fix: ensure apps are apps and packages are packages

doc/manual/src/release-notes/rl-next.md

@@ -40,3 +40,7 @@
 
   As before, the old output will continue to work, but `nix flake check` will
   issue a warning about it.
+
+* `nix run` is now stricter wrt what it accepts:
+    * Members of `apps` are now required to be apps (as defined in [the manual](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-run.html#apps))
+    * Member of `packages` or `legacyPackages` cannot be of type "app" when used by `nix run`.

src/nix/app.cc

@@ -65,6 +65,15 @@ UnresolvedApp Installable::toApp(EvalState & state)
 
     auto type = cursor->getAttr("type")->getString();
 
+    std::string expected;
+    if (hasPrefix(attrPath,"apps.")) {
+        expected = "app";
+    } else {
+        expected = "derivation";
+    }
+    if (type != expected) {
+        throw Error("Attribute '%s' should have type '%s'.", attrPath, expected);
+    }
     if (type == "app") {
         auto [program, context] = cursor->getAttr("program")->getStringWithContext();
 

tests/flakes-run.sh

@@ -0,0 +1,29 @@
+source common.sh
+
+clearStore
+rm -rf $TEST_HOME/.cache $TEST_HOME/.config $TEST_HOME/.local
+cp ./shell-hello.nix ./config.nix $TEST_HOME
+cd $TEST_HOME
+
+cat <<EOF > flake.nix
+{
+    outputs = {self}: {
+      packages.$system.PkgAsPkg = (import ./shell-hello.nix).hello;
+      packages.$system.AppAsApp = self.packages.$system.AppAsApp;
+
+      apps.$system.PkgAsApp = self.packages.$system.PkgAsPkg;
+      apps.$system.AppAsApp = {
+        type = "app";
+        program = "\${(import ./shell-hello.nix).hello}/bin/hello";
+      };
+    };
+}
+EOF
+nix run --no-write-lock-file .#AppAsApp
+nix run --no-write-lock-file .#PkgAsPkg
+
+! nix run --no-write-lock-file .#PkgAsApp || fail "'nix run' shouldn’t accept an 'app' defined under 'packages'"
+! nix run --no-write-lock-file .#AppAsPkg || fail "elements of 'apps' should be of type 'app'"
+
+clearStore
+

tests/local.mk

@@ -1,5 +1,6 @@
 nix_tests = \
   flakes.sh \
+  flakes-run.sh \
   ca/gc.sh \
   gc.sh \
   remote-store.sh \