quien is a standard Go module:
go build ./...
go test ./...
gofmt -l . # must report nothing
golangci-lint run ./... # CI uses the latest releaseCI also enforces the modernize analyzer:
go run golang.org/x/tools/go/analysis/passes/modernize/cmd/modernize@latest ./...After any change to go.mod/go.sum, the Nix flake's vendorHash is stale and nix build will fail with a hash mismatch. nix-update fixes it automatically at release time, but to keep main buildable you can recompute it now:
# set vendorHash in flake.nix to a fake value, then build to learn the real one:
nix build .#default # prints "got: sha256-…"; paste that into flake.nix
nix build .#default # confirm it succeedsThe Go version lives in two coupled places that must move together:
- The
godirective ingo.mod. - The flake's
nixpkgsinput inflake.nix, which supplies the Go compiler used bynix build. It is pinned to a stable channel (e.g.nixos-26.05).
nix-update does not touch the nixpkgs input, so the toolchain only moves when you bump it by hand:
- Check which channel actually ships the Go version you want — a stable release branch sometimes carries a newer patch than
nixpkgs-unstable:nix eval --raw github:NixOS/nixpkgs/nixos-26.05#go.version - Update the directive (
go mod edit -go=1.26.4) and, if needed, pointinputs.nixpkgs.urlat the channel that has it. - Re-lock and recompute the vendor hash (see Bumping dependencies above):
nix flake update nix build .#default - Verify:
go build ./... && go test ./... && nix build .#default.
If go.mod requires a newer Go than the pinned nixpkgs provides, nix build fails because the sandbox can't download a toolchain — that's the symptom of the two having drifted apart.