Introduce development Nix binary cache

[timon-schelling]

https://graphite-dev.cachix.org

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[timon-schelling]

!build desktop:linux (Run ID 23256065185)

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/build.yml">

<violation number="1" location=".github/workflows/build.yml:581">
P1: The cache-push step now ignores `push_to_nix_cache` and always attempts cachix auth/push, which can break non-push or opt-out runs when cache secrets are unavailable.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

2 issues found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/nix.yml">

<violation number="1" location=".github/workflows/nix.yml:23">
P1: Pin this third-party action to an immutable commit SHA instead of `@main` to prevent supply-chain drift.</violation>
</file>

<file name=".github/workflows/build.yml">

<violation number="1" location=".github/workflows/build.yml:574">
P1: Do not trust the dev Cachix key/cache in the shared Linux workflow setup; it allows dev-signed substitutes to be consumed (and potentially promoted) during production cache publishing.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Pin this third-party action to an immutable commit SHA instead of @main to prevent supply-chain drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/nix.yml, line 23:

<comment>Pin this third-party action to an immutable commit SHA instead of `@main` to prevent supply-chain drift.</comment>

<file context>
@@ -0,0 +1,37 @@
+          ref: ${{ inputs.checkout_ref || '' }}
+
+      - name: ❄ Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
</file context>

[github-actions]

📦 Linux Build Complete for e30a995
Download binary
Download Flatpak

[timon-schelling]

!build desktop:linux (Run ID 23259360770)

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/nix.yml">

<violation number="1" location=".github/workflows/nix.yml:40">
P1: `CACHE_URL` is unset here, so `set -u` makes the cache-check step fail before `curl` runs.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[github-actions]

📦 Linux Build Complete for 1d84d06
Download binary
Download Flatpak