From ee437fca5ab38fd9fac4ab66ce491c530cb03c5a Mon Sep 17 00:00:00 2001 From: Psychotoxical Date: Fri, 17 Apr 2026 23:51:11 +0200 Subject: [PATCH] ci(nix): push store paths to Cachix during verify-nix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wires cachix/cachix-action@v15 into the verify-nix job. The action watches the nix store for the duration of the workflow and uploads new paths to the `psysonic` cache on cachix.org automatically. Using Cachix-managed signing (no signing key on our side) — Cachix signs server-side with the cache's built-in keypair. End users will pick up the public key automatically via `cachix use psysonic`, so no manual nix.conf configuration is required. Consequence: after the next `v*` release, `nix profile install github:Psychotoxical/psysonic` pulls a prebuilt binary from Cachix instead of recompiling Rust + npm deps locally. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7b549d73..c0daa129 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -160,12 +160,13 @@ jobs: \( -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" \) \ | xargs gh release upload "app-v${VERSION}" --clobber - # Verifies that `nix build .#psysonic` still works against the current source - # and refreshes `nix/upstream-sources.json` (npmDepsHash) + `flake.lock` - # (nixpkgs pin). Commits the refreshed files back to `main` when they change. + # Verifies that `nix build .#psysonic` still works against the current source, + # refreshes `nix/upstream-sources.json` (npmDepsHash) + `flake.lock` + # (nixpkgs pin), and pushes the resulting store paths to the public Cachix + # binary cache so end users can `nix profile install github:Psychotoxical/psysonic` + # without having to compile locally. # - # Tarball publishing / Cachix upload are intentionally out of scope here — - # those will live in a dedicated workflow tied to a binary cache setup. + # The refreshed lock/hash files are committed back to `main` when they change. verify-nix: needs: create-release runs-on: ubuntu-24.04 @@ -183,6 +184,15 @@ jobs: - name: install Nix uses: DeterminateSystems/nix-installer-action@v15 + # cachix-action with no signingKey = Cachix-managed signing (Cachix signs + # server-side). The action watches the nix store during subsequent build + # steps and uploads new paths automatically. + - name: configure Cachix (managed signing) + uses: cachix/cachix-action@v15 + with: + name: psysonic + authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} + - name: compute npmDepsHash from package-lock.json id: npm-hash run: | @@ -202,7 +212,7 @@ jobs: - name: refresh flake.lock (nixpkgs pin) run: nix flake update --accept-flake-config - - name: verify nix build + - name: verify nix build + push to Cachix run: nix build .#psysonic --accept-flake-config --no-link --print-build-logs - name: commit + push refreshed lock and hash (if changed)