feat: Add nix flake (#94)

.changeset/nix-flake.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Add flake.nix for nix & NixOS installs

.github/workflows/ci.yml

@@ -51,6 +51,19 @@ jobs:
       - name: Run tests
         run: cargo test --verbose
 
+  nix:
+    name: Nix
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check flake
+        run: nix flake check
+      - name: Build flake
+        run: nix build .
+
   lint:
     name: Lint
     runs-on: ubuntu-latest

.github/workflows/release-changesets.yml

@@ -38,6 +38,11 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Install Nix
+        uses: cachix/install-nix-action@v30
+        with:
+          github_access_token: ${{ secrets.GOOGLEWORKSPACE_BOT_TOKEN }}
+
       - uses: pnpm/action-setup@v4
 
       - name: Setup Node.js

README.md

@@ -54,6 +54,15 @@ Or build from source:
 cargo install --path .
 ```
 
+A Nix flake is also available at `github:googleworkspace/cli`
+
+```bash
+nix run github:googleworkspace/cli
+```
+
+
+
+
 ## Why gws?
 
 **For humans** — stop writing `curl` calls against REST docs. `gws` gives you tab‑completion, `--help` on every resource, `--dry-run` to preview requests, and auto‑pagination.

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1772542754,
+        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,77 @@
+{
+  description = "Google Workspace CLI — dynamic command surface from Discovery Service";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+
+        # Extract version from Cargo.toml
+        cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
+        version = cargoToml.package.version;
+
+        # System dependencies
+        # On Linux, keyring often needs libsecret
+        # On macOS, it uses Security framework
+        linuxDeps = with pkgs; [
+          libsecret
+        ];
+
+        darwinDeps = with pkgs; [
+          libiconv
+          darwin.apple_sdk.frameworks.Security
+        ];
+
+        gws = pkgs.rustPlatform.buildRustPackage {
+          pname = "gws";
+          inherit version;
+
+          src = ./.;
+
+          cargoLock = {
+            lockFile = ./Cargo.lock;
+          };
+
+          nativeBuildInputs = [ pkgs.pkg-config ];
+          buildInputs = pkgs.lib.optionals pkgs.stdenv.isLinux linuxDeps
+            ++ pkgs.lib.optionals pkgs.stdenv.isDarwin darwinDeps;
+
+          # Tests are disabled by default in buildRustPackage if not specified, 
+          # but we'll be explicit. Some tests might require network.
+          doCheck = false;
+
+          meta = with pkgs.lib; {
+            description = cargoToml.package.description;
+            homepage = cargoToml.package.homepage;
+            license = licenses.asl20;
+            maintainers = [{ name = "Justin Poehnelt"; email = "justin.poehnelt@mgail.com"; }];
+            mainProgram = "gws";
+          };
+        };
+      in
+      {
+        packages.default = gws;
+        packages.gws = gws;
+
+        apps.default = flake-utils.lib.mkApp {
+          drv = gws;
+        };
+
+        devShells.default = pkgs.mkShell {
+          inputsFrom = [ gws ];
+          buildInputs = with pkgs; [
+            rustc
+            cargo
+            rust-analyzer
+            clippy
+            rustfmt
+          ];
+        };
+      }
+    );
+}

scripts/version-sync.sh

@@ -21,5 +21,10 @@ awk -v ver="$VERSION" '
 # Update Cargo.lock to match
 cargo generate-lockfile
 
+# Update flake.lock if nix is available
+if command -v nix > /dev/null 2>&1; then
+  nix flake lock --update-input nixpkgs
+fi
+
 # Stage the changed files so changesets/action commits them
-git add Cargo.toml Cargo.lock
+git add Cargo.toml Cargo.lock flake.nix flake.lock