fix(core): interpolate {projectRoot} and {projectName} in {workspaceRoot} input patterns in native hasher (#34637) `{projectRoot}` and `{projectName}` tokens inside `{workspaceRoot}/...` input patterns were silently never substituted in the native Rust hasher, causing the glob to match zero files and those inputs to be entirely excluded from the cache hash — a silent cache correctness bug. ## Root Cause In `gather_self_inputs` (`hash_planner.rs`), workspace filesets (those starting with `{workspaceRoot}/`) were forwarded as-is to `HashInstruction::WorkspaceFileSet`. When `globs_from_workspace_globs` later stripped `{workspaceRoot}/`, the remaining `{projectRoot}/**/*.go` was matched literally — which never exists on disk. ## Changes - **`hash_planner.rs`**: Before storing workspace filesets in `HashInstruction::WorkspaceFileSet`, replace `{projectRoot}` and `{projectName}` with their actual values from the project graph node. - **`planner.spec.ts`**: Added a test verifying that a pattern like `{workspaceRoot}/{projectRoot}/**/*.go` correctly resolves to `{workspaceRoot}/libs/parent/**/*.go` in the hash plan. ```json // nx.json — this pattern now works correctly "namedInputs": { "goSource": ["{workspaceRoot}/{projectRoot}/**/*.go"] } ``` This pattern is documented as valid per the [Nx inputs reference](https://nx.dev/docs/reference/inputs): `{projectRoot}` and `{projectName}` can appear anywhere after the leading `{workspaceRoot}`. > [!WARNING] > >

Firewall rules blocked me from connecting to one or more addresses (expand for details)

> > #### I tried to connect to the following addresses, but was blocked by firewall rules: > > - `repo.gradle.org` > - Triggering command: `/usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -XX:MaxMetaspaceSize=384m -XX:+HeapDumpOnOutOfMemoryError -Xms256m -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en` (dns block) > - `staging.nx.app` > - Triggering command: `/home/REDACTED/work/_temp/ghcca-node/node/bin/node node ./bin/post-install` (dns block) > - Triggering command: `/opt/hostedtoolcache/node/24.13.1/x64/bin/node /opt/hostedtoolcache/node/24.13.1/x64/bin/node /home/REDACTED/work/nx/nx/node_modules/.pnpm/nx@22.6.0-beta.5_@swc-node+register@1.11.1_@swc+core@1.15.10_@swc+helpers@0.5.18__@swc+_a827ebc424be037fc154d90301143d4e/node_modules/nx/src/project-graph/plugins/isolation/plugin-worker /tmp/plugin4368-16-420.890618.sock @nx/enterprise-cloud` (dns block) > - Triggering command: `/opt/hostedtoolcache/node/24.13.1/x64/bin/node /opt/hostedtoolcache/node/24.13.1/x64/bin/node /home/REDACTED/work/nx/nx/node_modules/.pnpm/nx@22.6.0-beta.5_@swc-node+register@1.11.1_@swc+core@1.15.10_@swc+helpers@0.5.18__@swc+_a827ebc424be037fc154d90301143d4e/node_modules/nx/src/project-graph/plugins/isolation/plugin-worker /tmp/plugin5770-16-420.874901.sock @nx/enterprise-cloud` (dns block) > > If you need me to access, download, or install something from one of these locations, you can either: > > - Configure [Actions setup steps](https://gh.io/copilot/actions-setup-steps) to set up my environment, which run before the firewall is enabled > - Add the appropriate URLs or hosts to the custom allowlist in this repository's [Copilot coding agent settings](https://github.com/nrwl/nx/settings/copilot/coding_agent) (admins only) > >

Original prompt

> > ---- > > *This section details on the original issue you should resolve* > > {projectRoot} not interpolated inside {workspaceRoot} input patterns in native hasher > ## Current Behavior > > When using a `{workspaceRoot}/{projectRoot}/**/*.go` pattern in target inputs, the `{projectRoot}` token is **not interpolated** by the native Rust hash planner. The pattern silently matches zero files, causing the cache hash to exclude those files entirely. > > ```json > // nx.json > "namedInputs": { > "gosourceUnfiltered": ["{workspaceRoot}/{projectRoot}/**/*.go"] > } > ``` > > ```json > // target config > "format": { > "inputs": ["gosourceUnfiltered", { "externalDependencies": [] }] > } > ``` > > The hash plan for this target contains **zero `.go` file inputs**: > > ``` > Task: my-project:format:write > Inputs: > my-project:ProjectConfiguration > my-project:TsConfig > env:NX_CLOUD_ENCRYPTION_KEY > file:nx.json > file:.gitignore > // no .go files! > ``` > > ## Root Cause > > In the Rust hash planner (`hash_planner.rs`), fileset inputs are partitioned based on their prefix: > > ```rust > .partition(|file_set| { > file_set.starts_with("{projectRoot}/") || file_set.starts_with("!{projectRoot}/") > }); > ``` > > A pattern starting with `{workspaceRoot}/` is classified as a **workspace fileset**. It then flows to `hash_workspace_files.rs` where `{workspaceRoot}/` is stripped via `strip_prefix("{workspaceRoot}/")`, leaving `{projectRoot}/**/*.go`. But `{projectRoot}` is **never substituted** with the actual project root, so the glob literally tries to match paths starting with `{projectRoot}/` — which don't exist. > > ## Expected Behavior > > Per the [Nx docs on inputs](https://nx.dev/docs/reference/inputs): > > > `{workspaceRoot}` should only appear in the beginning of an input but **`{projectRoot}` and `{projectName}` can be specified later in the input to interpolate the root or name of the project** into the input location. > > The native hasher should interpolate `{projectRoot}` (and `{projectName}`) within `{workspaceRoot}` patterns before glob matching. After stripping `{workspaceRoot}/` and interpolating `{projectRoot}`, the pattern should become e.g. `packages/shared/go/middleware/**/*.go` and correctly match files. > > ## Impact > > This is a **silent cache correctness issue**: targets using this pattern appear to work but their cache hash doesn't include the matched files. Changes to those files won't invalidate the cache. There's no warning or error emitted. > > ## Workaround > > Use the literal path instead of `{projectRoot}` inside workspace-level patterns: > > ```js > // In a createNodes plugin, instead of: > inputs: ["{workspaceRoot}/{projectRoot}/**/*.go"] > // Use: > inputs: [`{workspaceRoot}/${actualProjectRoot}/**/*.go`] > ``` > > ## Related > > - nrwl/nx#34225 — Nested Project Files Excluded from Parent Project Inputs (the reason `{workspaceRoot}/{projectRoot}` patterns are used in the first place: to bypass project file filtering and include files from nested sub-projects) > > ## Environment > > - **Nx version**: 22.6.0-beta.3 > - **OS**: macOS (Darwin 24.6.0) > - **Package manager**: pnpm > > ## Comments on the Issue (you are @copilot in this section) > > > >

- Fixes nrwl/nx#34595 --- 🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. [Learn more about Advanced Security.](https://gh.io/cca-advanced-security) --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: AgentEnder <6933928+AgentEnder@users.noreply.github.com> Co-authored-by: Jason Jean Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com> Co-authored-by: Copilot