impure-checks: improve performance by disabling dynamic deps

pkgs/clan-cli/clan_cli/nix/__init__.py

@@ -103,7 +103,7 @@ def nix_metadata(flake_url: str | Path) -> dict[str, Any]:
 def nix_shell(packages: list[str], cmd: list[str]) -> list[str]:
     # we cannot use nix-shell inside the nix sandbox
     # in our tests we just make sure we have all the packages
-    if os.environ.get("IN_NIX_SANDBOX"):
+    if os.environ.get("IN_NIX_SANDBOX") or os.environ.get("CLAN_NO_DYNAMIC_DEPS"):
         return cmd
     return [
         *nix_command(["shell", "--inputs-from", f"{nixpkgs_flake()!s}"]),

pkgs/clan-cli/clan_cli/nix/allowed-programs.json

@@ -1,6 +1,7 @@
 [
   "age",
   "bash",
+  "bubblewrap",
   "e2fsprogs",
   "git",
   "mypy",
@@ -8,8 +9,10 @@
   "openssh",
   "qemu",
   "rsync",
+  "pass",
   "sops",
   "sshpass",
   "tor",
+  "virtiofsd",
   "zbar"
 ]