an empty file with a friendly message, and `while read -ra … || [ "${#environments[@]}" -gt 0 ]` correctly picks up a final line with no trailing newline without looping forever (bash clears a `-a` array even on EOF) and is `set -u`-safe (the `@`-subscript exemption covers an unset array). - Single-environment behavior is unchanged; README covers both modes, the exclusivity rule, and the name charset. **Blocking** - `plugins/nixidy-switch/default.nix:31` vs `:55`: the environments file is *checked* before `cd "$CI_WORKSPACE"` but *opened* after it, so the two resolve relative paths against different directories whenever the container's initial working directory differs from `CI_WORKSPACE` (a step-level `directory:`, or running the image manually where CWD is the image WORKDIR). README:34-35 promises the path is "resolved before changing to CI_WORKSPACE", which only describes the check. See comment 1 — please make code and docs consistent (one-line fix either way). **Optional / non-blocking** - Redirect the loop body's child stdin so `nixidy switch` can never consume the remaining entries. - CRLF-terminated files fail validation with an invisible `\r` in the error message; strip it or document LF-only files. - Nice-to-haves: accept an optional `.#` prefix in the file for symmetry with `environment`, and consider an `integration.yaml` covering the multi-env path (flake-checker sets the precedent in this repo). --- *🤖 Review by opencode (opencode/mimo-v2.6-flash-free) — verdict: **changes**

clank-bot reviewed

2026-09-30 06:18:15 +00:00

clank-bot left a comment

Code review findings from opencode.

Code review findings from opencode.

plugins/nixidy-switch/default.nix

					
				@ -20,0 +28,4 @@

				      exit 1

				    fi

				    if [ -n "$env_file" ] && [ ! -r "$env_file" ]; then

[bug] The readability check runs before `cd "$target"`, but the file is actually opened by `done < "$env_file"` (line 55) *after* the cd. Whenever the container's initial CWD differs from CI_WORKSPACE (a step-level `directory:`, or a manual `docker run` where CWD is the image WORKDIR), check and read resolve relative paths differently: a valid file is rejected here, or this check passes and the loop then aborts with a raw "No such file or directory" under `set -e`. README:34-35 claims the path is "resolved before changing to CI_WORKSPACE", which only holds for this check, not for the read. Fix: open the file before the cd (e.g. `exec 3< "$env_file"` here and `done <&3`), or absolutize it first; alternatively move the check after the cd and reword the README to say paths are workspace-relative. Also consider `-f` instead of `-r` so a directory path gets this friendly message rather than a raw bash error.

[bug] The readability check runs before `cd "$target"`, but the file is actually opened by `done < "$env_file"` (line 55) *after* the cd. Whenever the container's initial CWD differs from CI_WORKSPACE (a step-level `directory:`, or a manual `docker run` where CWD is the image WORKDIR), check and read resolve relative paths differently: a valid file is rejected here, or this check passes and the loop then aborts with a raw "No such file or directory" under `set -e`. README:34-35 claims the path is "resolved before changing to CI_WORKSPACE", which only holds for this check, not for the read. Fix: open the file before the cd (e.g. `exec 3< "$env_file"` here and `done <&3`), or absolutize it first; alternatively move the check after the cd and reword the README to say paths are workspace-relative. Also consider `-f` instead of `-r` so a directory path gets this friendly message rather than a raw bash error.

plugins/nixidy-switch/default.nix

					
				@ -23,0 +41,4 @@

				    fi

				    count=0

				    while read -ra environments || [ "''${#environments[@]}" -gt 0 ]; do

[style] A CRLF-terminated file gives every name a trailing `\r` (not in default IFS), so validation rejects it with an error where the name visually looks valid — the `\r` just returns the cursor to column 0. Either normalize per name (`env="''${env%$'\r'}"` before the `case`) or document that the file must be LF-terminated.

[style] A CRLF-terminated file gives every name a trailing `\r` (not in default IFS), so validation rejects it with an error where the name visually looks valid — the `\r` just returns the cursor to column 0. Either normalize per name (`env="''${env%$'\r'}"` before the `case`) or document that the file must be LF-terminated.

plugins/nixidy-switch/default.nix

					
				@ -23,0 +49,4 @@

				            exit 1

				            ;;

				        esac

				        nixidy switch ".#$env"

[bug] Latent issue: inside `while … done < "$env_file"` the loop body inherits the environments file as stdin, so `nixidy switch` shares it. nixidy/nix don't read stdin today, but if the tool (or a future prompt/flag) ever does, it will silently swallow the remaining entries. Cheap hardening: `nixidy switch ".#$env" < /dev/null`.

[bug] Latent issue: inside `while … done < "$env_file"` the loop body inherits the environments file as stdin, so `nixidy switch` shares it. nixidy/nix don't read stdin today, but if the tool (or a future prompt/flag) ever does, it will silently swallow the remaining entries. Cheap hardening: `nixidy switch ".#$env" < /dev/null`.

ci/woodpecker/pr/verify-nix Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin nixidy-switch/multi-env:nixidy-switch/multi-env

git switch nixidy-switch/multi-env

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff nixidy-switch/multi-env

git switch nixidy-switch/multi-env

git rebase main

git switch main

git merge --ff-only nixidy-switch/multi-env

git switch nixidy-switch/multi-env

git rebase main

git switch main

git merge --no-ff nixidy-switch/multi-env

git switch main

git merge --squash nixidy-switch/multi-env