From 61ecfae3882b4b7989b89b31e710c5ac9e3166a3 Mon Sep 17 00:00:00 2001
From: Thomas Honeyman <admin@thomashoneyman.com>
Date: Sun, 18 Oct 2026 18:11:11 -0400
Subject: [PATCH] Use pinned Nix tools for development and dashboard builds

---
 .agents/setup                   |  2 +-
 .github/workflows/dashboard.yml | 28 +++++++---------------------
 CONTRIBUTING.md                 | 15 +++++++++++----
 flake.nix                       |  5 +++++
 nix/overlay.nix                 | 16 +++++++++++++++-
 5 files changed, 39 insertions(+), 27 deletions(-)

diff --git a/.agents/setup b/.agents/setup
index f05dd534..ac39eace 100755
--- a/.agents/setup
+++ b/.agents/setup
@@ -46,7 +46,7 @@ time nix_env="$(nix print-dev-env --profile .direnv/flake-profile)"
 eval "$nix_env"
 
 echo "Installing locked npm dependencies..."
-time npm ci --no-audit --no-fund
+time npm ci --omit=optional --no-audit --no-fund
 
 echo "Building the PureScript workspace..."
 time spago build
diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
index 11987dd1..94bc8af4 100644
--- a/.github/workflows/dashboard.yml
+++ b/.github/workflows/dashboard.yml
@@ -3,10 +3,10 @@ name: Deploy Dashboard
 on:
   push:
     branches: [master]
-    paths: ['dashboard/**']
+    paths: ['dashboard/**', '.github/workflows/dashboard.yml']
   pull_request:
     types: [opened, reopened, synchronize, closed]
-    paths: ['dashboard/**']
+    paths: ['dashboard/**', '.github/workflows/dashboard.yml']
 
 permissions:
   contents: write
@@ -20,31 +20,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup Node
+      - uses: DeterminateSystems/determinate-nix-action@v3
         if: github.event.action != 'closed'
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
 
-      - name: Install tools
+      - uses: DeterminateSystems/magic-nix-cache-action@v14
         if: github.event.action != 'closed'
-        run: npm install --no-save purescript@0.15.16 spago@1.0.4 esbuild
+        with:
+          use-flakehub: false
 
       - name: Build dashboard
         if: github.event.action != 'closed'
-        run: npm run dashboard:build
-
-      - name: Verify bundle
-        if: github.event.action != 'closed'
-        run: test -f dashboard/app.js
-
-      - name: Prepare deploy directory
-        if: github.event.action != 'closed'
-        run: |
-          mkdir -p _site
-          cp dashboard/index.html _site/
-          cp dashboard/app.js _site/
-          cp -r dashboard/static _site/
+        run: nix build .#dashboard --out-link _site
 
       - name: Deploy to Pages
         if: github.ref == 'refs/heads/master'
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 00235a4b..55d6b831 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -10,9 +10,14 @@ You can get all the tools you need to work on this repository via Nix by enterin
 nix develop
 ```
 
-Then, you can treat this repository as an ordinary PureScript project:
+If you have direnv with nix-direnv configured for your shell, run `direnv allow` to activate the environment automatically when entering this repository.
+
+Install the locked JavaScript dependencies inside the Nix shell, then build and test:
 
 ```sh
+# Install JavaScript dependencies
+npm ci --omit=optional --no-audit --no-fund
+
 # Build the source
 spago build
 
@@ -20,6 +25,8 @@ spago build
 spago test
 ```
 
+Repeat the npm install step when the dependencies or Node version change.
+
 > NOTE: You don't strictly need Nix to work on the registry; if you are contributing PureScript changes only then you can get away with just `purs` and `spago`, but be aware that some tests will fail on your machine, you may see database errors, and you will not be able to run integration tests.
 
 ## Repository Structure
@@ -275,13 +282,13 @@ The `dashboard/` directory contains a Halogen (PureScript) application for monit
 
 ### Building
 
-To produce a browser JS bundle:
+To build the dashboard for deployment:
 
 ```sh
-npm run dashboard:build
+nix build .#dashboard
 ```
 
-This outputs `dashboard/app.js`, which `dashboard/index.html` loads via `<script src="./app.js">`.
+The `result/` directory contains `index.html`, `app.js`, and `static/`. To produce only the JS bundle in your checkout, run `npm run dashboard:build`.
 
 ### Local Development
 
diff --git a/flake.nix b/flake.nix
index 5a5f5628..318c6a0c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -110,6 +110,7 @@
           pkgs.registry.apps
           // pkgs.registry.scripts
           // {
+            dashboard = pkgs.registry-dashboard;
             test-env = testEnv.testEnvScript;
           };
 
@@ -131,6 +132,8 @@
           };
 
         checks = {
+          dashboard = pkgs.registry-dashboard;
+
           spago-test =
             pkgs.runCommand "spago-test"
               {
@@ -240,6 +243,8 @@
               nixfmt-rfc-style
               bash
               nodejs
+              prefetch-npm-deps
+              esbuild
               jq
               dbmate
               sqlite
diff --git a/nix/overlay.nix b/nix/overlay.nix
index 407325e9..c696a596 100644
--- a/nix/overlay.nix
+++ b/nix/overlay.nix
@@ -166,7 +166,7 @@ in
     dontNpmBuild = true;
     npmFlags = [ "--omit=optional" ];
 
-    # To update: run `nix build .#server` and copy the hash from the error
+    # To update: run `prefetch-npm-deps package-lock.json` in the dev shell.
     npmDepsHash = "sha256-1PENsd/EzRYVZ6RxTssbSzPu7SVVGlWnP7Zjt6im5GI=";
 
     installPhase = ''
@@ -176,6 +176,20 @@ in
     '';
   };
 
+  registry-dashboard =
+    prev.runCommand "registry-dashboard" { nativeBuildInputs = [ prev.esbuild ]; }
+      ''
+        ln -s ${final.registry-spago-lock}/output .
+        ln -s ${final.registry-package-lock}/node_modules .
+        mkdir -p $out
+        esbuild --bundle --platform=browser --outfile=$out/app.js <<'EOF'
+        import { main } from "./output/Dashboard.Main/index.js";
+        main();
+        EOF
+        cp ${../dashboard/index.html} $out/index.html
+        cp -r ${../dashboard/static} $out/static
+      '';
+
   # Compiler infrastructure
 
   # All PureScript compilers we support (filtered from purs-bin overlay)