pin.yml

name: "Pin release on Cachix"

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "The existing tag to build and pin"
        type: "string"
        required: true

  workflow_call:
    secrets:
      CACHIX_AUTH_TOKEN:
        required: true

jobs:
  pin:
    if: startsWith(github.ref, 'refs/tags/v')

    strategy:
      fail-fast: false
      matrix:
        os: [[ubuntu-latest], [macos-latest], [self-hosted, macOS], [self-hosted, linux, ARM64]]

    runs-on: ${{ matrix.os }}

    steps:
    - uses: actions/checkout@v4
    - uses: cachix/install-nix-action@v30
      with:
        extra_nix_config: |
          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
    - uses: cachix/cachix-action@v15
      with:
        name: devenv
        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

    - name: Pin release
      run: cachix pin devenv ${{ github.ref_name }} $(nix build --accept-flake-config --print-out-paths)