grok-build-nix

This is bitpartner's fork, mirrored from AodhanHayter/grok-build-nix at 9fcaef8 so that the cluster's agent containers depend on a repository we control rather than on a third party's master. The hourly stable-channel tracking runs here, as a Forgejo Actions workflow in .forgejo/workflows/ (the upstream GitHub workflows are removed — they cannot run on this instance). One difference worth knowing: our runners are x86_64-linux only, so releases land on an x86_64-linux verification alone. All three platform hashes are still recorded, since hashing needs a download and not a build.

Consumed by bitpartner/nixos-llm as the grok-build flake input. Repin with nix flake update grok-build there.

The same repo now tracks the other default agent CLIs (agy, claude, codex, junie EAP, hermes, omp, pi). Twice a day the Forgejo workflow checks each upstream and opens a bump PR; it does not push master. See PIPELINE.md.

Nix flake for Grok Build (grok) — xAI's terminal-based AI coding agent. Tracks the upstream stable channel hourly and lands each release only after it builds and runs on Linux and macOS.

Packages the signed binary xAI publishes for each release, not a from-source rebuild, so grok --version here is byte-identical to curl https://x.ai/cli/install.sh | bash.

Use it

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    grok-build-nix = {
      url = "git+https://git.bitp.cz/donach/grok-build-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };
}

Then either take the package directly:

environment.systemPackages = [
  inputs.grok-build-nix.packages.${pkgs.stdenv.hostPlatform.system}.grok
];

or apply the overlay and use pkgs.grok anywhere:

nixpkgs.overlays = [ inputs.grok-build-nix.overlays.default ];

Pin to a release instead of tracking master with ?ref=v0.2.118, or to the newest verified build with ?ref=latest.

Try it without installing

nix run github:AodhanHayter/grok-build-nix

What the package does

Binary	grok, plus .grok-unwrapped (the raw upstream binary)
Completions	bash, zsh and fish, generated from the binary at build time
Auto-updater	disabled via GROK_DISABLE_AUTOUPDATER=1 — the store is read-only, so updates come from bumping this flake
PATH	suffixed with git, ripgrep, procps, and bubblewrap on Linux (grok's sandbox re-execs under bwrap) — suffixed, not prefixed, so your own tools still win
Platforms	aarch64-darwin, x86_64-linux, aarch64-linux — every one built and smoke-tested in CI. x86_64-darwin is deliberately not packaged; nixpkgs is winding it down

The macOS builds carry xAI's code signature, so the derivation never strips them. The Linux builds are statically linked and need no patching.

binName is overridable if you want the binary under a different name:

pkgs.callPackage "${inputs.grok-build-nix}/package.nix" { binName = "grok-build"; }

Automation

Workflow	Trigger	What it does
update.yml	05:00 and 17:00 Europe/Prague	Checks agy, grok, claude, codex, junie EAP, hermes, omp, and pi. A newer version becomes a bump/<tool>-<version> PR for Hermes. Grok is built before its PR. Nothing is pushed to master from CI
ci.yml	push / PR	Same build matrix plus nix flake check
update-flake-lock.yml	weekly	Opens a PR bumping nixpkgs
dependabot.yml	weekly	Pins for GitHub Actions

Grok is built and smoke-tested before its bump PR is opened. The other pins record the upstream version and the linux artifact hash. CI does not push master; Hermes merges the bump PR.

update-flake-lock PRs are opened with GITHUB_TOKEN, which by GitHub's design does not trigger CI. Add a PAT with repo scope as the FLAKE_LOCK_PAT secret if you want CI to run on them.

Updating by hand

./scripts/update-version.sh                 # sync to the channel pointer, then verify the build
./scripts/update-version.sh --check         # report only, changes nothing
./scripts/update-version.sh --version 0.2.118  # pin a specific version

sources.json is the only file a version bump touches: the tracked channel, the version, and one SRI hash per platform.

Licensing

The grok source is Apache-2.0 (see xai-org/grok-build); this package installs the binary xAI builds from it and marks it sourceProvenance = binaryNativeCode. The Nix expressions in this repo are MIT.