ci: use ruff 0.16.x #36051

This is pretty unrleated, but from the recent "pinning discussion". One could use nix here for a full pin, and only having to modify one line to update all tools, with something like (untested, and the python3.10 install fails):

Also, the uv pip installs remain un-pinned, but maybe this can be done later.

edit: Also, seems to eat 4GB of storage instead of 1GB....

diff --git a/ci/lint/01_install.sh b/ci/lint/01_install.sh
index 9c2020a..86e1e74 100755
--- a/ci/lint/01_install.sh
+++ b/ci/lint/01_install.sh
@@ -8,19 +8,17 @@ export LC_ALL=C
 
 set -o errexit -o pipefail -o xtrace
 
-export DEBIAN_FRONTEND=noninteractive
 export CI_RETRY_EXE="/ci_retry"
 
 pushd "/"
 
-${CI_RETRY_EXE} apt-get update
 # Lint dependencies:
 # - cargo (used to run the lint tests)
-# - curl/xz-utils (to install shellcheck)
+# - curl (used to install mlc)
 # - git (used in many lint scripts)
 # - gpg (used by verify-commits)
 # - moreutils (used by scripted-diff)
-${CI_RETRY_EXE} apt-get install -y cargo curl xz-utils git gpg moreutils
+# These packages are installed via ci/lint/packages.nix.
 
 # Install Python and create venv using uv (reads version from .python-version)
 uv venv /python_env
@@ -31,11 +29,6 @@ python3 --version
 
 uv pip install --python /python_env --requirements /ci/lint/requirements.txt
 
-SHELLCHECK_VERSION=v0.11.0
-curl --fail -L "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.$(uname --machine).tar.xz" | \
-    tar --xz -xf - --directory /tmp/
-mv "/tmp/shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/bin/
-
 MLC_VERSION=v1.2.0
 curl --fail -L "https://github.com/becheran/mlc/releases/download/${MLC_VERSION}/mlc-$(uname --machine)-linux" -o "/usr/bin/mlc"
 chmod +x /usr/bin/mlc
diff --git a/ci/lint/packages.nix b/ci/lint/packages.nix
new file mode 100644
index 0000000..94defe0
--- /dev/null
+++ b/ci/lint/packages.nix
@@ -0,0 +1,17 @@
+let
+  nixpkgs = builtins.fetchTarball {
+    url = "https://github.com/NixOS/nixpkgs/archive/07e1d92cdc0ed416cfa11ff3ca40d17e61cfba7a.tar.gz";
+    sha256 = "1jxgz2l7qpq16aclvd40bzy7rzkph50wb93mwm2fkh6srr5p6a1x";
+  };
+  pkgs = import nixpkgs {};
+in with pkgs; [
+  bash
+  cargo
+  curl
+  git
+  gnupg
+  moreutils
+  ruff
+  shellcheck
+  uv
+]
diff --git a/ci/lint_imagefile b/ci/lint_imagefile
index cc4986a..45a8647 100644
--- a/ci/lint_imagefile
+++ b/ci/lint_imagefile
@@ -4,20 +4,17 @@
 
 # See test/lint/README.md for usage.
 
-FROM mirror.gcr.io/ubuntu:26.04
-
-# Pin uv and ruff to minor version to avoid breaking changes
-# https://docs.astral.sh/uv/reference/policies/versioning/
-# https://docs.astral.sh/ruff/versioning/
-COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /uvx /bin/
-COPY --from=ghcr.io/astral-sh/ruff:0.15 /ruff /bin/
+FROM docker.io/nixos/nix:2.34.3
 
 COPY ./ci/retry/retry /ci_retry
+COPY ./ci/lint/packages.nix /ci/lint/packages.nix
 COPY ./.python-version /.python-version
 COPY ./ci/lint/requirements.txt /ci/lint/requirements.txt
 COPY ./ci/lint/01_install.sh /install.sh
 
-RUN /install.sh && \
-  rm -rf /var/lib/apt/lists/*
+RUN nix-env --uninstall git-minimal && nix-env \
+      --file /ci/lint/packages.nix \
+      --install && \
+    /install.sh
 
 WORKDIR /bitcoin

Looks interesting. Lets discuss in a followup? Some tradeoffs to pinning everything under 1 hash, and it requiring 4x the storage.

I don't think this will be worth it unfortunately. the "nix way" of doing this is to build the actual image itself directly from a nix expression (or flake) using pkgs.dockerTools.buildLayeredImage. I have an example:

https://github.com/willcl-ark/bitcoin-core-docker/blob/master/master/flake.nix https://github.com/willcl-ark/bitcoin-core-docker/blob/master/master/nix/docker.nix

This precisely builds the exact closure. It could be nice-ish, but it would require lint-runners to have nix installed to build the image, which I presume we don't want.

We could have a builder which pushed an image to dockerhub, which would work OK for CI (where we can install nix anyway and rebuild on changes to lint things), but it would require that devs making changes to any lint stuff have nix installed...

Also, we'll inevitably find at some point we want newer or older packages, then have to use multiple nix revisions resulting in ... multiple places to touch when updating package versions!