Generate the package list from pkgs/ instead of a sed script

.github/workflows/actionci.yml

@@ -16,6 +16,7 @@ jobs:
   actionci:
     permissions:
       contents: read
+      actions: read
       security-events: write
     uses: smallstep/workflows/.github/workflows/actionci.yml@main
     secrets: inherit

.github/workflows/build.yml

@@ -10,23 +10,8 @@ on:
 permissions: read-all
 
 jobs:
-  release-check:
-    permissions: {}
-    runs-on: ubuntu-latest
-    outputs:
-      is-release: ${{ steps.condition-check.outputs.match }}
-    steps:
-      - id: condition-check
-        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2
-        with:
-          # matches: package_name: vX.Y.Z -> vX.Y.Z where XYZ are digits (including rc, e.g: vX.Y.Z-rcN)
-          # it detects a commit from goreleaser with a new nix package version.
-          regex: '\s*[a-zA-Z][\w]+:\s*v\d+\.\d+\.\d+(-rc\d+)?\s*->\s*v\d+\.\d+\.\d+(-rc\d+)?'
-          text: ${{ github.event.head_commit.message }}
-
   tests:
     permissions: {}
-    needs: release-check
     strategy:
       matrix:
         nixPath:
@@ -35,7 +20,6 @@ jobs:
           - nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/heads/nixos-25.11.tar.gz
     runs-on: ubuntu-latest
 
-    if: needs.release-check.outputs.is-release != ''
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
@@ -55,50 +39,7 @@ jobs:
           --option restrict-eval true \
           --option allow-import-from-derivation true \
           --drv-path --show-trace \
-          -I nixpkgs=$(nix-instantiate --find-file nixpkgs) \
-          -I $PWD
+          -I "nixpkgs=$(nix-instantiate --find-file nixpkgs)" \
+          -I "$PWD"
     - name: Build nix packages
       run: nix shell -f '<nixpkgs>' nix-build-uncached -c nix-build-uncached ci.nix -A cacheOutputs
-
-  add-pkg:
-    permissions:
-      contents: write
-    needs: [release-check, tests]
-    runs-on: ubuntu-latest
-
-    if: needs.release-check.outputs.is-release != ''
-    steps:
-    - name: Configure PAT for git push
-      run: |
-        git config --global url.https://${{ secrets.NUR_PAT }}@github.com/.insteadOf https://github.com/
-
-    - name: Checkout repository
-      uses: actions/checkout@v6
-      with:
-        token: ${{ secrets.NUR_PAT }}
-
-    - name: Make addpkg script executable
-      run: chmod +x ./addpkg.sh
-    - name: Execute addpkg.sh to update nix package's catalog
-      run: ./addpkg.sh step-agent
-    - name: Setup bot SSH signing key
-      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-      env:
-        HAS_SSH_PRIVATE_KEY: ${{ secrets.STEP_TRAVIS_CI_GH_PRIVATE_SIGNING_KEY != '' }}
-      if: ${{ env.HAS_SSH_PRIVATE_KEY == 'true' }}
-      with:
-        ssh-private-key: |
-          ${{ secrets.STEP_TRAVIS_CI_GH_PRIVATE_SIGNING_KEY }}
-    - name: Add and Commit default.nix
-      run: |
-        git config user.email "eng+ci@smallstep.com"
-        git config user.name "step-ci"
-
-        # Configure GH commit signing key.
-        git config --global commit.gpgsign true
-        git config --global gpg.format ssh
-        git config --global user.signingkey "${{ secrets.STEP_TRAVIS_CI_GH_PUBLIC_SIGNING_KEY }}"
-
-        git add default.nix && git commit -m "Add new package to default.nix"
-    - name: Push changes
-      run: git push

README.md

@@ -77,5 +77,23 @@ $ step-agent version
 ```
 
 8. More information about `step-agent` can be found on the following page: [Step Agent docs](https://smallstep.com/docs/platform/smallstep-app/)
+
+## Packaging
+
+Attributes are generated from the contents of `pkgs/`. Every
+`pkgs/<name>/<name>_<version>.nix` is registered automatically as
+`<name>_<version>`, with `.` replaced by `_`:
+
+| File | Attribute |
+|------|-----------|
+| `pkgs/step-agent/step-agent_0.69.0.nix` | `step-agent_0_69_0` |
+| `pkgs/step-agent/step-agent_0.69.1-rc1.nix` | `step-agent_0_69_1-rc1` |
+
+The unsuffixed `step-agent` attribute is the highest **stable** version present
+— prereleases are only reachable by their explicit attribute.
+
+Releasing is therefore just committing the derivation: goreleaser writes the
+file from `smallstep/agent` and there is no package list to keep in sync.
+
 <!-- Remove this if you don't use github actions -->
 ![Build and populate cache](https://github.com/smallstep/nur/workflows/Build%20and%20populate%20cache/badge.svg)

default.nix

@@ -8,43 +8,57 @@
 
 { pkgs ? import <nixpkgs> { } }:
 
+let
+  inherit (pkgs) lib;
+
+  # Every derivation under pkgs/<name>/ is registered automatically, so this
+  # attribute set can never drift from what goreleaser has committed. Releases
+  # add a file and nothing else: there is no package list to keep in sync.
+  #
+  #   pkgs/step-agent/step-agent_0.69.0.nix  ->  step-agent_0_69_0
+  #   pkgs/step-agent/step-agent_0.69.0-rc1.nix  ->  step-agent_0_69_0-rc1
+  #
+  # Version and attribute name differ only in the separator, so we keep both.
+  releasesOf = name:
+    let
+      dir = ./pkgs + "/${name}";
+      isRelease = file: type: type == "regular" && lib.hasSuffix ".nix" file;
+      versionOf = file: lib.removePrefix "${name}_" (lib.removeSuffix ".nix" file);
+    in
+    lib.mapAttrsToList
+      (file: _: rec {
+        version = versionOf file;
+        attr = "${name}_${builtins.replaceStrings [ "." ] [ "_" ] version}";
+        package = pkgs.callPackage (dir + "/${file}") { };
+      })
+      (lib.filterAttrs isRelease (builtins.readDir dir));
+
+  # A release is stable when its version carries no -rc/-dev/nightly suffix.
+  isStable = release: builtins.match "[0-9]+\\.[0-9]+\\.[0-9]+" release.version != null;
+
+  newest = releases:
+    lib.head (lib.sort (a: b: builtins.compareVersions a.version b.version > 0) releases);
+
+  # `nur.repos.smallstep.step-agent` is the obvious thing to type, so it has to
+  # mean the current stable release rather than whichever file happens to sort
+  # last -- `sort -V` ranks 0.68.0-rc1 above 0.68.0, and prerelease lines run
+  # ahead of stable ones.
+  packageSet = name:
+    let
+      releases = releasesOf name;
+      byAttr = lib.listToAttrs
+        (map (r: lib.nameValuePair r.attr r.package) releases);
+      stable = lib.filter isStable releases;
+    in
+    byAttr // lib.optionalAttrs (stable != [ ]) {
+      ${name} = (newest stable).package;
+    };
+
+in
 {
   # The `lib`, `modules`, and `overlays` names are special
   lib = import ./lib { inherit pkgs; }; # functions
   modules = import ./modules; # NixOS modules
   overlays = import ./overlays; # nixpkgs overlays
-
-  # <package-list>: DO NOT REMOVE THIS LINE
-  step-agent_0_70_0-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.70.0-rc2.nix { };
-  step-agent_0_70_0-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.70.0-rc1.nix { };
-  step-agent_0_68_0-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.68.0-rc1.nix { };
-  step-agent_0_67_4-rc12 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc12.nix { };
-  step-agent_0_67_4-rc11 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc11.nix { };
-  step-agent_0_67_4-rc10 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc10.nix { };
-  step-agent_0_67_4-rc9 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc9.nix { };
-  step-agent_0_67_4-rc8 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc8.nix { };
-  step-agent_0_67_4-rc7 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc7.nix { };
-  step-agent_0_67_4-rc6 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc6.nix { };
-  step-agent_0_67_4-rc4 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc4.nix { };
-  step-agent_0_67_4-rc3 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc3.nix { };
-  step-agent_0_67_4-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc2.nix { };
-  step-agent_0_67_4-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc1.nix { };
-  step-agent_0_67_3-rc3 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc3.nix { };
-  step-agent_0_67_3-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc2.nix { };
-  step-agent_0_67_3-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc1.nix { };
-  step-agent_0_67_2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.2.nix { };
-  step-agent_0_67_1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.1.nix { };
-  step-agent_0_67_0 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.0.nix { };
-  step-agent_0_66_0 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.66.0.nix { };
-  step-agent_0_65_6 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.6.nix { };
-  step-agent_0_65_5-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.5-rc2.nix { };
-  step-agent_0_65_5-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.5-rc1.nix { };
-  step-agent_0_65_4 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.4.nix { };
-  step-agent_0_65_2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.2.nix { };
-  step-agent_0_65_1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.1.nix { };
-  step-agent_0_65_0-rc21 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc21.nix { };
-  step-agent_0_65_0-rc20 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc20.nix { };
-  step-agent_0_65_0-rc19 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc19.nix { };
-  step-agent = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc11.nix { };
-  step-agent_0_65_0-rc11 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc11.nix { };
 }
+// packageSet "step-agent"