Nix polish: gc, weekly lock bumps, itsycal defaults, raycast-export check #29

	# First-ring regression gate: the deterministic checks the repo already defines,
	# run on every push/PR instead of being a remembered pre-flight step.
	name: checks

	on:
	push:
	branches: [main]
	pull_request:

	permissions:
	contents: read

	jobs:
	preflight:
	name: preflight (doctors, catalog, budget, lint)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- run: make preflight

	script-tests:
	name: script tests (make test)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- run: make test

	skill-security-scan:
	name: SkillSpector scan (static)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: astral-sh/setup-uv@v6
	- name: install skillspector (pinned via SKILLSPECTOR_REF in the Makefile)
	run: make skillspector-install
	- name: materialize vendored skills
	run: make skills-materialize
	- name: scan every skill against the reviewed baselines
	run: make skills-scan QUIET=1

	nix:
	name: nix (flake check, darwin eval, statix)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: DeterminateSystems/nix-installer-action@v16
	- run: nix flake check
	# Pure eval type-checks the whole darwin + home-manager module tree;
	# no macOS runner needed.
	- run: nix eval .#darwinConfigurations.Sankets-MacBook-Air.system.drvPath
	- run: nix run nixpkgs#statix -- check nix/

Navigation Menu