ci: fix Renovate's Nix updates and bump nixpkgs to nixos-26.05

[jbw976]

Description of your changes

We've done a bunch of work recently in crossplane and crossplane-runtime to get Renovate+Nix working well together and regular dependency updates (including lock file maintenance) flowing.

This repo also uses Nix as the build system and Renovate to update dependencies, and it's showing some of the same behavior we've fixed recently, e.g., PR #253 which failed its run with:

Command failed: nix run .#tidy
building '/nix/store/...-gomod2nix-dev.drv'...
error: home directory '/homeless-shelter' exists; please remove it to assure purity of builds without sandboxing

This PR ports over all the fixes and updates we worked through in crossplane/crossplane and crossplane-runtime:

• build: give every Go build its own writable HOME crossplane#7652
  • fix(ci): clean /homeless-shelter between Renovate's Nix builds crossplane-runtime#1085
• fix(ci): make the flake.lock schedule reachable and cover release branches crossplane#7661
• fix(ci): prioritize flake.lock maintenance updates crossplane#7695
• fix(ci): pin which Nix Renovate's post-upgrade tasks use crossplane#7709
• build: bump pinned nixpkgs channel from nixos-25.11 to nixos-26.05 crossplane#7715

How has this code been tested

I had an agent run this repo's updated entrypoint inside ghcr.io/renovatebot/renovate:44, the same image the action pulls, and then invoke the crossplane-nix launcher for postUpgradeTasks, which complete successfully:

===== crossplane-nix run .#tidy =====      tidy exit: 0      >>> /homeless-shelter: absent
===== crossplane-nix run .#generate =====  generate exit: 0  >>> /homeless-shelter: absent

git status in that container showed nothing beyond the changes already in this PR, so tidy and generate reproduce the committed gomod2nix.toml and generated code exactly.

I've also run nix flake check (all five checks pass) and nix build .#release, which produces all seven platforms with checksums matching what CI validates.

I have:

• Read and followed Crossplane's contribution process.
• Run ./nix.sh flake check to ensure this PR is ready for review.
• Added or updated unit tests.
• Linked a PR or a docs tracking issue to document this change.
• Added backport release-x.y labels to auto-backport this PR.

Need help with this checklist? See the cheat sheet.

[jbw976]

oops, fixed the goofy title that came from Github using the branch name instead of a commit subject because there's more than 1 commit 😇

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR updates Renovate to use a controlled Nix environment, centralizes XRD schema constants, replaces manual reverse loops with slices.Backward, and updates flake inputs and formatting tools.

Changes

Maintenance updates

Layer / File(s)	Summary
Renovate Nix execution .github/renovate-entrypoint.sh, .github/workflows/renovate.yml	The Renovate environment installs Nix, removes /homeless-shelter after builds, limits builds to one at a time, and uses the crossplane-nix launcher. The workflow shares Renovate version 44.23.0 across validation and execution.
XRD schema constants cmd/crossplane/xrd/generate.go	XRD generation uses shared constants for OpenAPI object types and spec and status fields.
Reverse iteration cleanup cmd/crossplane/render/engine_docker_test.go, cmd/crossplane/trace/internal/printer/default.go	Manual reverse-index loops now use slices.Backward while preserving cleanup and traversal order.
Nix development tooling flake.nix	The flake updates nixpkgs to nixos-26.05 and replaces nixfmt-rfc-style with nixfmt.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: jcogilvie

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title identifies Renovate and Nix but does not clearly describe the configuration, build, and dependency-update changes.	Use a descriptive title such as "Improve Renovate and Nix dependency updates" while keeping it under 72 characters.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the Renovate and Nix configuration changes, their purpose, and the reported testing.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Breaking Changes	✅ Passed	The only changes under cmd/ are loop refactors and string constants; no files under apis/ changed, and public fields, flags, and behavior remain intact.
Feature Gate Requirement	✅ Passed	No files under apis/ changed; Go edits preserve behavior, and the generated protobuf diff only updates the generator version comment. No new experimental feature requires a flag.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/renovate-entrypoint.sh:
- Around line 29-30: Add the Nix configuration setting sandbox = false alongside
max-jobs in the Renovate build configuration, ensuring Renovate builds
explicitly run without sandboxing.
- Around line 40-47: Update the crossplane-nix launcher to set
NIX_USER_CONF_FILES=/dev/null and explicitly unset NIX_CONFIG before executing
/usr/bin/nix, while retaining NIX_CONF_DIR=/etc/nix. Ensure the launcher
prevents user and environment configuration from overriding the pinned settings.
- Around line 32-33: Update the serialized crossplane-nix launcher invocation in
the entrypoint to run /usr/local/bin/nix-clean-homeless-shelter both before
starting and after completing each invocation, including when it fails or is
interrupted, while retaining the existing post-build-hook as a backup.

In @.github/workflows/renovate.yml:
- Line 52: Restrict RENOVATE_ALLOWED_COMMANDS to exact allowlisted invocations
for crossplane-nix run .#tidy, run .#generate, and run .#lint, preventing extra
arguments or alternate subcommands; only retain the broader pattern if this
container’s Docker-socket access is explicitly justified.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e97f6f7d-caa5-4995-8916-1154702d2e2d

📥 Commits

Reviewing files that changed from the base of the PR and between d267815 and 79e0ba3.

⛔ Files ignored due to path filters (5)

• .github/renovate.json5 is excluded by none and included by none
• flake.lock is excluded by !**/*.lock and included by none
• nix/apps.nix is excluded by none and included by none
• nix/checks.nix is excluded by none and included by none
• proto/render/v1alpha1/render.pb.go is excluded by !**/*.pb.go, !**/*.pb.go and included by **/*.go

📒 Files selected for processing (6)

• .github/renovate-entrypoint.sh
• .github/workflows/renovate.yml
• cmd/crossplane/render/engine_docker_test.go
• cmd/crossplane/trace/internal/printer/default.go
• cmd/crossplane/xrd/generate.go
• flake.nix

[haarchri]

thanks - let's see in a bit that the renovate PRs working again

[jbw976]

Thanks for approving/merging @haarchri!

Renovate ran overnight in https://github.com/crossplane/cli/actions/runs/31472551934 and we look to be good with these fixes!

• no /homeless-shelter errors
• we got a lock file maintenance PR in chore(deps): lock file maintenance (main) #258
• postUpradeTasks ran nix commands successfully on fix(deps): update module google.golang.org/protobuf to v1.36.12 (main) #262
• we're getting grouped security vulnerability PRs using a common branch release-2.3-vulnerable-dependencies in fix(deps): update module github.com/go-git/go-git/v5 to v5.19.2 [security] (release-2.3) #263

There are more lock file maintenance PRs for release branches that are rate limited right now, but that's expected until we clear the backlog of updates on main first since Renovate goes branch by branch starting with main. we see the same thing with c/c.

I think these changes are good! 🎉