move all nix expressions to pkgs

default.nix

@@ -16,42 +16,18 @@ in rec {
   inherit (pkgs) ssh-to-pgp;
 
   # used in the CI only
-  sops-pgp-hook-test = pkgs.buildGoModule {
-    name = "sops-pgp-hook-test";
-    src = ./.;
+  sops-pgp-hook-test = pkgs.callPackage ./pkgs/sops-pgp-hook-test.nix {
     inherit vendorSha256;
-    buildPhase = ''
-      go test -c ./pkgs/sops-pgp-hook
-      install -D sops-pgp-hook.test $out/bin/sops-pgp-hook.test
-    '';
   };
-  unit-tests = pkgs.callPackage ./unit-tests.nix {};
+  unit-tests = pkgs.callPackage ./pkgs/unit-tests.nix {};
 } // (pkgs.lib.optionalAttrs pkgs.stdenv.isLinux {
   inherit sops-install-secrets;
 
-  lint = sops-install-secrets.overrideAttrs (old: {
-    name = "golangci-lint";
-    nativeBuildInputs = old.nativeBuildInputs ++ [ pkgs.golangci-lint ];
-    buildPhase = ''
-      HOME=$TMPDIR golangci-lint run --timeout 360s
-    '';
-    doCheck = false;
-    installPhase = ''
-      touch $out $unittest
-    '';
-    fixupPhase = ":";
-  });
+  lint = pkgs.callPackage ./pkgs/lint.nix {
+    inherit sops-install-secrets;
+  };
 
-  cross-build = sops-install-secrets.overrideAttrs (old: {
-    name = "cross-build";
-    nativeBuildInputs = old.nativeBuildInputs ++ [ pkgs.gox ];
-    buildPhase = ''
-      (cd pkgs/sops-install-secrets && gox -os linux)
-    '';
-    doCheck = false;
-    installPhase = ''
-      touch $out $unittest
-    '';
-    fixupPhase = ":";
-  });
+  cross-build = pkgs.callPackage ./pkgs/cross-build.nix {
+    inherit sops-install-secrets;
+  };
 })

flake.nix

@@ -40,7 +40,7 @@
         nixpkgs.legacyPackages.${system}.callPackage ./shell.nix {}
     );
     devShells = forAllSystems (system: {
-      unit-tests = nixpkgs.legacyPackages.${system}.callPackage ./unit-tests.nix {};
+      unit-tests = nixpkgs.legacyPackages.${system}.callPackage ./pkgs/unit-tests.nix {};
     });
   };
 }

pkgs/cross-build.nix

@@ -0,0 +1,14 @@
+{ sops-install-secrets, gox }:
+
+sops-install-secrets.overrideAttrs (old: {
+  name = "cross-build";
+  nativeBuildInputs = old.nativeBuildInputs ++ [ gox ];
+  buildPhase = ''
+    (cd pkgs/sops-install-secrets && gox -os linux)
+  '';
+  doCheck = false;
+  installPhase = ''
+    touch $out $unittest
+  '';
+  fixupPhase = ":";
+})

pkgs/lint.nix

@@ -0,0 +1,13 @@
+{ sops-install-secrets, golangci-lint }:
+sops-install-secrets.overrideAttrs (old: {
+  name = "golangci-lint";
+  nativeBuildInputs = old.nativeBuildInputs ++ [ golangci-lint ];
+  buildPhase = ''
+    HOME=$TMPDIR golangci-lint run --timeout 360s
+  '';
+  doCheck = false;
+  installPhase = ''
+    touch $out $unittest
+  '';
+  fixupPhase = ":";
+})

pkgs/sops-pgp-hook-test.nix

@@ -0,0 +1,11 @@
+{ buildGoModule, vendorSha256 }:
+
+buildGoModule {
+  name = "sops-pgp-hook-test";
+  src = ../.;
+  inherit vendorSha256;
+  buildPhase = ''
+    go test -c ./pkgs/sops-pgp-hook
+    install -D sops-pgp-hook.test $out/bin/sops-pgp-hook.test
+  '';
+}

pkgs/unit-tests.nix

@@ -1,7 +1,7 @@
 { pkgs ? import <nixpkgs> {}
 }:
 let
-  sopsPkgs = import ./. { inherit pkgs; };
+  sopsPkgs = import ../. { inherit pkgs; };
 in pkgs.stdenv.mkDerivation {
   name = "env";
   nativeBuildInputs = with pkgs; [