1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: Nix flake
# Nothing else in CI builds the flake, so Nix packaging can break while every
# other job stays green: the crate still compiles under cargo, and only someone
# installing through Nix finds out.
#
# `flake.lock` pins nixpkgs to an exact revision, so the build cannot drift on
# its own — an unchanged tree rebuilds identically forever, which is why there
# is no scheduled run. What breaks it is the crate acquiring something the Nix
# sandbox cannot satisfy: a dependency needing a native library, or a build
# script reaching for the network. Those arrive through the Cargo manifests,
# so the paths filter watches those and the Nix files rather than all of
# `src/`; a plain source change that fails to compile is caught sooner, and on
# the same runner, by ci-test.yml.
on:
push:
branches:
paths:
- "flake.nix"
- "flake.lock"
- "package.nix"
- "Cargo.toml"
- "Cargo.lock"
- ".github/workflows/nix.yml"
pull_request:
branches:
paths:
- "flake.nix"
- "flake.lock"
- "package.nix"
- "Cargo.toml"
- "Cargo.lock"
- ".github/workflows/nix.yml"
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
flake:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
# The runner image ships no Nix. Upstream's installer, pinned by commit
# (v31.11.0); flakes are enabled explicitly rather than relying on the
# installer's default staying that way.
- name: Install Nix
uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 #v31.11.0
with:
extra_nix_config: |
experimental-features = nix-command flakes
# Evaluates every output for both systems in the flake's `systems`, not
# just the runner's, so an overlay or package that breaks only on
# aarch64 fails here instead of on a user's machine. Evaluation only —
# nothing is built for the foreign system.
- name: Check flake outputs
run: nix flake check --all-systems -L
# The real build. buildRustPackage runs the crate's test suite as its
# check phase, inside the sandbox and without network access.
- name: Build the package
run: nix build .#kinjo -L
# Proves the closure is complete: a package that builds can still fail to
# run if a runtime dependency was left out of the derivation.
- name: Run the built binary
run: ./result/bin/kinjo --version