.github/workflows/build.yml

@@ -0,0 +1,34 @@
+name: "Nix: build and cache outputs"
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - "**.nix"
+      - "**.lock"
+      - ".github/workflows/build.yml"
+
+jobs:
+  build-flake:
+    name: Build (x86_64-linux)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref_name }}
+          persist-credentials: false
+
+      - name: Install Lix
+        uses: ./.github/actions/install-lix
+
+      - name: Setup Attic cache
+        uses: ryanccn/attic-action@v0.3.2
+        with:
+          endpoint: https://cache.thevoid.cafe
+          cache: puzzlevision
+          token: ${{ secrets.ATTIC_TOKEN }}
+
+      - name: Build flake
+        run: nix build .#nixosConfigurations.puzzlevision.config.system.build.toplevel --accept-flake-config

.github/workflows/check-leaks.yml

@@ -1,38 +0,0 @@
-name: "Trufflehog: check for exposed secrets"
-
-on:
-  pull_request:
-  push:
-    paths:
-      - "**.nix"
-      - ".github/workflows/check-leaks.yml"
-
-permissions:
-  contents: read
-  id-token: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  deadnix:
-    name: Run trufflehog
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.ref_name }}
-          fetch-depth: 0
-
-      - id: trufflehog
-        name: TruffleHog scan
-        uses: trufflesecurity/trufflehog@main
-        continue-on-error: true
-        with:
-          path: ./
-          base: "${{ github.event.repository.default_branch }}"
-          extra_args: --debug --only-verified
-
-      - name: Scan Results Status
-        if: steps.trufflehog.outcome == 'failure'
-        run: exit 1

.github/workflows/deadnix.yml

@@ -12,17 +12,9 @@ jobs:
     name: Run deadnix
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - uses: actions/checkout@v4
-        uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v25
-        with:
-          ref: ${{ github.ref_name }}
-          persist-credentials: false
-
-      - name: Install lix
-        uses: ./.github/actions/install-lix
-
       - uses: cachix/cachix-action@v14
         with:
           name: deadnix
-
       - uses: phucleeuwu/deadnix-action@v1

.github/workflows/validate.yml

@@ -6,7 +6,7 @@ on:
     paths:
       - "**.nix"
       - "**.lock"
-      - ".github/workflows/validate.yml"
+      - ".github/workflows/**.yml"
 
 jobs:
   check-flake:
@@ -21,7 +21,10 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: ./.github/actions/install-lix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
+            experimental-features = flakes nix-command recursive-nix pipe-operator
 
       - name: Validate Flake
         run: nix flake check