From 7ec48045ceb20235929952fd3f718501e81105f1 Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Sat, 4 Jul 2026 10:58:26 +0000 Subject: [PATCH] Add Nix flake CI: eval check + hash verification MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Checks that the flake evaluates, and verifies the source, mixFodDeps, and yarnOfflineCache hashes are correct. Does not do a full nix build (which would be too slow for CI) — the hash checks catch the most common issues before merging to config-nixos. --- .gitea/workflows/nix-check.yml | 38 ++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .gitea/workflows/nix-check.yml diff --git a/.gitea/workflows/nix-check.yml b/.gitea/workflows/nix-check.yml new file mode 100644 index 0000000..e95eb30 --- /dev/null +++ b/.gitea/workflows/nix-check.yml @@ -0,0 +1,38 @@ +name: Nix Flake Check + +on: + push: + branches: + - master + - feature/* + pull_request: + branches: + - master + workflow_dispatch: + +jobs: + flake-check: + name: Nix Flake Check + runs-on: ubuntu-latest + if: "! contains(toJSON(github.event.commits.*.message), '[skip ci]')" + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Install Nix + uses: cachix/install-nix-action@v27 + with: + nix_path: nixpkgs=channel:nixos-unstable + + - name: Check flake evaluates + run: nix flake check --no-build + + - name: Verify source hash + run: nix build .#pinchflat.src --no-link --print-out-paths + + - name: Verify mix deps hash + run: nix build .#pinchflat.mixFodDeps --no-link --print-out-paths + + - name: Verify yarn cache hash + run: nix build .#pinchflat.yarnOfflineCache --no-link --print-out-paths