[duped]

No, I do actually want a real programming language. Determinism is orthogonal to this problem and it is actually outside the scope of whether you use a hobbled config language or a full scripting language to define your build - you need sandboxing to actually achieve it (like Nix).

The reason you might want a Turing-incomplete language is that you can prove the build terminates. However that's a lie, since you will always need to escape to running programs outside the language!