* ci: reduce PR check time from ~30 min to ~1 min
- merge lint + prettier into single code-quality workflow
- add concurrency groups to cancel stale runs on rapid pushes
- add path filters so irrelevant changes skip checks
- make full nix build opt-in via "nix" label (eval-only by default)
- add nix store caching via magic-nix-cache-action
- cache trusted-signing-cli binary on windows builds
- upgrade setup-bun from v1 to v2
* ci: add workflow path filters and expand nix build triggers
- add .github/workflows/** to path filters on code-quality and nix-check
so CI runs when workflow files themselves change
- include tauri.conf.json and build.rs in nix full-build diff check since
these can break nix sandbox builds independently of cargo builds
* fix(nix): replace manual hash management with bun2nix
Eliminate the recurring problem of Nix build hashes breaking whenever
bun dependencies change or the bun version in nixpkgs updates.
Changes:
- Add bun2nix flake input (pinned to v2.0.1) for per-package fetchurl
expressions from bun.lock, replacing the single FOD hash approach
- Use allowBuiltinFetchGit for cargo git dependencies, removing manual
outputHashes that required updates on every git dep change
- Add scripts/check-nix-deps.ts (cross-platform, runs via bun) that
auto-regenerates .nix/bun.nix when bun.lock changes, triggered by
the postinstall hook in package.json
- Update CI workflow to verify bun.nix is in sync and evaluate flake
- Remove scripts/update-nix-hashes.sh (no longer needed)
* style: format check-nix-deps.ts with prettier
* ci(nix): make nix-check job a required check
* fix(nix): address review feedback
- Fix bun2nix input pinning: use path syntax (github:owner/repo/tag)
instead of ?tag= query parameter so flake.lock records the ref
and `nix flake update` respects the pin
- Make check-nix-deps.ts exit with 0 on bun2nix failure so that
`bun install` is not blocked for non-Nix developers (CI validates
bun.nix independently)
- Fix stale reference to check-nix-deps.sh in flake.nix comment
* ci(nix): add full nix build step to CI workflow
Add `nix build .#handy -L --show-trace` after flake evaluation to
catch runtime build errors (broken dependencies, sandbox issues,
compilation failures) that flake eval alone cannot detect.
* fix(nix): update bun2nix pin from 2.0.1 to 2.0.8
bun2nix 2.0.1 has a bug in cache-entry-creator that causes
"ln: failed to create symbolic link '/p': Permission denied"
during the build. Version 2.0.8 fixes this.
