Repository navigation

Nix

chore(build): ignore the worktrees of Claude Code agents #80

	name: Nix

	# Builds the flake the way a user installs it. Nothing else here does, so without this a go.mod
	# change that leaves vendorHash stale breaks `nix profile add` without anyone noticing.
	# dependabot-vendor-hash.yml dispatches this for the commit it pushes.
	on:
	pull_request:
	push:
	branches:
	- main
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	build:
	name: Nix Build (${{ matrix.system }})
	strategy:
	fail-fast: false
	matrix:
	include:
	# One runner per system in flake.nix's supportedSystems.
	- system: x86_64-linux
	runner: ubuntu-latest
	- system: aarch64-linux
	runner: ubuntu-24.04-arm
	- system: aarch64-darwin
	runner: macos-latest
	runs-on: ${{ matrix.runner }}
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
	- run: nix flake check --print-build-logs
	- run: nix build .#meshstack --print-build-logs
	- run: ./result/bin/meshstack --version
	- name: Suggest fix command on failure
	if: failure()
	run: \|
	echo "::error::If the log shows a hash mismatch for the go-modules derivation, run 'task nix:vendor-hash' and commit flake.nix. On a Dependabot pull request, the Dependabot vendorHash workflow does that."