From a262e8d4c7ed8e78e372661eb927a92c5130d767 Mon Sep 17 00:00:00 2001
From: Ousama Ben Younes <benyounes.ousama@gmail.com>
Date: Fri, 31 Jul 2026 01:43:56 +0000
Subject: [PATCH] feat(allowlist): add Nix support

---
 internal/config/allowlist/allowed_ext_test.go |  2 ++
 .../allowlist/supported_file_types.json       |  3 +-
 internal/config/rules/rule_docs/nix.md        | 32 +++++++++++++++++++
 internal/config/rules/system_rules.json       |  3 +-
 4 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 internal/config/rules/rule_docs/nix.md

diff --git a/internal/config/allowlist/allowed_ext_test.go b/internal/config/allowlist/allowed_ext_test.go
index aea7132b..aa90e30f 100644
--- a/internal/config/allowlist/allowed_ext_test.go
+++ b/internal/config/allowlist/allowed_ext_test.go
@@ -48,6 +48,8 @@ func TestIsAllowedExt(t *testing.T) {
 		{".BICEP", true},
 		{".proto", true},
 		{".PROTO", true},
+		{".nix", true},
+		{".NIX", true},
 		{".txt", false},
 		{".md", false},
 		{".png", false},
diff --git a/internal/config/allowlist/supported_file_types.json b/internal/config/allowlist/supported_file_types.json
index c976805d..8fa61cf9 100644
--- a/internal/config/allowlist/supported_file_types.json
+++ b/internal/config/allowlist/supported_file_types.json
@@ -78,5 +78,6 @@
   ".hcl",
   ".tfvars",
   ".bicep",
-  ".proto"
+  ".proto",
+  ".nix"
 ]
diff --git a/internal/config/rules/rule_docs/nix.md b/internal/config/rules/rule_docs/nix.md
new file mode 100644
index 00000000..1a66e43b
--- /dev/null
+++ b/internal/config/rules/rule_docs/nix.md
@@ -0,0 +1,32 @@
+> Favor precision over recall: report only Nix issues that are likely to break evaluation, reproducibility, build isolation, security, or deployment behavior. Do not report formatting that `nixfmt` or project style would handle, and do not require flakes when the repository intentionally uses channels or legacy Nix.
+
+#### Evaluation and Attribute Sets
+- Duplicate attribute definitions in the same attrset, or an attribute override that unintentionally replaces a previously defined value in the changed scope.
+- Referencing `self`, `super`, `pkgs`, `config`, or function arguments that are not in scope for the changed expression.
+- `inherit` statements that reference missing names, or inherit from an attrset that cannot contain the requested attribute.
+- Recursive attrsets (`rec`) where a value depends on itself directly or through an obvious cycle.
+
+#### Reproducibility and Pinning
+- Fetchers such as `fetchTarball`, `fetchGit`, `fetchurl`, `fetchFromGitHub`, or `builtins.fetch*` without a fixed revision and hash when the source affects a package, module, or deployment output.
+- Version strings, source revisions, and hashes that are changed inconsistently, for example a package version bump without the matching source revision/hash update.
+- Imports from `<nixpkgs>` or mutable channels in otherwise pinned flake or lockfile-based code, unless existing neighboring code deliberately follows the same pattern.
+
+#### Build and Packaging Correctness
+- Derivations that use undeclared build tools or runtime dependencies instead of adding them to `nativeBuildInputs`, `buildInputs`, `propagatedBuildInputs`, or wrapper inputs.
+- Phase overrides that drop required default behavior without reintroducing it, such as replacing `installPhase` without installing outputs into `$out`.
+- Hardcoded host paths, user home paths, or `/usr/bin` tools inside derivations that should build in the Nix sandbox.
+- `meta.mainProgram`, `passthru.tests`, or output names that are changed inconsistently with installed binaries or referenced package attributes.
+
+#### NixOS and Home Manager Modules
+- Options used before declaration, options with defaults whose type does not match the declared `types.*`, or renamed options without a compatibility alias or migration path.
+- Systemd service, timer, user, group, port, or file path changes that conflict with existing module options or make activation fail.
+- Secrets or credentials embedded directly in module defaults, environment variables, scripts, or generated config instead of coming from secret management or protected files.
+
+#### Overlays and Flakes
+- Overlay functions with argument order or names swapped (`final`/`prev`, `self`/`super`) causing packages to be pulled from the wrong package set.
+- Flake outputs that reference missing inputs, unsupported systems, or package attributes not defined for every advertised system.
+- Adding a package/app/check/devShell for one system while the surrounding flake helper expects all systems to expose the same attribute.
+
+#### Review Scope
+- Focus on evaluation failures, non-reproducible sources, sandbox escapes, missing dependencies, module activation errors, and secret exposure.
+- Do not flag preference-only style choices, attr ordering, or idioms that are consistent with neighboring Nix files.
diff --git a/internal/config/rules/system_rules.json b/internal/config/rules/system_rules.json
index 0dd10066..8a6b867b 100644
--- a/internal/config/rules/system_rules.json
+++ b/internal/config/rules/system_rules.json
@@ -31,6 +31,7 @@
     "**/*.prisma": "prisma.md",
     "**/*.jl": "julia.md",
     "**/*.{tf,hcl,tfvars}": "terraform.md",
-    "**/*.bicep": "bicep.md"
+    "**/*.bicep": "bicep.md",
+    "**/*.nix": "nix.md"
   }
 }