feat: add Nix flake and Devbox support

[levonk]

What

Adds a flake.nix so the project can be installed and run directly from GitHub at the latest stable release:

nix run github:brave/brave-browser
nix profile install github:brave/brave-browser

The flake tracks the default branch and is auto-bumped to the latest stable release by a daily workflow, so github:brave/brave-browser always serves the current release.

Adds a devbox.json for reproducible development environments:

devbox shell
devbox run build

Why

The project publishes prebuilt release artifacts and nixpkgs already packages Brave via make-brave.nix, but there is no repo-owned flake. A repo-owned flake lets nix run github:brave/brave-browser track upstream releases directly (the nixpkgs package lags behind by days/weeks). For users who already have Nix installed, a flake provides:

• One-command install / run — nix run github:brave/brave-browser with no clone or manual build steps.
• Pure / Hermetic builds — every input (the prebuilt binary, glibc/libiconv) is pinned in flake.lock. If it builds today, it builds in ten years.
• Reproducible — the exact same derivation always produces the exact same output bit-for-bit. No "works on my machine."
• Idempotent installs — running nix profile install twice is a no-op.
• Rollback-able — nix profile rollback restores the previous profile generation instantly.
• Cross-platform — same invocation on macOS (Apple Silicon & Intel) and Linux. The flake handles platform-specific linking.
• Atomic upgrades / downgrades — profiles are switched atomically. No half-upgraded state.
• Clean uninstall — nix profile remove leaves no residue.

Changes

• flake.nix: Nix flake wrapping the prebuilt release binary as packages.<system>.default and apps.<system>.default. Reuses nixpkgs brave packaging via overrideAttrs (swapping in upstream version + per-platform SRI hashes) to avoid duplicating ~150 lines of patchelf/wrapGApps/desktop-fixup logic.
• flake.lock: pinned nixpkgs-unstable input.
• .github/workflows/nix-release.yml: scheduled lag-check automation that auto-bumps version + per-platform sha256 hashes and opens a PR when flake.nix falls behind the latest stable release.
• devbox.json: Devbox configuration for reproducible development environments.
• .gitignore: added Nix build result symlinks (/result, /result-*).
• README.md: added Nix installation subsection under Downloads.

Testing

Verified locally:

nix flake check --no-build
nix build .#brave
nix run .#brave -- --version

Builds and runs successfully on x86_64-darwin (reports Brave Browser 150.1.92.134).

Notes

• The flake wraps the prebuilt release binary rather than building from source, so it stays in sync with releases and avoids a full Chromium toolchain in the closure. Building from source is a separate concern that lives in brave-core.
• The flake reuses nixpkgs' brave packaging (pkgs.brave.overrideAttrs) rather than vendoring make-brave.nix. This means the patchelf/wrapGAppsHook3/desktop-file-fixup/icon-symlink/OutdatedBuildDetector-disable logic is maintained upstream in nixpkgs, and this repo only maintains version + 4 SRI hashes.
• Tag-pinning (github:brave/brave-browser/vX.Y.Z) is not supported — release tags are cut before the bump workflow updates flake.nix. Use github:brave/brave-browser (tracks default branch) or pin to a commit SHA.
• The lag-check workflow guards on github.repository == 'brave/brave-browser' so it only runs upstream, not on forks.
• No breaking changes to existing build paths — additive only.

Related

Resolves #56931

[Maybe778]

What

Adds a flake.nix so the project can be installed and run directly from GitHub at the latest stable release:

nix run github:brave/brave-browser
nix profile install github:brave/brave-browser

The flake tracks the default branch and is auto-bumped to the latest stable release by a daily workflow, so github:brave/brave-browser always serves the current release.

Adds a devbox.json for reproducible development environments:

devbox shell
devbox run build

Why

The project publishes prebuilt release artifacts and nixpkgs already packages Brave via make-brave.nix, but there is no repo-owned flake. A repo-owned flake lets nix run github:brave/brave-browser track upstream releases directly (the nixpkgs package lags behind by days/weeks). For users who already have Nix installed, a flake provides:

• One-command install / run — nix run github:brave/brave-browser with no clone or manual build steps.
• Pure / Hermetic builds — every input (the prebuilt binary, glibc/libiconv) is pinned in flake.lock. If it builds today, it builds in ten years.
• Reproducible — the exact same derivation always produces the exact same output bit-for-bit. No "works on my machine."
• Idempotent installs — running nix profile install twice is a no-op.
• Rollback-able — nix profile rollback restores the previous profile generation instantly.
• Cross-platform — same invocation on macOS (Apple Silicon & Intel) and Linux. The flake handles platform-specific linking.
• Atomic upgrades / downgrades — profiles are switched atomically. No half-upgraded state.
• Clean uninstall — nix profile remove leaves no residue.

Changes

• flake.nix: Nix flake wrapping the prebuilt release binary as packages.<system>.default and apps.<system>.default. Reuses nixpkgs brave packaging via overrideAttrs (swapping in upstream version + per-platform SRI hashes) to avoid duplicating ~150 lines of patchelf/wrapGApps/desktop-fixup logic.
• flake.lock: pinned nixpkgs-unstable input.
• .github/workflows/nix-release.yml: scheduled lag-check automation that auto-bumps version + per-platform sha256 hashes and opens a PR when flake.nix falls behind the latest stable release.
• devbox.json: Devbox configuration for reproducible development environments.
• .gitignore: added Nix build result symlinks (/result, /result-*).
• README.md: added Nix installation subsection under Downloads.

Testing

Verified locally:

nix flake check --no-build
nix build .#brave
nix run .#brave -- --version

Builds and runs successfully on x86_64-darwin (reports Brave Browser 150.1.92.134).

Notes

• The flake wraps the prebuilt release binary rather than building from source, so it stays in sync with releases and avoids a full Chromium toolchain in the closure. Building from source is a separate concern that lives in brave-core.
• The flake reuses nixpkgs' brave packaging (pkgs.brave.overrideAttrs) rather than vendoring make-brave.nix. This means the patchelf/wrapGAppsHook3/desktop-file-fixup/icon-symlink/OutdatedBuildDetector-disable logic is maintained upstream in nixpkgs, and this repo only maintains version + 4 SRI hashes.
• Tag-pinning (github:brave/brave-browser/vX.Y.Z) is not supported — release tags are cut before the bump workflow updates flake.nix. Use github:brave/brave-browser (tracks default branch) or pin to a commit SHA.
• The lag-check workflow guards on github.repository == 'brave/brave-browser' so it only runs upstream, not on forks.
• No breaking changes to existing build paths — additive only.

Related

Resolves #56931