feat: nix support (#4012)

very, very, very WIP implementation of nixpkgs for GoReleaser.

**Decisions made for this first version:**
- only linux and darwin, arm64, 386 and amd64
- only support pkgs from goreleaser-generated archives
- no support to push into default nixpkgs repository
- no support to automatically add the _maybe_ new pkg to the root
`default.nix`
- the generated nixpkg will be rather verbose, which shouldn't be too
much of an issue as it is autogenerated anyway

**TODOs**:
- [x] macos universal binary support
- [x] custom pkg path (e.g. pkgs/misc/foo/bar/default.nix)
- [x] handle archives with a folder in them
- [x] add more options: postInstall, ??

**Will be handled in future versions**:
- [ ] archives.format=binary support
- [ ] compile from source
- [ ] PR-ing into nixpkgs
- [ ] armv6l-linux & armv7l-linux support

closes #3537

---------

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

.gitattributes

@@ -9,3 +9,7 @@ www/docs/static/schema.json linguist-generated=true
 www/docs/static/schema-pro.json linguist-generated=true
 www/docs/static/releases.json linguist-generated=true
 www/docs/static/releases-pro.json linguist-generated=true
+*.nix.golden linguist-language=Nix
+*.rb.golden linguist-language=Ruby
+*.json.golden linguist-language=JSON
+*.yaml.golden linguist-language=YAML

.github/workflows/build.yml

@@ -48,6 +48,9 @@ jobs:
       - uses: crazy-max/ghaction-upx@v2
         with:
           install-only: true
+      - uses: cachix/install-nix-action@v20
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4
         with:
           go-version: stable

.github/workflows/release.yml

@@ -101,6 +101,9 @@ jobs:
       - uses: crazy-max/ghaction-upx@v2
         with:
           install-only: true
+      - uses: cachix/install-nix-action@v20
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
       - name: dockerhub-login
         if: startsWith(github.ref, 'refs/tags/v')
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1

.goreleaser.yaml

@@ -189,6 +189,21 @@ brews:
       fish_completion.install "completions/goreleaser.fish"
       man1.install "manpages/goreleaser.1.gz"
 
+nix:
+  - name: goreleaser
+    repository:
+      owner: goreleaser
+      name: nur
+    homepage:  https://goreleaser.com
+    description: Deliver Go binaries as fast and easily as possible
+    license: mit
+    install: |-
+      mkdir -p $out/bin
+      cp -vr ./goreleaser $out/bin/goreleaser
+      installManPage ./manpages/goreleaser.1.gz
+      installShellCompletion ./completions/*
+
+
 aurs:
   - homepage:  https://goreleaser.com
     description: Deliver Go binaries as fast and easily as possible

internal/artifact/artifact.go

@@ -58,6 +58,8 @@ const (
 	UploadableSourceArchive
 	// BrewTap is an uploadable homebrew tap recipe file.
 	BrewTap
+	// Nixpkg is an uploadable nix package.
+	Nixpkg
 	// PkgBuild is an Arch Linux AUR PKGBUILD file.
 	PkgBuild
 	// SrcInfo is an Arch Linux AUR .SRCINFO file.

internal/pipe/nix/nix.go

@@ -0,0 +1,463 @@
+package nix
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+	"text/template"
+
+	"github.com/caarlos0/log"
+	"github.com/goreleaser/goreleaser/internal/artifact"
+	"github.com/goreleaser/goreleaser/internal/client"
+	"github.com/goreleaser/goreleaser/internal/commitauthor"
+	"github.com/goreleaser/goreleaser/internal/pipe"
+	"github.com/goreleaser/goreleaser/internal/tmpl"
+	"github.com/goreleaser/goreleaser/pkg/config"
+	"github.com/goreleaser/goreleaser/pkg/context"
+)
+
+const nixConfigExtra = "NixConfig"
+
+type errNoArchivesFound struct {
+	goamd64 string
+	ids     []string
+}
+
+func (e errNoArchivesFound) Error() string {
+	return fmt.Sprintf("no linux/macos archives found matching goos=[darwin linux] goarch=[amd64 arm64 386] goamd64=%s ids=%v", e.goamd64, e.ids)
+}
+
+var (
+	errNoRepoName     = pipe.Skip("repository name is not set")
+	errSkipUpload     = pipe.Skip("nix.skip_upload is set")
+	errSkipUploadAuto = pipe.Skip("nix.skip_upload is set to 'auto', and current version is a pre-release")
+)
+
+// NewBuild returns a pipe to be used in the build phase.
+func NewBuild() Pipe {
+	return Pipe{buildShaPrefetcher{}}
+}
+
+// NewPublish returns a pipe to be used in the publish phase.
+func NewPublish() Pipe {
+	return Pipe{publishShaPrefetcher{
+		bin: nixPrefetchURLBin,
+	}}
+}
+
+type Pipe struct {
+	prefetcher shaPrefetcher
+}
+
+func (Pipe) String() string { return "nixpkgs" }
+func (p Pipe) Skip(ctx *context.Context) bool {
+	return len(ctx.Config.Nix) == 0 || !p.prefetcher.Available()
+}
+
+func (Pipe) Default(ctx *context.Context) error {
+	for i := range ctx.Config.Nix {
+		nix := &ctx.Config.Nix[i]
+
+		nix.CommitAuthor = commitauthor.Default(nix.CommitAuthor)
+
+		if nix.CommitMessageTemplate == "" {
+			nix.CommitMessageTemplate = "{{ .ProjectName }}: {{ .PreviousTag }} -> {{ .Tag }}"
+		}
+		if nix.Name == "" {
+			nix.Name = ctx.Config.ProjectName
+		}
+		if nix.Goamd64 == "" {
+			nix.Goamd64 = "v1"
+		}
+	}
+
+	return nil
+}
+
+func (p Pipe) Run(ctx *context.Context) error {
+	cli, err := client.New(ctx)
+	if err != nil {
+		return err
+	}
+
+	return p.runAll(ctx, cli)
+}
+
+// Publish .
+func (p Pipe) Publish(ctx *context.Context) error {
+	cli, err := client.New(ctx)
+	if err != nil {
+		return err
+	}
+	return p.publishAll(ctx, cli)
+}
+
+func (p Pipe) runAll(ctx *context.Context, cli client.Client) error {
+	for _, nix := range ctx.Config.Nix {
+		err := p.doRun(ctx, nix, cli)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (p Pipe) publishAll(ctx *context.Context, cli client.Client) error {
+	skips := pipe.SkipMemento{}
+	for _, nix := range ctx.Artifacts.Filter(artifact.ByType(artifact.Nixpkg)).List() {
+		err := doPublish(ctx, p.prefetcher, cli, nix)
+		if err != nil && pipe.IsSkip(err) {
+			skips.Remember(err)
+			continue
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return skips.Evaluate()
+}
+
+func (p Pipe) doRun(ctx *context.Context, nix config.Nix, cl client.ReleaserURLTemplater) error {
+	if nix.Repository.Name == "" {
+		return errNoRepoName
+	}
+
+	name, err := tmpl.New(ctx).Apply(nix.Name)
+	if err != nil {
+		return err
+	}
+	nix.Name = name
+
+	ref, err := client.TemplateRef(tmpl.New(ctx).Apply, nix.Repository)
+	if err != nil {
+		return err
+	}
+	nix.Repository = ref
+
+	skipUpload, err := tmpl.New(ctx).Apply(nix.SkipUpload)
+	if err != nil {
+		return err
+	}
+	nix.SkipUpload = skipUpload
+
+	filename := nix.Name + ".nix"
+	path := filepath.Join(ctx.Config.Dist, filename)
+
+	content, err := preparePkg(ctx, nix, cl, p.prefetcher)
+	if err != nil {
+		return err
+	}
+
+	log.WithField("nixpkg", path).Info("writing")
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil { //nolint: gosec
+		return fmt.Errorf("failed to write nixpkg: %w", err)
+	}
+
+	ctx.Artifacts.Add(&artifact.Artifact{
+		Name: filename,
+		Path: path,
+		Type: artifact.Nixpkg,
+		Extra: map[string]interface{}{
+			nixConfigExtra: nix,
+		},
+	})
+
+	return nil
+}
+
+func preparePkg(
+	ctx *context.Context,
+	nix config.Nix,
+	cli client.ReleaserURLTemplater,
+	prefetcher shaPrefetcher,
+) (string, error) {
+	filters := []artifact.Filter{
+		artifact.Or(
+			artifact.ByGoos("darwin"),
+			artifact.ByGoos("linux"),
+		),
+		artifact.Or(
+			artifact.And(
+				artifact.ByGoarch("amd64"),
+				artifact.ByGoamd64(nix.Goamd64),
+			),
+			artifact.ByGoarch("arm64"),
+			artifact.ByGoarch("386"),
+			artifact.ByGoarch("all"),
+		),
+		artifact.And(
+			artifact.ByFormats("zip", "tar.gz"),
+			artifact.ByType(artifact.UploadableArchive),
+		),
+		artifact.OnlyReplacingUnibins,
+	}
+	if len(nix.IDs) > 0 {
+		filters = append(filters, artifact.ByIDs(nix.IDs...))
+	}
+
+	archives := ctx.Artifacts.Filter(artifact.And(filters...)).List()
+	if len(archives) == 0 {
+		return "", errNoArchivesFound{
+			goamd64: nix.Goamd64,
+			ids:     nix.IDs,
+		}
+	}
+
+	if nix.URLTemplate == "" {
+		url, err := cli.ReleaseURLTemplate(ctx)
+		if err != nil {
+			return "", err
+		}
+		nix.URLTemplate = url
+	}
+
+	installs, err := installs(ctx, nix, archives[0])
+	if err != nil {
+		return "", err
+	}
+
+	postInstall, err := postInstall(ctx, nix, archives[0])
+	if err != nil {
+		return "", err
+	}
+
+	folder := artifact.ExtraOr(*archives[0], artifact.ExtraWrappedIn, ".")
+	if folder == "" {
+		folder = "."
+	}
+
+	data := templateData{
+		Name:        nix.Name,
+		Version:     ctx.Version,
+		Install:     installs,
+		PostInstall: postInstall,
+		Archives:    map[string]Archive{},
+		SourceRoot:  folder,
+		Description: nix.Description,
+		Homepage:    nix.Homepage,
+		License:     nix.License,
+	}
+	platforms := map[string]bool{}
+	for _, art := range archives {
+		url, err := tmpl.New(ctx).WithArtifact(art).Apply(nix.URLTemplate)
+		if err != nil {
+			return "", err
+		}
+		sha, err := prefetcher.Prefetch(url)
+		if err != nil {
+			return "", err
+		}
+		archive := Archive{
+			URL: url,
+			Sha: sha,
+		}
+
+		for _, goarch := range expandGoarch(art.Goarch) {
+			data.Archives[art.Goos+goarch] = archive
+			plat := goosToPlatform[art.Goos+goarch]
+			platforms[plat] = true
+		}
+	}
+	data.Platforms = keys(platforms)
+	sort.Strings(data.Platforms)
+
+	return doBuildPkg(ctx, data)
+}
+
+func expandGoarch(goarch string) []string {
+	if goarch == "all" {
+		return []string{"amd64", "arm64"}
+	}
+	return []string{goarch}
+}
+
+var goosToPlatform = map[string]string{
+	"linuxamd64":  "x86_64-linux",
+	"linuxarm64":  "aarch64-linux",
+	"linux386":    "i686-linux",
+	"darwinamd64": "x86_64-darwin",
+	"darwinarm64": "aarch64-darwin",
+}
+
+func keys(m map[string]bool) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	return keys
+}
+
+func doPublish(ctx *context.Context, prefetcher shaPrefetcher, cl client.Client, pkg *artifact.Artifact) error {
+	nix, err := artifact.Extra[config.Nix](*pkg, nixConfigExtra)
+	if err != nil {
+		return err
+	}
+
+	if strings.TrimSpace(nix.SkipUpload) == "true" {
+		return errSkipUpload
+	}
+
+	if strings.TrimSpace(nix.SkipUpload) == "auto" && ctx.Semver.Prerelease != "" {
+		return errSkipUploadAuto
+	}
+
+	repo := client.RepoFromRef(nix.Repository)
+
+	gpath := nix.Path
+	if gpath == "" {
+		gpath = path.Join("pkgs", nix.Name, "default.nix")
+	}
+
+	msg, err := tmpl.New(ctx).Apply(nix.CommitMessageTemplate)
+	if err != nil {
+		return err
+	}
+
+	author, err := commitauthor.Get(ctx, nix.CommitAuthor)
+	if err != nil {
+		return err
+	}
+
+	content, err := preparePkg(ctx, nix, cl, prefetcher)
+	if err != nil {
+		return err
+	}
+
+	if nix.Repository.Git.URL != "" {
+		return client.NewGitUploadClient(repo.Branch).
+			CreateFile(ctx, author, repo, []byte(content), gpath, msg)
+	}
+
+	cl, err = client.NewIfToken(ctx, cl, nix.Repository.Token)
+	if err != nil {
+		return err
+	}
+
+	if !nix.Repository.PullRequest.Enabled {
+		return cl.CreateFile(ctx, author, repo, []byte(content), gpath, msg)
+	}
+
+	log.Info("nix.pull_request enabled, creating a PR")
+	pcl, ok := cl.(client.PullRequestOpener)
+	if !ok {
+		return fmt.Errorf("client does not support pull requests")
+	}
+
+	if err := cl.CreateFile(ctx, author, repo, []byte(content), gpath, msg); err != nil {
+		return err
+	}
+
+	title := fmt.Sprintf("Updated %s to %s", ctx.Config.ProjectName, ctx.Version)
+	return pcl.OpenPullRequest(ctx, repo, nix.Repository.PullRequest.Base, title)
+}
+
+func doBuildPkg(ctx *context.Context, data templateData) (string, error) {
+	t, err := template.
+		New(data.Name).
+		Parse(string(pkgTmpl))
+	if err != nil {
+		return "", err
+	}
+	var out bytes.Buffer
+	if err := t.Execute(&out, data); err != nil {
+		return "", err
+	}
+
+	content, err := tmpl.New(ctx).Apply(out.String())
+	if err != nil {
+		return "", err
+	}
+	out.Reset()
+
+	// Sanitize the template output and get rid of trailing whitespace.
+	var (
+		r = strings.NewReader(content)
+		s = bufio.NewScanner(r)
+	)
+	for s.Scan() {
+		l := strings.TrimRight(s.Text(), " ")
+		_, _ = out.WriteString(l)
+		_ = out.WriteByte('\n')
+	}
+	if err := s.Err(); err != nil {
+		return "", err
+	}
+
+	return out.String(), nil
+}
+
+func postInstall(ctx *context.Context, nix config.Nix, art *artifact.Artifact) ([]string, error) {
+	applied, err := tmpl.New(ctx).WithArtifact(art).Apply(nix.PostInstall)
+	if err != nil {
+		return nil, err
+	}
+	return split(applied), nil
+}
+
+func installs(ctx *context.Context, nix config.Nix, art *artifact.Artifact) ([]string, error) {
+	applied, err := tmpl.New(ctx).WithArtifact(art).Apply(nix.Install)
+	if err != nil {
+		return nil, err
+	}
+	if applied != "" {
+		return split(applied), nil
+	}
+
+	result := []string{"mkdir -p $out/bin"}
+	for _, bin := range artifact.ExtraOr(*art, artifact.ExtraBinaries, []string{}) {
+		result = append(result, fmt.Sprintf("cp -vr ./%s $out/bin/%[1]s", bin))
+	}
+
+	log.WithField("install", result).Warnf("guessing install")
+	return result, nil
+}
+
+func split(s string) []string {
+	var result []string
+	for _, line := range strings.Split(strings.TrimSpace(s), "\n") {
+		line := strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		result = append(result, line)
+	}
+	return result
+}
+
+type shaPrefetcher interface {
+	Prefetch(url string) (string, error)
+	Available() bool
+}
+
+const (
+	zeroHash          = "0000000000000000000000000000000000000000000000000000"
+	nixPrefetchURLBin = "nix-prefetch-url"
+)
+
+type buildShaPrefetcher struct{}
+
+func (buildShaPrefetcher) Prefetch(_ string) (string, error) { return zeroHash, nil }
+func (buildShaPrefetcher) Available() bool                   { return true }
+
+type publishShaPrefetcher struct {
+	bin string
+}
+
+func (p publishShaPrefetcher) Available() bool {
+	_, err := exec.LookPath(p.bin)
+	if err != nil {
+		log.Warnf("%s is not available", p.bin)
+	}
+	return err == nil
+}
+
+func (p publishShaPrefetcher) Prefetch(url string) (string, error) {
+	out, err := exec.Command(p.bin, url).Output()
+	return strings.TrimSpace(string(out)), err
+}

internal/pipe/nix/nix_test.go

@@ -0,0 +1,407 @@
+package nix
+
+import (
+	"html/template"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/goreleaser/goreleaser/internal/artifact"
+	"github.com/goreleaser/goreleaser/internal/client"
+	"github.com/goreleaser/goreleaser/internal/golden"
+	"github.com/goreleaser/goreleaser/internal/testctx"
+	"github.com/goreleaser/goreleaser/pkg/config"
+	"github.com/stretchr/testify/require"
+)
+
+func TestString(t *testing.T) {
+	require.NotEmpty(t, Pipe{}.String())
+}
+
+func TestSkip(t *testing.T) {
+	t.Run("no-nix", func(t *testing.T) {
+		require.True(t, Pipe{}.Skip(testctx.New()))
+	})
+	t.Run("nix-all-good", func(t *testing.T) {
+		require.False(t, NewPublish().Skip(testctx.NewWithCfg(config.Project{
+			Nix: []config.Nix{{}},
+		})))
+	})
+	t.Run("prefetcher-not-in-path", func(t *testing.T) {
+		t.Setenv("PATH", "nope")
+		require.True(t, NewPublish().Skip(testctx.NewWithCfg(config.Project{
+			Nix: []config.Nix{{}},
+		})))
+	})
+}
+
+const fakeNixPrefetchURLBin = "fake-nix-prefetch-url"
+
+func TestPrefetcher(t *testing.T) {
+	t.Run("prefetch", func(t *testing.T) {
+		t.Run("build", func(t *testing.T) {
+			sha, err := buildShaPrefetcher{}.Prefetch("any")
+			require.NoError(t, err)
+			require.Equal(t, zeroHash, sha)
+		})
+		t.Run("publish", func(t *testing.T) {
+			t.Run("no-nix-prefetch-url", func(t *testing.T) {
+				_, err := publishShaPrefetcher{fakeNixPrefetchURLBin}.Prefetch("any")
+				require.ErrorIs(t, err, exec.ErrNotFound)
+			})
+			t.Run("valid", func(t *testing.T) {
+				sha, err := publishShaPrefetcher{nixPrefetchURLBin}.Prefetch("https://github.com/goreleaser/goreleaser/releases/download/v1.18.2/goreleaser_Darwin_arm64.tar.gz")
+				require.NoError(t, err)
+				require.Equal(t, "0girjxp07srylyq36xk1ska8p68m2fhp05xgyv4wkcl61d6rzv3y", sha)
+			})
+		})
+	})
+	t.Run("available", func(t *testing.T) {
+		t.Run("build", func(t *testing.T) {
+			require.True(t, buildShaPrefetcher{}.Available())
+		})
+		t.Run("publish", func(t *testing.T) {
+			t.Run("no-nix-prefetch-url", func(t *testing.T) {
+				require.False(t, publishShaPrefetcher{fakeNixPrefetchURLBin}.Available())
+			})
+			t.Run("valid", func(t *testing.T) {
+				require.True(t, publishShaPrefetcher{nixPrefetchURLBin}.Available())
+			})
+		})
+	})
+}
+
+func TestRunPipe(t *testing.T) {
+	for _, tt := range []struct {
+		name                 string
+		expectRunErrorIs     error
+		expectPublishErrorIs error
+		nix                  config.Nix
+	}{
+		{
+			name: "minimal",
+			nix: config.Nix{
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name: "open-pr",
+			nix: config.Nix{
+				Name:        "foo",
+				IDs:         []string{"foo"},
+				Description: "my test",
+				Homepage:    "https://goreleaser.com",
+				License:     "mit",
+				Path:        "pkgs/foo.nix",
+				Repository: config.RepoRef{
+					Owner:  "foo",
+					Name:   "bar",
+					Branch: "update-{{.Version}}",
+					PullRequest: config.PullRequest{
+						Enabled: true,
+					},
+				},
+			},
+		},
+		{
+			name: "wrapped-in-dir",
+			nix: config.Nix{
+				Name:        "wrapped-in-dir",
+				IDs:         []string{"wrapped-in-dir"},
+				Description: "my test",
+				Homepage:    "https://goreleaser.com",
+				License:     "mit",
+				PostInstall: `
+					echo "do something"
+				`,
+				Install: `
+					mkdir -p $out/bin
+					cp foo $out/bin/foo
+				`,
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name: "unibin",
+			nix: config.Nix{
+				Name:        "unibin",
+				IDs:         []string{"unibin"},
+				Description: "my test",
+				Homepage:    "https://goreleaser.com",
+				License:     "mit",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name: "no-archives",
+			expectRunErrorIs: errNoArchivesFound{
+				goamd64: "v2",
+				ids:     []string{"nopenopenope"},
+			},
+			nix: config.Nix{
+				Name:    "no-archives",
+				IDs:     []string{"nopenopenope"},
+				Goamd64: "v2",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name: "unibin-replaces",
+			nix: config.Nix{
+				Name:        "unibin-replaces",
+				IDs:         []string{"unibin-replaces"},
+				Description: "my test",
+				Homepage:    "https://goreleaser.com",
+				License:     "mit",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name: "partial",
+			nix: config.Nix{
+				Name: "partial",
+				IDs:  []string{"partial"},
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name:             "no-repo-name",
+			expectRunErrorIs: errNoRepoName,
+			nix: config.Nix{
+				Name: "doesnotmatter",
+				Repository: config.RepoRef{
+					Owner: "foo",
+				},
+			},
+		},
+		{
+			name:             "bad-name-tmpl",
+			expectRunErrorIs: &template.Error{},
+			nix: config.Nix{
+				Name: "{{ .Nope }}",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name:             "bad-repo-tmpl",
+			expectRunErrorIs: &template.Error{},
+			nix: config.Nix{
+				Name: "doesnotmatter",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "{{ .Nope }}",
+				},
+			},
+		},
+		{
+			name:             "bad-skip-upload-tmpl",
+			expectRunErrorIs: &template.Error{},
+			nix: config.Nix{
+				Name:       "doesnotmatter",
+				SkipUpload: "{{ .Nope }}",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name:             "bad-install-tmpl",
+			expectRunErrorIs: &template.Error{},
+			nix: config.Nix{
+				Name:    "foo",
+				Install: `{{.NoInstall}}`,
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name:             "bad-post-install-tmpl",
+			expectRunErrorIs: &template.Error{},
+			nix: config.Nix{
+				Name:        "foo",
+				PostInstall: `{{.NoPostInstall}}`,
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name:             "bad-release-url-tmpl",
+			expectRunErrorIs: &template.Error{},
+			nix: config.Nix{
+				Name:        "foo",
+				URLTemplate: "{{.BadURL}}",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name:                 "skip-upload",
+			expectPublishErrorIs: errSkipUpload,
+			nix: config.Nix{
+				Name:       "doesnotmatter",
+				SkipUpload: "true",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+		{
+			name:                 "skip-upload-auto",
+			expectPublishErrorIs: errSkipUploadAuto,
+			nix: config.Nix{
+				Name:       "doesnotmatter",
+				SkipUpload: "auto",
+				Repository: config.RepoRef{
+					Owner: "foo",
+					Name:  "bar",
+				},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			folder := t.TempDir()
+			ctx := testctx.NewWithCfg(
+				config.Project{
+					Dist:        folder,
+					ProjectName: "foo",
+					Nix:         []config.Nix{tt.nix},
+				},
+				testctx.WithVersion("1.2.1"),
+				testctx.WithCurrentTag("v1.2.1"),
+				testctx.WithSemver(1, 2, 1, "rc1"),
+			)
+			createFakeArtifact := func(id, goos, goarch string, extra map[string]any) {
+				path := filepath.Join(folder, "dist/foo_"+goos+goarch+".tar.gz")
+				art := artifact.Artifact{
+					Name:    "foo_" + goos + "_" + goarch + ".tar.gz",
+					Path:    path,
+					Goos:    goos,
+					Goarch:  goarch,
+					Goamd64: "v1",
+					Type:    artifact.UploadableArchive,
+					Extra: map[string]interface{}{
+						artifact.ExtraID:        id,
+						artifact.ExtraFormat:    "tar.gz",
+						artifact.ExtraBinaries:  []string{"foo"},
+						artifact.ExtraWrappedIn: "",
+					},
+				}
+				for k, v := range extra {
+					art.Extra[k] = v
+				}
+				ctx.Artifacts.Add(&art)
+
+				require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+				f, err := os.Create(path)
+				require.NoError(t, err)
+				require.NoError(t, f.Close())
+			}
+
+			createFakeArtifact("unibin-replaces", "darwin", "all", map[string]any{artifact.ExtraReplaces: true})
+			createFakeArtifact("unibin", "darwin", "all", nil)
+			for _, goos := range []string{"linux", "darwin", "windows"} {
+				for _, goarch := range []string{"amd64", "arm64", "386"} {
+					if goos+goarch == "darwin386" {
+						continue
+					}
+					if goarch == "amd64" {
+						createFakeArtifact("partial", goos, goarch, nil)
+					}
+					createFakeArtifact("foo", goos, goarch, nil)
+					createFakeArtifact("unibin", goos, goarch, nil)
+					createFakeArtifact("unibin-replaces", goos, goarch, nil)
+					createFakeArtifact("wrapped-in-dir", goos, goarch, map[string]any{artifact.ExtraWrappedIn: "./foo"})
+				}
+			}
+
+			client := client.NewMock()
+			bpipe := NewBuild()
+			ppipe := Pipe{
+				fakeNixShaPrefetcher{
+					"https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz":  "sha1",
+					"https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz":  "sha2",
+					"https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz": "sha3",
+					"https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz": "sha4",
+					"https://dummyhost/download/v1.2.1/foo_darwin_all.tar.gz":   "sha5",
+				},
+			}
+
+			// default
+			require.NoError(t, bpipe.Default(ctx))
+
+			// run
+			if tt.expectRunErrorIs != nil {
+				err := bpipe.runAll(ctx, client)
+				require.ErrorAs(t, err, &tt.expectPublishErrorIs)
+				return
+			}
+			require.NoError(t, bpipe.runAll(ctx, client))
+			bts, err := os.ReadFile(ctx.Artifacts.Filter(artifact.ByType(artifact.Nixpkg)).Paths()[0])
+			require.NoError(t, err)
+			golden.RequireEqualExt(t, bts, "_build.nix")
+
+			// publish
+			if tt.expectPublishErrorIs != nil {
+				err := ppipe.publishAll(ctx, client)
+				require.ErrorAs(t, err, &tt.expectPublishErrorIs)
+				return
+			}
+			require.NoError(t, ppipe.publishAll(ctx, client))
+			require.True(t, client.CreatedFile)
+			golden.RequireEqualExt(t, []byte(client.Content), "_publish.nix")
+			require.NotContains(t, client.Content, strings.Repeat("0", 52))
+
+			if tt.nix.Repository.PullRequest.Enabled {
+				require.True(t, client.OpenedPullRequest)
+			}
+			if tt.nix.Path != "" {
+				require.Equal(t, tt.nix.Path, client.Path)
+			}
+		})
+	}
+}
+
+func TestErrNoArchivesFound(t *testing.T) {
+	require.EqualError(t, errNoArchivesFound{
+		goamd64: "v1",
+		ids:     []string{"foo", "bar"},
+	}, "no linux/macos archives found matching goos=[darwin linux] goarch=[amd64 arm64 386] goamd64=v1 ids=[foo bar]")
+}
+
+type fakeNixShaPrefetcher map[string]string
+
+func (m fakeNixShaPrefetcher) Prefetch(url string) (string, error) {
+	return m[url], nil
+}
+func (m fakeNixShaPrefetcher) Available() bool { return true }

internal/pipe/nix/template.go

@@ -0,0 +1,23 @@
+package nix
+
+import _ "embed"
+
+//go:embed tmpl.nix
+var pkgTmpl []byte
+
+type Archive struct {
+	URL, Sha string
+}
+
+type templateData struct {
+	Name        string
+	Version     string
+	Install     []string
+	PostInstall []string
+	SourceRoot  string
+	Archives    map[string]Archive
+	Description string
+	Homepage    string
+	License     string
+	Platforms   []string
+}

internal/pipe/nix/testdata/TestRunPipe/minimal_build.nix.golden

@@ -0,0 +1,48 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    i686-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-linux = "0000000000000000000000000000000000000000000000000000";
+    aarch64-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
+    aarch64-darwin = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "foo";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/minimal_publish.nix.golden

@@ -0,0 +1,47 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    x86_64-linux = "sha1";
+    aarch64-linux = "sha2";
+    x86_64-darwin = "sha3";
+    aarch64-darwin = "sha4";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "foo";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/open-pr_build.nix.golden

@@ -0,0 +1,51 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    i686-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-linux = "0000000000000000000000000000000000000000000000000000";
+    aarch64-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
+    aarch64-darwin = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "foo";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+    description = "my test";
+    homepage = "https://goreleaser.com";
+    license = licenses.mit;
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/open-pr_publish.nix.golden

@@ -0,0 +1,50 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    x86_64-linux = "sha1";
+    aarch64-linux = "sha2";
+    x86_64-darwin = "sha3";
+    aarch64-darwin = "sha4";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "foo";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+    description = "my test";
+    homepage = "https://goreleaser.com";
+    license = licenses.mit;
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/partial_build.nix.golden

@@ -0,0 +1,39 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    x86_64-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  urlMap = {
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "partial";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+
+    platforms = [
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/partial_publish.nix.golden

@@ -0,0 +1,39 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    x86_64-linux = "sha1";
+    x86_64-darwin = "sha3";
+  };
+
+  urlMap = {
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "partial";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+
+    platforms = [
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/skip-upload-auto_build.nix.golden

@@ -0,0 +1,48 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    i686-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-linux = "0000000000000000000000000000000000000000000000000000";
+    aarch64-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
+    aarch64-darwin = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "doesnotmatter";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/skip-upload_build.nix.golden

@@ -0,0 +1,48 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    i686-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-linux = "0000000000000000000000000000000000000000000000000000";
+    aarch64-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
+    aarch64-darwin = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "doesnotmatter";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/unibin-replaces_build.nix.golden

@@ -0,0 +1,51 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    i686-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-linux = "0000000000000000000000000000000000000000000000000000";
+    aarch64-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
+    aarch64-darwin = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "unibin-replaces";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+    description = "my test";
+    homepage = "https://goreleaser.com";
+    license = licenses.mit;
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/unibin-replaces_publish.nix.golden

@@ -0,0 +1,50 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    x86_64-linux = "sha1";
+    aarch64-linux = "sha2";
+    x86_64-darwin = "sha3";
+    aarch64-darwin = "sha4";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "unibin-replaces";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+    description = "my test";
+    homepage = "https://goreleaser.com";
+    license = licenses.mit;
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/unibin_build.nix.golden

@@ -0,0 +1,51 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    i686-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-linux = "0000000000000000000000000000000000000000000000000000";
+    aarch64-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
+    aarch64-darwin = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "unibin";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+    description = "my test";
+    homepage = "https://goreleaser.com";
+    license = licenses.mit;
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/unibin_publish.nix.golden

@@ -0,0 +1,50 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    x86_64-linux = "sha1";
+    aarch64-linux = "sha2";
+    x86_64-darwin = "sha3";
+    aarch64-darwin = "sha4";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "unibin";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./foo $out/bin/foo
+  '';
+
+  system = system;
+
+  meta = with lib; {
+    description = "my test";
+    homepage = "https://goreleaser.com";
+    license = licenses.mit;
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/wrapped-in-dir_build.nix.golden

@@ -0,0 +1,54 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    i686-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-linux = "0000000000000000000000000000000000000000000000000000";
+    aarch64-linux = "0000000000000000000000000000000000000000000000000000";
+    x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
+    aarch64-darwin = "0000000000000000000000000000000000000000000000000000";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "wrapped-in-dir";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = "./foo";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp foo $out/bin/foo
+  '';
+  postInstall = ''
+    echo "do something"
+  '';
+
+  system = system;
+
+  meta = with lib; {
+    description = "my test";
+    homepage = "https://goreleaser.com";
+    license = licenses.mit;
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/testdata/TestRunPipe/wrapped-in-dir_publish.nix.golden

@@ -0,0 +1,53 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    x86_64-linux = "sha1";
+    aarch64-linux = "sha2";
+    x86_64-darwin = "sha3";
+    aarch64-darwin = "sha4";
+  };
+
+  urlMap = {
+    i686-linux = "https://dummyhost/download/v1.2.1/foo_linux_386.tar.gz";
+    x86_64-linux = "https://dummyhost/download/v1.2.1/foo_linux_amd64.tar.gz";
+    aarch64-linux = "https://dummyhost/download/v1.2.1/foo_linux_arm64.tar.gz";
+    x86_64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_amd64.tar.gz";
+    aarch64-darwin = "https://dummyhost/download/v1.2.1/foo_darwin_arm64.tar.gz";
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "wrapped-in-dir";
+  version = "1.2.1";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = "./foo";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp foo $out/bin/foo
+  '';
+  postInstall = ''
+    echo "do something"
+  '';
+
+  system = system;
+
+  meta = with lib; {
+    description = "my test";
+    homepage = "https://goreleaser.com";
+    license = licenses.mit;
+
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "i686-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+  };
+}

internal/pipe/nix/tmpl.nix

@@ -0,0 +1,84 @@
+# vim: set ft=nix ts=2 sw=2 sts=2 et sta
+{ system ? builtins.currentSystem, pkgs, lib, fetchurl, installShellFiles }:
+let
+  shaMap = {
+    {{- with  .Archives.linux386.Sha }}
+    i686-linux = "{{ . }}";
+    {{- end }}
+    {{- with  .Archives.linuxamd64.Sha }}
+    x86_64-linux = "{{ . }}";
+    {{- end }}
+    {{- with  .Archives.linuxarm64.Sha }}
+    aarch64-linux = "{{ . }}";
+    {{- end }}
+    {{- with  .Archives.darwinamd64.Sha }}
+    x86_64-darwin = "{{ . }}";
+    {{- end }}
+    {{- with  .Archives.darwinarm64.Sha }}
+    aarch64-darwin = "{{ . }}";
+    {{- end }}
+  };
+
+  urlMap = {
+    {{- with  .Archives.linux386.URL }}
+    i686-linux = "{{ . }}";
+    {{- end }}
+    {{- with  .Archives.linuxamd64.URL }}
+    x86_64-linux = "{{ . }}";
+    {{- end }}
+    {{- with  .Archives.linuxarm64.URL }}
+    aarch64-linux = "{{ . }}";
+    {{- end }}
+    {{- with  .Archives.darwinamd64.URL }}
+    x86_64-darwin = "{{ . }}";
+    {{- end }}
+    {{- with  .Archives.darwinarm64.URL }}
+    aarch64-darwin = "{{ . }}";
+    {{- end }}
+  };
+in pkgs.stdenv.mkDerivation {
+  pname = "{{ .Name }}";
+  version = "{{ .Version }}";
+  src = fetchurl {
+    url = urlMap.${system};
+    sha256 = shaMap.${system};
+  };
+
+  sourceRoot = "{{ .SourceRoot }}";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    {{- range $index, $element := .Install }}
+    {{ . -}}
+    {{- end }}
+  '';
+
+  {{- with .PostInstall }}
+  postInstall = ''
+    {{- range $index, $element := . }}
+    {{ . -}}
+    {{- end }}
+  '';
+  {{- end }}
+
+  system = system;
+
+  meta = with lib; {
+    {{- with .Description }}
+    description = "{{ . }}";
+    {{- end }}
+    {{- with .Homepage }}
+    homepage = "{{ . }}";
+    {{- end }}
+    {{- with .License }}
+    license = licenses.{{ . }};
+    {{- end }}
+
+    platforms = [
+      {{- range $index, $plat := .Platforms }}
+      "{{ . }}"
+      {{- end }}
+    ];
+  };
+}

internal/pipe/publish/publish.go

@@ -17,6 +17,7 @@ import (
 	"github.com/goreleaser/goreleaser/internal/pipe/ko"
 	"github.com/goreleaser/goreleaser/internal/pipe/krew"
 	"github.com/goreleaser/goreleaser/internal/pipe/milestone"
+	"github.com/goreleaser/goreleaser/internal/pipe/nix"
 	"github.com/goreleaser/goreleaser/internal/pipe/release"
 	"github.com/goreleaser/goreleaser/internal/pipe/scoop"
 	"github.com/goreleaser/goreleaser/internal/pipe/sign"
@@ -47,6 +48,7 @@ var publishers = []Publisher{
 	// This should be one of the last steps
 	release.Pipe{},
 	// brew et al use the release URL, so, they should be last
+	nix.NewPublish(),
 	brew.Pipe{},
 	aur.Pipe{},
 	krew.Pipe{},

internal/pipeline/pipeline.go

@@ -23,6 +23,7 @@ import (
 	"github.com/goreleaser/goreleaser/internal/pipe/krew"
 	"github.com/goreleaser/goreleaser/internal/pipe/metadata"
 	"github.com/goreleaser/goreleaser/internal/pipe/nfpm"
+	"github.com/goreleaser/goreleaser/internal/pipe/nix"
 	"github.com/goreleaser/goreleaser/internal/pipe/prebuild"
 	"github.com/goreleaser/goreleaser/internal/pipe/publish"
 	"github.com/goreleaser/goreleaser/internal/pipe/reportsizes"
@@ -109,6 +110,8 @@ var Pipeline = append(
 	sign.Pipe{},
 	// create arch linux aur pkgbuild
 	aur.Pipe{},
+	// create nixpkgs
+	nix.NewBuild(),
 	// create brew tap
 	brew.Pipe{},
 	// krew plugins

pkg/config/config.go

@@ -197,6 +197,23 @@ type Homebrew struct {
 	Service               string               `yaml:"service,omitempty" json:"service,omitempty"`
 }
 
+type Nix struct {
+	Name                  string       `yaml:"name,omitempty" json:"name,omitempty"`
+	Path                  string       `yaml:"path,omitempty" json:"path,omitempty"`
+	Repository            RepoRef      `yaml:"repository,omitempty" json:"repository,omitempty"`
+	CommitAuthor          CommitAuthor `yaml:"commit_author,omitempty" json:"commit_author,omitempty"`
+	CommitMessageTemplate string       `yaml:"commit_msg_template,omitempty" json:"commit_msg_template,omitempty"`
+	IDs                   []string     `yaml:"ids,omitempty" json:"ids,omitempty"`
+	Goamd64               string       `yaml:"goamd64,omitempty" json:"goamd64,omitempty"`
+	SkipUpload            string       `yaml:"skip_upload,omitempty" json:"skip_upload,omitempty" jsonschema:"oneof_type=string;boolean"`
+	URLTemplate           string       `yaml:"url_template,omitempty" json:"url_template,omitempty"`
+	Install               string       `yaml:"install,omitempty" json:"install,omitempty"`
+	PostInstall           string       `yaml:"post_install,omitempty" json:"post_install,omitempty"`
+	Description           string       `yaml:"description,omitempty" json:"description,omitempty"`
+	Homepage              string       `yaml:"homepage,omitempty" json:"homepage,omitempty"`
+	License               string       `yaml:"license,omitempty" json:"license,omitempty"`
+}
+
 // Krew contains the krew section.
 type Krew struct {
 	IDs                   []string     `yaml:"ids,omitempty" json:"ids,omitempty"`
@@ -966,6 +983,7 @@ type Project struct {
 	Release         Release          `yaml:"release,omitempty" json:"release,omitempty"`
 	Milestones      []Milestone      `yaml:"milestones,omitempty" json:"milestones,omitempty"`
 	Brews           []Homebrew       `yaml:"brews,omitempty" json:"brews,omitempty"`
+	Nix             []Nix            `yaml:"nix,omitempty" json:"nix,omitempty"`
 	AURs            []AUR            `yaml:"aurs,omitempty" json:"aurs,omitempty"`
 	Krews           []Krew           `yaml:"krews,omitempty" json:"krews,omitempty"`
 	Kos             []Ko             `yaml:"kos,omitempty" json:"kos,omitempty"`

pkg/defaults/defaults.go

@@ -23,6 +23,7 @@ import (
 	"github.com/goreleaser/goreleaser/internal/pipe/mattermost"
 	"github.com/goreleaser/goreleaser/internal/pipe/milestone"
 	"github.com/goreleaser/goreleaser/internal/pipe/nfpm"
+	"github.com/goreleaser/goreleaser/internal/pipe/nix"
 	"github.com/goreleaser/goreleaser/internal/pipe/opencollective"
 	"github.com/goreleaser/goreleaser/internal/pipe/project"
 	"github.com/goreleaser/goreleaser/internal/pipe/reddit"
@@ -78,6 +79,7 @@ var Defaulters = []Defaulter{
 	blob.Pipe{},
 	upload.Pipe{},
 	aur.Pipe{},
+	nix.Pipe{},
 	brew.Pipe{},
 	krew.Pipe{},
 	ko.Pipe{},

www/docs/customization/nix.md

@@ -0,0 +1,182 @@
+# Nixpkgs
+
+> Since: v1.19
+
+After releasing to GitHub, GitLab, or Gitea, GoReleaser can generate and publish
+a _nixpkg_ to a [Nix User Repository][nur].
+
+[nur]: https://github.com/nix-community/NUR
+
+The `nix` section specifies how the pkgs should be created:
+
+```yaml
+# .goreleaser.yaml
+nix:
+  -
+    # Name of the recipe
+    #
+    # Default: ProjectName
+    # Templates: allowed
+    name: myproject
+
+    # IDs of the archives to use.
+    # Empty means all IDs.
+    ids:
+    - foo
+    - bar
+
+    # GOAMD64 to specify which amd64 version to use if there are multiple
+    # versions from the build section.
+    #
+    # Default: v1
+    goamd64: v1
+
+    # GitHub/GitLab repository to push the pkg to.
+    repository:
+      # Repository owner.
+      #
+      # Templates: allowed
+      owner: user
+
+      # Repository name.
+      #
+      # Templates: allowed
+      name: nur
+
+      # Optionally a branch can be provided.
+      #
+      # Default: default repository branch.
+      # Templates: allowed
+      branch: main
+
+      # Optionally a token can be provided, if it differs from the token
+      # provided to GoReleaser
+      #
+      # Templates: allowed
+      token: "{{ .Env.NUR_GITHUB_TOKEN }}"
+
+      # Sets up pull request creation instead of just pushing to the given branch.
+      # Make sure the 'branch' property is different from base before enabling
+      # it.
+      pull_request:
+        # Whether to enable it or not.
+        enabled: true
+
+        # Base branch of the PR.
+        #
+        # Default: default repository branch.
+        base: main
+
+      # Clone, create the file, commit and push, to a regular Git repository.
+      #
+      # Notice that this will only have any effect if the given URL is not
+      # empty.
+      git:
+        # The Git URL to push.
+        #
+        # Templates: allowed
+        url: 'ssh://git@myserver.com:repo.git'
+
+        # The SSH private key that should be used to commit to the Git
+        # repository.
+        # This can either be a path or the key contents.
+        #
+        # IMPORTANT: the key must not be password-protected.
+        #
+        # WARNING: do not expose your private key in the configuration file!
+        #
+        # Templates: allowed
+        private_key: '{{ .Env.PRIVATE_KEY_PATH }}'
+
+        # The value to be passed to `GIT_SSH_COMMAND`.
+        # This is mainly used to specify the SSH private key used to pull/push
+        # to the Git URL.
+        #
+        # Default: 'ssh -i {{ .KeyPath }} -o StrictHostKeyChecking=accept-new -F /dev/null'
+        # Templates: allowed
+        ssh_command: 'ssh -i {{ .Env.KEY }} -o SomeOption=yes'
+
+    # URL which is determined by the given Token (github, gitlab or gitea).
+    #
+    # Default depends on the client.
+    # Templates: allowed
+    url_template: "https://github.mycompany.com/foo/bar/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
+
+    # Git author used to commit to the repository.
+    commit_author:
+      name: goreleaserbot
+      email: bot@goreleaser.com
+
+    # The project name and current git tag are used in the format string.
+    #
+    # Templates: allowed
+    commit_msg_template: "{{ .ProjectName }}: {{ .Tag }}"
+
+    # Path for the file inside the repository.
+    #
+    # Default: pkgs/<name>/default.nix
+    path: pkgs/foo.nix
+
+    # Your app's homepage.
+    homepage: "https://example.com/"
+
+    # Your app's description.
+    #
+    # Templates: allowed
+    description: "Software to create fast and easy drum rolls."
+
+    # License name.
+    license: "mit"
+
+    # Setting this will prevent goreleaser to actually try to commit the updated
+    # package - instead, it will be stored on the dist folder only,
+    # leaving the responsibility of publishing it to the user.
+    #
+    # If set to auto, the release will not be uploaded to the repository
+    # in case there is an indicator for prerelease in the tag e.g. v1.0.0-rc1
+    #
+    # Templates: allowed
+    skip_upload: true
+
+    # Custom install script.
+    #
+    # Default: 'mkdir -p $out/bin; cp -vr $binary $out/bin/$binary'
+    # Templates: allowed
+    install: |
+      mkdir -p $out/bin
+      cp -vr ./foo $out/bin/foo
+      installManPage ./manpages/foo.1.gz
+
+    # Custom post_install script.
+    # Could be used to do any additional work after the "install" script
+    #
+    # Templates: allowed
+    post_install: |
+      installShellCompletion ./completions/*
+```
+
+!!! tip
+    Learn more about the [name template engine](/customization/templates/).
+
+## `nix-prefetch-url`
+
+The `nix-prefetch-url` binary must be available in the `$PATH` for the
+publishing to work.
+
+## Compile from source
+
+GoReleaser does not (yet) generate packages that compile the Go module from
+source.
+It's planned for next releases, though.
+
+## GitHub Actions
+
+To publish a package from one repository to another using GitHub Actions, you
+cannot use the default action token.
+You must use a separate token with content write privileges for the tap
+repository.
+You can check the
+[resource not accessible by integration](/errors/resource-not-accessible-by-integration/)
+for more information.
+
+

www/docs/install.md

@@ -103,6 +103,49 @@ Below you can find the steps for each of them.
     yay -S goreleaser-pro-bin
     ```
 
+
+### nix
+
+#### nixpkgs
+
+=== "OSS"
+    ```bash
+    nix-env -iA goreleaser
+    ```
+
+!!! info
+    The [package in nixpkgs](https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/misc/goreleaser/default.nix)
+    might be slightly outdated, as it is not updated automatically.
+    Use our NUR to always get the latest updates.
+
+#### nur
+
+First, you'll need to add our [NUR][nur] to your nix configuration.
+You can follow the guides
+[here](https://github.com/nix-community/NUR#installation).
+
+Once you do that, you can install the packages.
+
+[nur]: https://github.com/goreleaser/nur
+
+=== "OSS"
+    ```nix
+    { pkgs, lib, ... }: {
+      home.packages = with pkgs; [
+        nur.repos.goreleaser.goreleaser
+      ];
+    }
+    ```
+
+=== "Pro"
+    ```nix
+    { pkgs, lib, ... }: {
+      home.packages = with pkgs; [
+        nur.repos.goreleaser.goreleaser-pro
+      ];
+    }
+    ```
+
 ### deb, rpm and apk packages
 
 === "OSS"

www/mkdocs.yml

@@ -129,6 +129,7 @@ nav:
     - customization/blob.md
     - customization/fury.md
     - customization/homebrew.md
+    - customization/nix.md
     - customization/aur.md
     - customization/krew.md
     - customization/scoop.md