Use actions.nix for generating GitHub Actions workflows

.github/workflows/check.yml

@@ -0,0 +1,42 @@
+# This file was autogenerated by actions.nix. Do not edit it manually.
+# To make changes, edit the workflow definition in your flake's actions-nix configuration
+# (typically under flake.actions-nix.workflows.".github/workflows/check.yml") and run:
+#   nix run .#render-workflows
+# Or commit to trigger the pre-commit hook if enabled.
+jobs:
+  check:
+    name: Check flake
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - name: Install Lix
+      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+      with:
+        extra_nix_config: |-
+          accept-flake-config = true
+          max-jobs = auto
+    - name: Add SSH keys to ssh-agent
+      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+      with:
+        ssh-private-key: |-
+          ${{ secrets.SECRETS_DEPLOY_KEY }}"
+          ${{ secrets.PRAGMATAPRO_DEPLOY_KEY }}"
+    - name: Setup Attic cache
+      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
+      with:
+        cache: tilde
+        endpoint: https://cache.e10.camp
+        token: ${{ secrets.ATTIC_TOKEN }}
+    - name: Use Cachix store
+      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
+      with:
+        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+        installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix
+        name: tilde
+    - name: Run check flake
+      run: nix flake -Lv check --impure --show-trace
+name: Check
+'on':
+  push: {}
+  workflow_dispatch: {}

.github/workflows/devshell.yml

@@ -0,0 +1,43 @@
+# This file was autogenerated by actions.nix. Do not edit it manually.
+# To make changes, edit the workflow definition in your flake's actions-nix configuration
+# (typically under flake.actions-nix.workflows.".github/workflows/devshell.yml") and run:
+#   nix run .#render-workflows
+# Or commit to trigger the pre-commit hook if enabled.
+jobs:
+  build-dev-shell:
+    name: Build devShell
+    runs-on: macos-15
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - name: Install Lix
+      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+      with:
+        extra_nix_config: |-
+          accept-flake-config = true
+          max-jobs = auto
+    - name: Add SSH keys to ssh-agent
+      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+      with:
+        ssh-private-key: |-
+          ${{ secrets.SECRETS_DEPLOY_KEY }}"
+          ${{ secrets.PRAGMATAPRO_DEPLOY_KEY }}"
+    - name: Setup Attic cache
+      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
+      with:
+        cache: tilde
+        endpoint: https://cache.e10.camp
+        token: ${{ secrets.ATTIC_TOKEN }}
+    - name: Use Cachix store
+      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
+      with:
+        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+        installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix
+        name: tilde
+    - name: Build aarch64-darwin shell
+      run: nix build .#devShells.aarch64-darwin.default --impure --keep-going --print-build-logs
+        --show-trace --verbose
+name: devShell
+'on':
+  push: {}
+  workflow_dispatch: {}

.github/workflows/hosts.yml

@@ -0,0 +1,48 @@
+# This file was autogenerated by actions.nix. Do not edit it manually.
+# To make changes, edit the workflow definition in your flake's actions-nix configuration
+# (typically under flake.actions-nix.workflows.".github/workflows/hosts.yml") and run:
+#   nix run .#render-workflows
+# Or commit to trigger the pre-commit hook if enabled.
+jobs:
+  build-system:
+    name: Build host system
+    runs-on: macos-15
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - name: Install Lix
+      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+      with:
+        extra_nix_config: |-
+          accept-flake-config = true
+          max-jobs = auto
+    - name: Add SSH keys to ssh-agent
+      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+      with:
+        ssh-private-key: |-
+          ${{ secrets.SECRETS_DEPLOY_KEY }}"
+          ${{ secrets.PRAGMATAPRO_DEPLOY_KEY }}"
+    - name: Setup Attic cache
+      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
+      with:
+        cache: tilde
+        endpoint: https://cache.e10.camp
+        token: ${{ secrets.ATTIC_TOKEN }}
+    - name: Use Cachix store
+      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
+      with:
+        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+        installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix
+        name: tilde
+    - name: Build ${{ matrix.host }} host system
+      run: nix build .#darwinConfigurations.${{ matrix.host }}.system --keep-going
+        --print-build-logs --show-trace --verbose
+    strategy:
+      matrix:
+        host:
+        - eMac
+        - mercury
+name: Host configurations
+'on':
+  push: {}
+  workflow_dispatch: {}

.github/workflows/packages.yml

@@ -0,0 +1,55 @@
+# This file was autogenerated by actions.nix. Do not edit it manually.
+# To make changes, edit the workflow definition in your flake's actions-nix configuration
+# (typically under flake.actions-nix.workflows.".github/workflows/packages.yml") and run:
+#   nix run .#render-workflows
+# Or commit to trigger the pre-commit hook if enabled.
+jobs:
+  build-package:
+    name: Build package
+    runs-on: macos-15
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - name: Install Lix
+      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+      with:
+        extra_nix_config: |-
+          accept-flake-config = true
+          max-jobs = auto
+    - name: Add SSH keys to ssh-agent
+      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+      with:
+        ssh-private-key: |-
+          ${{ secrets.SECRETS_DEPLOY_KEY }}"
+          ${{ secrets.PRAGMATAPRO_DEPLOY_KEY }}"
+    - name: Setup Attic cache
+      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
+      with:
+        cache: tilde
+        endpoint: https://cache.e10.camp
+        token: ${{ secrets.ATTIC_TOKEN }}
+    - name: Use Cachix store
+      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
+      with:
+        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+        installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix
+        name: tilde
+    - name: Build ${{ matrix.package }} (${{ matrix.architecture }}) package
+      run: nix build .#packages.${{ matrix.architecture }}.${{ matrix.package }} --keep-going
+        --print-build-logs --show-trace --verbose
+    strategy:
+      matrix:
+        architecture:
+        - aarch64-darwin
+        package:
+        - gh-stack
+        - nix-docker
+        - oh-my-tmux
+        - render-workflows
+        - sf-pro
+name: Build packages
+'on':
+  push:
+    paths:
+    - flake.lock
+    - modules/packages/**/*.nix

Justfile

@@ -64,3 +64,7 @@ generate-user-age-key:
 [doc("Get the age key for the current host")]
 host-age-key:
     nix shell nixpkgs#ssh-to-age --command sh -c "sudo cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age"
+
+[doc("Render the GitHub workflow files")]
+render-workflows:
+    nix run .#render-workflows