Update nix #37

	# First-ring regression gate: the deterministic checks the repo already defines,
	# run on every push/PR instead of being a remembered pre-flight step.
	name: checks

	on:
	push:
	branches: [main]
	pull_request:

	permissions:
	contents: read

	jobs:
	preflight:
	name: preflight (doctors, catalog, budget, lint)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- run: make preflight

	script-tests:
	name: script tests (make test)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- run: make test

	skill-security-scan:
	name: SkillSpector scan (static)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: astral-sh/setup-uv@v6
	- name: install skillspector (pinned via SKILLSPECTOR_REF in the Makefile)
	run: make skillspector-install
	- name: materialize vendored skills
	run: make skills-materialize
	- name: scan every skill against the reviewed baselines
	run: make skills-scan QUIET=1

	nix:
	name: nix (flake check, darwin eval, statix)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: DeterminateSystems/nix-installer-action@v16
	- run: nix flake check
	# Pure eval type-checks every host's darwin + home-manager module tree;
	# no macOS runner needed, and new hosts are covered automatically.
	# Block scalar on purpose: an inline `run:` value that holds `: ` is not
	# valid YAML, and GitHub answers an unparsable workflow with a 0-job run.
	- run: \|
	nix eval .#darwinConfigurations --apply 'cfgs: builtins.mapAttrs (_: c: c.system.drvPath) cfgs'
	- run: nix run nixpkgs#statix -- check nix/

Navigation Menu