.forgejo/workflows/build.yaml

@@ -1,8 +1,6 @@
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: "Build on PR"
+name: "Build"
 on:
   pull_request:
-    types: [opened, synchronize]
   push:
     branches: ["main"]
     paths:
@@ -32,9 +30,11 @@ jobs:
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           name: hsndev
+          # If you chose API tokens for write access OR if you have a private cache
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
       - name: Garbage collect build dependencies
         run: nix-collect-garbage
+
       - name: Build new ${{ matrix.system }} system and push to cachix
         id: "build"
         shell: bash
@@ -49,3 +49,10 @@ jobs:
           CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
         run: |
           echo $DRVOUT | cachix push hsndev
+      - name: Deploy ${{ matrix.system }} runners
+        id: "deploy"
+        if: success()
+        env:
+          CACHIX_ACTIVATE_TOKEN: ${{ secrets.CACHIX_ACTIVATE_TOKEN }}
+        run: |
+          cachix deploy activate $DRVOUT

.forgejo/workflows/deploy.yaml

@@ -1,47 +0,0 @@
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: "Deploy on PR Merge"
-on:
-  pull_request:
-    types: [closed]
-
-jobs:
-  if_merged:
-    if: github.event.pull_request.merged == true
-    strategy:
-      matrix:
-        include:
-          - name: fj-hetzner-aarch64-01
-            system: aarch64-linux
-            os: native-aarch64
-          - name: fj-shadowfax-01
-            system: x86_64-linux
-            os: native-x86_64
-    runs-on: ${{ matrix.os }}
-    env:
-      PATH: ${{ format('{0}:{1}', '/run/current-system/sw/bin', env.PATH) }}
-    steps:
-      - name: Checkout repository
-        uses: https://github.com/actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: https://github.com/cachix/cachix-action@v15
-        if: ${{ !github.event.pull_request.head.repo.fork }}
-        with:
-          name: hsndev
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - name: Garbage collect build dependencies
-        run: nix-collect-garbage
-      - name: Build new ${{ matrix.system }} system and push to cachix
-        id: "build"
-        shell: bash
-        run: |
-          set -o pipefail
-          DRVOUT=$(nix build .#deploy-json.${{ matrix.system }} --print-out-paths)
-          echo "DRVOUT=$DRVOUT" >> $GITHUB_ENV
-      - name: Deploy ${{ matrix.system }} runners
-        id: "deploy"
-        if: success()
-        env:
-          CACHIX_ACTIVATE_TOKEN: ${{ secrets.CACHIX_ACTIVATE_TOKEN }}
-        run: |
-          cachix deploy activate $DRVOUT

agents/fj-hetzner-aarch64.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, ... }:
+{ pkgs, config, lib, ... }:
 {
   imports = [
     ../cachix.nix

flake.nix

@@ -108,7 +108,7 @@
       # Cachix deploy for automated deployments
       packages.aarch64-linux.default =
         let
-          inherit (common "aarch64-linux") cachix-deploy-lib;
+          inherit (common "aarch64-linux") cachix-deploy-lib pkgs;
         in
         cachix-deploy-lib.nixos {
           # system = "aarch64-linux";
@@ -116,7 +116,7 @@
         };
       packages.x86_64-linux.default =
         let
-          inherit (common "x86_64-linux") cachix-deploy-lib;
+          inherit (common "x86_64-linux") cachix-deploy-lib pkgs;
         in
         cachix-deploy-lib.nixos {
           imports = x86_64-linux-modules;
@@ -136,7 +136,7 @@
                 agents = {
                   "fj-hetzner-aarch64-01" =
                     let
-                      inherit (common "aarch64-linux") cachix-deploy-lib;
+                      inherit (common "aarch64-linux") cachix-deploy-lib pkgs;
                     in
                     cachix-deploy-lib.nixos {
                       # system = "aarch64-linux";
@@ -153,7 +153,7 @@
                 agents = {
                   "fj-shadowfax-01" =
                     let
-                      inherit (common "x86_64-linux") cachix-deploy-lib;
+                      inherit (common "x86_64-linux") cachix-deploy-lib pkgs;
                     in
                     cachix-deploy-lib.nixos {
                       imports = x86_64-linux-modules;

shell.nix

@@ -1,15 +1,32 @@
 # Shell for bootstrapping flake-enabled nix and home-manager
-{ pkgs ? import <nixpkgs> {} }:
+{ pkgs ? let
+    # If pkgs is not defined, instantiate nixpkgs from locked commit
+    lock = (builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked;
+    nixpkgs = fetchTarball {
+      url = "https://github.com/nixos/nixpkgs/archive/${lock.rev}.tar.gz";
+      sha256 = lock.narHash;
+    };
+    system = builtins.currentSystem;
+    overlays = [ ]; # Explicit blank overlay to avoid interference
+  in
+  import nixpkgs { inherit system overlays; }
+, ...
+}:
+let
+in
 pkgs.mkShell {
   # Enable experimental features without having to specify the argument
   NIX_CONFIG = "experimental-features = nix-command flakes";
 
   nativeBuildInputs = with pkgs; [
+    nix
+    home-manager
     git
+    nil
+    nixpkgs-fmt
     go-task
     sops
     pre-commit
     gitleaks
-    statix
   ];
 }