chore: manage dev environment with devenv

.gitignore

@@ -32,3 +32,8 @@ report.html
 # Ignore exports
 export-*.json
 export-*.md
+
+# devenv
+.devenv/
+# autogenerated pre-commit config (managed by git-hooks.nix)
+.pre-commit-config.yaml

README.md

@@ -193,11 +193,20 @@ cabal run cert-prep -- ./config.json
 
 ### Development
 
-Pre-commit hooks (hpack, fourmolu, hlint) are configured in
-`.pre-commit-config.yaml` and run with [prek](https://github.com/j178/prek).
-They expect `hpack`, `fourmolu`, and `hlint` on your PATH (e.g. via ghcup or
-`cabal install`). Activate them once per clone:
+The development environment is managed with [devenv](https://devenv.sh/). It provides GHC, Cabal, Haskell Language Server, linters, and git hooks.
 
 ```bash
-prek install
+devenv shell
 ```
+
+Entering the shell automatically installs and configures the git hooks (`hpack`, `fourmolu`, `hlint`, `yamllint`).
+
+Common tasks:
+
+```bash
+devenv tasks run cert-prep:build   # build using cabal.fast.project
+devenv tasks run cert-prep:test    # run test suite
+devenv tasks run cert-prep:lint    # run hlint
+```
+
+For AI explanations during development, set `GEMINI_API_KEY` in a `.env` file (managed via Secretspec).

devenv.lock

@@ -0,0 +1,117 @@
+{
+  "nodes": {
+    "devenv": {
+      "locked": {
+        "dir": "src/modules",
+        "lastModified": 1788550903,
+        "narHash": "sha256-XMMZULOICeCNuJPFzUyy6KRws26ug78HmbAqtEmXVxk=",
+        "owner": "cachix",
+        "repo": "devenv",
+        "rev": "2769b83ebd3e259192740ee40e39af59c5642774",
+        "type": "github"
+      },
+      "original": {
+        "dir": "src/modules",
+        "owner": "cachix",
+        "repo": "devenv",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1788267358,
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1787631388,
+        "narHash": "sha256-vMiXptXarfSdJb1Gkc+FYVOAibuBRj7qxGa8z68q1Uw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ac6b2166e7a9375683b8e98f860f273222337b16",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1787394516,
+        "narHash": "sha256-pRGOQSClnXNI2iLUG6DYpsGvYcuw0drOutVZFTJNw90=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c8f90650c15282fa8656a041bfbbd2403997a9a7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "inputs": {
+        "nixpkgs-src": "nixpkgs-src"
+      },
+      "locked": {
+        "lastModified": 1787753358,
+        "narHash": "sha256-Tl77VbWyAKrOfRNQhL6JbQtb/MLzbYa/1RG1gWWfICk=",
+        "owner": "cachix",
+        "repo": "devenv-nixpkgs",
+        "rev": "256551e45f6303e142ab4a98be1bf243feb77dc0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "rolling",
+        "repo": "devenv-nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "devenv": "devenv",
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_2"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

devenv.nix

@@ -0,0 +1,60 @@
+{ pkgs, config, ... }:
+{
+  packages = [
+    pkgs.hlint
+    pkgs.hpack
+  ];
+  languages.haskell = {
+    enable = true;
+    # Enable this as soon as lsp supports 9.14.1
+    # package = pkgs.haskell.compiler.ghc9141;
+    cabal.enable = true;
+    lsp.enable = true;
+    stack.enable = false;
+  };
+
+  # Replaces .pre-commit-config.yaml with an autogenerated symlink.
+  git-hooks.hooks = {
+    hpack = {
+      enable = true;
+      entry = "hpack";
+      files = "^(package\\.yaml|cert-prep\\.cabal)$";
+      pass_filenames = false;
+    };
+    local-fourmolu = {
+      enable = true;
+      name = "fourmolu";
+      entry = "fourmolu";
+      files = ".*\\.hs$";
+      args = [
+        "--mode"
+        "inplace"
+      ];
+    };
+    hlint.enable = true;
+    yamllint = {
+      enable = true;
+      args = [
+        "--strict"
+        "-c"
+        ".yamllint"
+      ];
+    };
+  };
+
+  tasks = {
+    "cert-prep:build".exec = "cabal build --project-file=cabal.fast.project";
+    "cert-prep:test" = {
+      exec = "cabal test --project-file=cabal.fast.project --test-show-details=always";
+      after = [ "cert-prep:build" ];
+      before = [ "devenv:enterTest" ];
+    };
+    "cert-prep:lint".exec = "hlint src app test";
+  };
+
+  env = {
+    GEMINI_API_KEY = config.secretspec.secrets.GEMINI_API_KEY;
+    GEMINI_BASE_URL = "https://generativelanguage.googleapis.com/v1beta/openai";
+    GEMINI_MODEL = "gemini-3.7-flash";
+  };
+}

devenv.yaml

@@ -0,0 +1,8 @@
+inputs:
+  nixpkgs:
+    url: github:cachix/devenv-nixpkgs/rolling
+  git-hooks:
+    url: github:cachix/git-hooks.nix
+secretspec:
+  enable: true
+  provider: dotenv

secretspec.toml

@@ -0,0 +1,6 @@
+[project]
+name = "cert-prep"
+revision = "1.0"
+
+[profiles.default]
+GEMINI_API_KEY = { description = "GEMINI_API_KEY secret", required = true }