* ci: add full build and quality checks on push to main
Adds a new main-build.yml workflow that runs the full 7-platform build
matrix on every push to main, uploading artifacts for 30 days. Also
adds push-to-main triggers to code-quality, test, and nix-check
workflows. The nix full build now always runs on main pushes (not just
when nix packaging files change), catching the expensive breakage that
currently requires manual verification before each release.
* ci: fix permissions and clarify nix full-build intent
- narrow contents: write to contents: read in main-build.yml — no
release assets are uploaded here so write access is unnecessary
- update nix-check comment to reflect that the full build always runs
on push to main (not just when nix files change), matching intent
* ci: reduce PR check time from ~30 min to ~1 min
- merge lint + prettier into single code-quality workflow
- add concurrency groups to cancel stale runs on rapid pushes
- add path filters so irrelevant changes skip checks
- make full nix build opt-in via "nix" label (eval-only by default)
- add nix store caching via magic-nix-cache-action
- cache trusted-signing-cli binary on windows builds
- upgrade setup-bun from v1 to v2
* ci: add workflow path filters and expand nix build triggers
- add .github/workflows/** to path filters on code-quality and nix-check
so CI runs when workflow files themselves change
- include tauri.conf.json and build.rs in nix full-build diff check since
these can break nix sandbox builds independently of cargo builds
* fix(nix): replace manual hash management with bun2nix
Eliminate the recurring problem of Nix build hashes breaking whenever
bun dependencies change or the bun version in nixpkgs updates.
Changes:
- Add bun2nix flake input (pinned to v2.0.1) for per-package fetchurl
expressions from bun.lock, replacing the single FOD hash approach
- Use allowBuiltinFetchGit for cargo git dependencies, removing manual
outputHashes that required updates on every git dep change
- Add scripts/check-nix-deps.ts (cross-platform, runs via bun) that
auto-regenerates .nix/bun.nix when bun.lock changes, triggered by
the postinstall hook in package.json
- Update CI workflow to verify bun.nix is in sync and evaluate flake
- Remove scripts/update-nix-hashes.sh (no longer needed)
* style: format check-nix-deps.ts with prettier
* ci(nix): make nix-check job a required check
* fix(nix): address review feedback
- Fix bun2nix input pinning: use path syntax (github:owner/repo/tag)
instead of ?tag= query parameter so flake.lock records the ref
and `nix flake update` respects the pin
- Make check-nix-deps.ts exit with 0 on bun2nix failure so that
`bun install` is not blocked for non-Nix developers (CI validates
bun.nix independently)
- Fix stale reference to check-nix-deps.sh in flake.nix comment
* ci(nix): add full nix build step to CI workflow
Add `nix build .#handy -L --show-trace` after flake evaluation to
catch runtime build errors (broken dependencies, sandbox issues,
compilation failures) that flake eval alone cannot detect.
* fix(nix): update bun2nix pin from 2.0.1 to 2.0.8
bun2nix 2.0.1 has a bug in cache-entry-creator that causes
"ln: failed to create symbolic link '/p': Permission denied"
during the build. Version 2.0.8 fixes this.
