Merge pull request #213 from loss-and-quick/ci/nightly-module-nix

ci: use Nix devshell for module builds and desktop-linux smoke

Author: loss-and-quick

.github/workflows/ci.yml

@@ -244,38 +244,30 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@da36cb69b1c3247ad7a1f931ebfd954a1105ef14 # v14
         with:
-          toolchain: stable
-          targets: x86_64-unknown-linux-gnu
-
-      - name: Linux desktop deps
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev \
-            libayatana-appindicator3-dev patchelf
+          extra-conf: |
+            accept-flake-config = true
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Cachix
+        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
-          bun-version: latest
-
-      - name: Build the UI (generate_context embeds frontendDist)
-        run: |
-          bun install --frozen-lockfile
-          ( cd frontend && bun run build )
+          name: kasumi-proxy
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - name: Stub the libcronet bundle resource (compile-smoke doesn't bundle)
         run: |
-          # tauri-build validates tauri.linux.conf.json's libcronet.so resource at
-          # compile time; the real lib is fetched only for the bundle. Placeholder.
           mkdir -p src-tauri/binaries
           : > src-tauri/binaries/libcronet.so
 
       - name: Compile the Tauri app (no bundle)
-        run: cargo build -p kasumi-desktop
+        run: |
+          nix develop --command bash -euo pipefail -c '
+            bun install --frozen-lockfile
+            ( cd frontend && bun run build )
+            cargo build -p kasumi-desktop
+          '
 
   # ── Windows desktop compile smoke. Mirrors desktop-linux: the `rust` job runs on
   #    Linux and never compiles the #[cfg(windows)] Platform + Win32 code, so this is

.github/workflows/nightly.yml

@@ -80,66 +80,29 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: latest
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-        with:
-          path: ~/.bun/install/cache
-          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: bun-${{ runner.os }}-
-
-      - name: Setup Rust (android targets)
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          toolchain: stable
-          targets: aarch64-linux-android,x86_64-linux-android
-
-      - name: Install cargo-ndk
-        uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
-        with:
-          tool: cargo-ndk
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@da36cb69b1c3247ad7a1f931ebfd954a1105ef14 # v14
         with:
-          go-version: '1.26'
-          cache: false
+          extra-conf: |
+            accept-flake-config = true
 
-      - name: Cache Go build & modules
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - name: Cachix
+        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: go-${{ runner.os }}-geodat2srs
-          restore-keys: go-${{ runner.os }}-
+          name: kasumi-proxy
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-      - name: Setup NDK
-        id: setup-ndk
-        uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1
-        with:
-          ndk-version: r28
-
-      - name: Install UI dependencies
-        # bun workspace rooted at the repo — install from root against the single bun.lock.
-        run: bun install --frozen-lockfile
-
-      - name: Lint & test
+      - name: Install, lint & test
         run: |
-          bunx biome check
-          bun run frontend/scripts/check-i18n.ts
-          ( cd frontend && bunx vitest run )
+          nix develop .#android --command bash -euo pipefail -c '
+            bun install --frozen-lockfile
+            bunx biome check
+            bun run frontend/scripts/check-i18n.ts
+            ( cd frontend && bunx vitest run )
+          '
 
       - name: Build debug zip
-        env:
-          NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
-        # package-release.sh names the zip itself (artifact-name.sh); the run's
-        # commit is carried by the upload artifact name below.
-        run: scripts/package-release.sh
+        run: nix develop .#android --command bash -euo pipefail -c 'scripts/package-release.sh'
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4

.github/workflows/release.yml

@@ -261,58 +261,24 @@ jobs:
           ref: ${{ needs.prepare.outputs.version }}
           fetch-depth: 0
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: latest
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-        with:
-          path: ~/.bun/install/cache
-          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: bun-${{ runner.os }}-
-
-      - name: Setup Rust (android targets)
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          toolchain: stable
-          targets: aarch64-linux-android,x86_64-linux-android
-
-      - name: Install cargo-ndk
-        uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
-        with:
-          tool: cargo-ndk
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@da36cb69b1c3247ad7a1f931ebfd954a1105ef14 # v14
         with:
-          go-version: '1.26'
-          cache: false
+          extra-conf: |
+            accept-flake-config = true
 
-      - name: Cache Go build & modules
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: go-${{ runner.os }}-geodat2srs
-          restore-keys: go-${{ runner.os }}-
-
-      - name: Setup NDK
-        id: setup-ndk
-        uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1
+      - name: Cachix
+        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
-          # Mirror flake.nix NDK 28.0.13004108 (== r28).
-          ndk-version: r28
-
-      - name: Install UI dependencies
-        run: bun install --frozen-lockfile
+          name: kasumi-proxy
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - name: Build release zip
-        env:
-          NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
-        run: scripts/package-release.sh
+        run: |
+          nix develop .#android --command bash -euo pipefail -c '
+            bun install --frozen-lockfile
+            scripts/package-release.sh
+          '
 
       - name: Upload to the release
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2