Cardano Updates

GHC's test suite requires `perl` (e.g. the testsuite driver and various
test scripts). Like `which`, `perl` is not part of stdenv's initialPath
and was only reachable via the host system before the hermetic PATH
change. Add it explicitly to all four shell definitions.

GHC's test suite requires `perl` (e.g. the testsuite driver and various
test scripts). Like `which`, `perl` is not part of stdenv's initialPath
and was only reachable via the host system before the hermetic PATH
change. Add it explicitly to all four shell definitions.

GHC's Makefile unconditionally calls `tput bold` and `tput sgr0`
(lines 217-218) which fail with "No value for $TERM and no -T
specified" when TERM is unset. This happens in CI runners and
containers where no terminal is attached.

Set TERM to "dumb" as a fallback after sourcing setup.sh so ncurses
tools like tput degrade gracefully instead of erroring.

writeTextFile sets `buildCommand` in the derivation, which causes
stdenv's genericBuild to skip the entire phase system — installPhase,
postInstall, fixupPhase — none of them execute. The previous commit
used postInstall which was silently ignored, leaving the wrapper
output without nix-support/propagated-native-build-inputs.

Append the file creation directly to buildCommand, which is the only
code path the builder actually runs.

writeShellApplication uses writeTextFile internally, which does NOT
run stdenv.mkDerivation's fixupPhase. Setting propagatedNativeBuildInputs
via overrideAttrs only adds the attribute to the derivation but never
materializes the $out/nix-support/propagated-native-build-inputs file
that setup.sh's findInputs actually reads at runtime.

Without this file, curl was invisible to the shell environment despite
being set as a propagated dep — the wrapper script itself had curl on
its internal PATH, but other programs (like GHC's stage0 cabal) could
not find it.

Fix: explicitly create the nix-support file in postInstall.

The switch from nix-print-dev-env to devShellTools (a354771) broke
runtimeInputs visibility in -env container scripts. writeShellApplication
embeds runtimeInputs in the wrapper's own PATH, but $stdenv/setup (which
the -env scripts source) only walks buildInputs/nativeBuildInputs — not
the internal PATH of wrappers within those inputs.

The previous fix (76d6b37) added curl explicitly to buildInputs, but
this is fragile: any future runtimeInputs change requires a parallel
edit in the shell's input lists.

Instead, use propagatedNativeBuildInputs on the wrapper derivation.
When $stdenv/setup processes wrapped-cabal from nativeBuildInputs, it
transitively follows propagatedNativeBuildInputs and adds curl (and
cabal-install) to PATH for the whole environment. This is the standard
Nix mechanism for transitive dependency propagation.

Applies to all four shell definitions: dynamic, static, cross-js,
cross-windows. Removes the explicit curl additions from 76d6b37.

* Update workflow step name for prefix-less check-runs

The hydra-github-bridge no longer prefixes check-run names with
"ci/hydra-build:" for zw3rk CI. Update the step name to match.
The JQ filters and wait-for-hydra action (check: required) now
work correctly with the bare job names.

* Update head.hackage FOD hash

The head.hackage index is a rolling target — upstream published new
packages, invalidating the previous hash.

  specified: sha256-nFFut7+8NzUps+4MsmnAo2bLp1EE2Dx4eWqTeZ2aYqI=
  got:       sha256-P0hOiQyh54Y5Pyl9rjpEE5Er/u83aeXIKBygzniRZtk=

* Add curl to shell buildInputs for HTTPS transport

The wrapped-cabal writeShellApplication includes curl as a
runtimeInput, but that only puts curl on PATH when the wrapper
script itself runs. In the -env container scripts (which source
$stdenv/setup to construct PATH from buildInputs/nativeBuildInputs),
curl is NOT on PATH for other programs.

This breaks GHC CI builds: GHC's Makefile bootstraps its own
stage0 cabal (debug build, no native TLS) which then needs curl
on PATH to download packages from Hackage over HTTPS. Without
curl available, it fails with Cabal-7113.

Fix: add curl directly to buildInputs/nativeBuildInputs in
dynamic.nix, static.nix, and cross-js.nix so it's always
available on PATH regardless of how the environment is sourced.

The head.hackage index is a rolling target — upstream published new
packages, invalidating the previous hash.

  specified: sha256-nFFut7+8NzUps+4MsmnAo2bLp1EE2Dx4eWqTeZ2aYqI=
  got:       sha256-P0hOiQyh54Y5Pyl9rjpEE5Er/u83aeXIKBygzniRZtk=

The hydra-github-bridge no longer prefixes check-run names with
"ci/hydra-build:" for zw3rk CI. Update the step name to match.
The JQ filters and wait-for-hydra action (check: required) now
work correctly with the bare job names.

The head.hackage index is a rolling target — upstream published new
packages, invalidating the previous hash.

  specified: sha256-nFFut7+8NzUps+4MsmnAo2bLp1EE2Dx4eWqTeZ2aYqI=
  got:       sha256-P0hOiQyh54Y5Pyl9rjpEE5Er/u83aeXIKBygzniRZtk=

The hydra-github-bridge no longer prefixes check-run names with
"ci/hydra-build:" for zw3rk CI. Update the step name to match.
The JQ filters and wait-for-hydra action (check: required) now
work correctly with the bare job names.

* Drop cabal-experimental input, use regular cabal for all shells

The cabal-experimental input (stable-haskell/cabal cross-compile branch)
was used for withGHCTooling shells. The pinned version (Apr 2025) has
hackage-security bounds incompatible with GHC 9.10+/9.12+ (ghc-prim
>= 0.12), causing IFD plan resolution failures. The newer version
(Aug 2025) fixes that but regresses shared library handling, breaking
downstream CI.

Simplify by using the regular cabal input for all shell variants.

* Update haskell.nix to fix head.hackage FOD hash mismatch

The head.hackage upstream content changed after Feb 21, making the
fixed-output derivation hash stale. With the cached outputs GC'd,
all JS backend IFD evaluations fail with hash mismatch, blocking
the entire Hydra eval (no jobsetevals entry produced).

Update haskell.nix from 7e7550c (Dec 9 2025) to cc939d0 (Feb 23 2026)
which includes the daily "Update Hackage and Stackage" with the
current head.hackage hash.

* Update head.hackage FOD hash and haskell.nix input

The head.hackage upstream content changed (upstream index grew),
making the fixed-output derivation hash in tool-map.nix stale.
With the cached outputs GC'd from hydra builders, all JS backend
IFD evaluations fail with hash mismatch, blocking the entire
Hydra eval (no jobsetevals produced).

Update the head.hackage sha256 from
  sha256-AO/vHIMSIBwjbp5GY561SmnPr5qTTyBt9ruy8D3lKZI=
to
  sha256-nFFut7+8NzUps+4MsmnAo2bLp1EE2Dx4eWqTeZ2aYqI=

Also update haskell.nix from 7e7550c (Dec 2025) to cc939d0
(Feb 23 2026) to pick up latest Hackage/Stackage indexes.

The head.hackage upstream content changed (upstream index grew),
making the fixed-output derivation hash in tool-map.nix stale.
With the cached outputs GC'd from hydra builders, all JS backend
IFD evaluations fail with hash mismatch, blocking the entire
Hydra eval (no jobsetevals produced).

Update the head.hackage sha256 from
  sha256-AO/vHIMSIBwjbp5GY561SmnPr5qTTyBt9ruy8D3lKZI=
to
  sha256-nFFut7+8NzUps+4MsmnAo2bLp1EE2Dx4eWqTeZ2aYqI=

Also update haskell.nix from 7e7550c (Dec 2025) to cc939d0
(Feb 23 2026) to pick up latest Hackage/Stackage indexes.

The head.hackage upstream content changed after Feb 21, making the
fixed-output derivation hash stale. With the cached outputs GC'd,
all JS backend IFD evaluations fail with hash mismatch, blocking
the entire Hydra eval (no jobsetevals entry produced).

Update haskell.nix from 7e7550c (Dec 9 2025) to cc939d0 (Feb 23 2026)
which includes the daily "Update Hackage and Stackage" with the
current head.hackage hash.

The cabal-experimental input (stable-haskell/cabal cross-compile branch)
was used for withGHCTooling shells. The pinned version (Apr 2025) has
hackage-security bounds incompatible with GHC 9.10+/9.12+ (ghc-prim
>= 0.12), causing IFD plan resolution failures. The newer version
(Aug 2025) fixes that but regresses shared library handling, breaking
downstream CI.

Simplify by using the regular cabal input for all shell variants.

The cabal-experimental update from 7e50837 (Apr 2025) to bc52b09
(Aug 2025) introduced a change in pkgsUseSharedLibrary (commit
f47840db) that stopped checking the compiler's capabilities when
deciding whether to build shared libraries. This causes store
dependencies (e.g. os-string) to be installed without .dyn_hi files,
while project packages (e.g. tar) are still built with -dynamic-too,
resulting in missing dynamic interface file errors.

Pin back to the known-working version until the regression is
resolved upstream.

The cabal-experimental update from 7e50837 (Apr 2025) to bc52b09
(Aug 2025) introduced a change in pkgsUseSharedLibrary (commit
f47840db) that stopped checking the compiler's capabilities when
deciding whether to build shared libraries. This causes store
dependencies (e.g. os-string) to be installed without .dyn_hi files,
while project packages (e.g. tar) are still built with -dynamic-too,
resulting in missing dynamic interface file errors.

Pin back to the known-working version until the regression is
resolved upstream.

Flake lock file updates:

• Updated input 'cabal-experimental':
    'github:stable-haskell/cabal/bc52b09' (2025-08-26)
  → 'github:stable-haskell/cabal/8e9a1e3' (2025-12-11)
• Updated input 'haskellNix':
    'github:input-output-hk/haskell.nix/7e7550c' (2025-12-09)
  → 'github:input-output-hk/haskell.nix/96631ac' (2026-02-21)
• Updated input 'haskellNix/hackage':
    'github:input-output-hk/hackage.nix/b0bc4ec' (2025-12-09)
  → 'github:input-output-hk/hackage.nix/0af430c' (2026-02-21)
• Updated input 'haskellNix/hackage-for-stackage':
    'github:input-output-hk/hackage.nix/f3472c5' (2025-12-09)
  → 'github:input-output-hk/hackage.nix/7309ada' (2026-02-21)
• Added input 'haskellNix/hls-2.12':
    'github:haskell/haskell-language-server/7d983de' (2025-09-24)
• Updated input 'haskellNix/iserv-proxy':
    'github:stable-haskell/iserv-proxy/1506051' (2025-08-15)
  → 'github:stable-haskell/iserv-proxy/91ef7ff' (2026-02-04)
• Updated input 'haskellNix/stackage':
    'github:input-output-hk/stackage.nix/238321d' (2025-12-09)
  → 'github:input-output-hk/stackage.nix/8124f3d' (2026-02-21)
• Updated input 'iohk-nix':
    'github:input-output-hk/iohk-nix/a704b93' (2025-11-12)
  → 'github:input-output-hk/iohk-nix/0ce7cc2' (2026-02-02)

Two fixes for CI failures when consuming devx containers:

1. Use Nix-provided Bash in shebang instead of /usr/bin/env bash.
   On macOS GitHub Actions runners, /usr/bin/env bash resolves to
   Apple's Bash 3.2 (GPLv2), but nixpkgs' setup.sh requires Bash 5+.
   pkgs.bash is already in the closure via stdenv.

2. Disable NIX_ENFORCE_PURITY before sourcing stdenv/setup.
   The stdenv preHook defaults NIX_ENFORCE_PURITY to 1, causing
   cc-wrapper to reject -I/-L flags outside /nix/store/. This breaks
   cabal builds that use $HOME/.cabal-devx/store/. Setting it to empty
   before sourcing setup.sh matches nix develop behavior.

Two fixes for CI failures when consuming devx containers:

1. Use Nix-provided Bash in shebang instead of /usr/bin/env bash.
   On macOS GitHub Actions runners, /usr/bin/env bash resolves to
   Apple's Bash 3.2 (GPLv2), but nixpkgs' setup.sh requires Bash 5+.
   pkgs.bash is already in the closure via stdenv.

2. Disable NIX_ENFORCE_PURITY before sourcing stdenv/setup.
   The stdenv preHook defaults NIX_ENFORCE_PURITY to 1, causing
   cc-wrapper to reject -I/-L flags outside /nix/store/. This breaks
   cabal builds that use $HOME/.cabal-devx/store/. Setting it to empty
   before sourcing setup.sh matches nix develop behavior.

* Update to nixpkgs-2511 and bump dependencies

- Switch from nixpkgs-2411 to nixpkgs-2511
- Update cabal-experimental to stable-haskell/feature/cross-compile
- Bump haskell.nix, head.hackage, HLS 2.10→2.11
- Update cabal build configuration to inline constraints
- Fix flake packages attribute naming (dots → dashes)

* Enable all platforms and remove ghc810

- Add aarch64-linux to supportedSystems
- Re-enable macOS and aarch64-linux in CI workflows
- Remove ghc810 from compiler list
- Update lints workflow to use ghc96

* Replace recursive-nix -env jobs with devShellTools

The old -env job generation used recursive-nix to run
`nix print-dev-env` inside a derivation, which is not supported
on remote builders. Replace with pure evaluation-time approach:

- Use devShellTools.unstructuredDerivationInputEnv to extract
  environment variables from mkShell derivations
- Construct PATH via lib.makeBinPath from flattened buildInputs
- Filter internal nix variables, keeping only user-defined ones
- Generate self-contained wrapper scripts at eval time
- Update ghcr-upload.sh to match new -env.sh naming

* Fix nixpkgs-2511 build failures: happy, openssl, postgresql

- happy: disable disallowGhcReference check — happy-2.1.7
  transitively references GHC through happy-lib
- openssl musl: skip flaky OCSP test 82-test_ocsp_cert_chain.t
- postgresql musl: comprehensive fix for pkgsCross.musl64 which
  doesn't set isStatic=true, causing all optional features to
  default on:
  - Disable jitSupport, perlSupport, pythonSupport, tclSupport
  - Override llvmPackages_20 to prevent LLVM stdenv switch
  - Disable LTO (GCC + GNU ld .ltrans failures)
  - Clear outputChecks, disallowedReferences, separateDebugInfo
  - Break dev↔out and lib↔out reference cycles with
    remove-references-to

* Add -env-test Hydra jobs to validate devcontainer environments

Source each -env.sh script in a sandbox and verify that ghc, cabal,
and pkg-config are functional. Optionally checks HLS for non-minimal,
non-JS, non-Windows shells with compiler < 9.11. Catches PATH
construction errors, missing packages, and broken shellHooks that
would produce unusable containers. Not yet in `required` aggregate.

* Fix env wrapper with stdenv/setup, gate GHCR uploads to main

The devShellTools approach only captured Nix-level derivation attributes,
missing hook-computed variables (NIX_CFLAGS_COMPILE, NIX_LDFLAGS,
PKG_CONFIG_PATH, etc.) that stdenv setup hooks produce at shell init
time. This caused downstream "Missing C library" errors.

Fix: export all drvAttrs (including stdenv, buildInputs, initialPath)
then source $stdenv/setup at runtime, exactly like `nix develop` does.
This runs cc-wrapper, pkg-config-wrapper, and all other setup hooks.

Also fix env-tests to save $out before sourcing (setup.sh resets it),
gate GHCR uploads to main branch (prevents PR pushes from overwriting
production images), gate hello.yml to main, and add pr-validate.yml
for PR closure validation via Hydra cache.

* Fix PR validation: paginated API response and devx invocation

gh api --paginate returns multiple JSON objects (one per page).
The old jq heredoc processed each page separately, producing
multiple arrays (some empty []) which GitHub Actions rejected
as invalid output format. Use jq --slurp to merge all pages
into a single array before filtering.

Also fix the validate step: the devx wrapper sources $1 as a
file path, it doesn't support bash-style -c. Write smoke test
commands to a temp file instead.

* Fix devx wrapper: set $out for stdenv/setup outside Nix builds

stdenv's setup.sh calls _assignFirst which requires $out to be set
for output variable assignment. Inside a Nix build the builder sets
$out automatically, but when running the devx wrapper directly
(containers, CI validation) $out is unset and setup.sh fails with:

  error: _assignFirst: could not find a non-empty variable whose
  name to assign to outputDev.

Fix in two places:
- mkEnvScript: wrapper sets $out to a temp dir when unset
- pr-validate.yml: set $out before invoking cached wrappers
  that don't yet include the mkEnvScript fix

* Filter discover to only successfully built check-runs

Hydra posts check-runs at evaluation time before builds complete.
When flake.nix changes cause new derivation hashes, the discover
step would pick up store paths not yet available in any cache,
causing nix-store -r to fail on GH runners.

Filter for conclusion=="success" and valid /nix/store/ paths to
only validate closures that are actually built and cached.

* Set all Nix builder runtime vars for devx wrapper outside builds

setup.sh runs with set -eu and expects NIX_BUILD_TOP, TMPDIR, out,
and other variables that the Nix builder sets at runtime. The
previous fix only set $out; NIX_BUILD_TOP was the next failure.

Set all required builder runtime variables (NIX_BUILD_TOP, TMPDIR,
TMP, TEMP, TEMPDIR, NIX_STORE, out) in both mkEnvScript and the
CI validate step.

Verified locally on hydra: both static (ghc96-static-env) and
dynamic (ghc98-minimal-env) wrappers work correctly.

---------

Co-authored-by: Moritz Angermann <[email protected]>

setup.sh runs with set -eu and expects NIX_BUILD_TOP, TMPDIR, out,
and other variables that the Nix builder sets at runtime. The
previous fix only set $out; NIX_BUILD_TOP was the next failure.

Set all required builder runtime variables (NIX_BUILD_TOP, TMPDIR,
TMP, TEMP, TEMPDIR, NIX_STORE, out) in both mkEnvScript and the
CI validate step.

Verified locally on hydra: both static (ghc96-static-env) and
dynamic (ghc98-minimal-env) wrappers work correctly.

Hydra posts check-runs at evaluation time before builds complete.
When flake.nix changes cause new derivation hashes, the discover
step would pick up store paths not yet available in any cache,
causing nix-store -r to fail on GH runners.

Filter for conclusion=="success" and valid /nix/store/ paths to
only validate closures that are actually built and cached.

stdenv's setup.sh calls _assignFirst which requires $out to be set
for output variable assignment. Inside a Nix build the builder sets
$out automatically, but when running the devx wrapper directly
(containers, CI validation) $out is unset and setup.sh fails with:

  error: _assignFirst: could not find a non-empty variable whose
  name to assign to outputDev.

Fix in two places:
- mkEnvScript: wrapper sets $out to a temp dir when unset
- pr-validate.yml: set $out before invoking cached wrappers
  that don't yet include the mkEnvScript fix

- happy: disable disallowGhcReference check — happy-2.1.7
  transitively references GHC through happy-lib
- openssl musl: skip flaky OCSP test 82-test_ocsp_cert_chain.t
- postgresql musl: comprehensive fix for pkgsCross.musl64 which
  doesn't set isStatic=true, causing all optional features to
  default on:
  - Disable jitSupport, perlSupport, pythonSupport, tclSupport
  - Override llvmPackages_20 to prevent LLVM stdenv switch
  - Disable LTO (GCC + GNU ld .ltrans failures)
  - Clear outputChecks, disallowedReferences, separateDebugInfo
  - Break dev↔out and lib↔out reference cycles with
    remove-references-to