Run multiline workflow steps inside Nix

Co-authored-by: dichhead <330471626+dichhead@users.noreply.github.com>

.github/workflows/pages.yml

@@ -77,7 +77,7 @@ jobs:
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           git merge-base --is-ancestor "$RELEASE_TAG" HEAD
           if [ -f scripts/release.py ]; then
             python3 scripts/release.py versions --tag "$RELEASE_TAG"
@@ -86,6 +86,8 @@ jobs:
             test "v$VERSION" = "$RELEASE_TAG"
           fi
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Build web bundle
         run: nix develop --command trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
@@ -97,26 +99,37 @@ jobs:
           path: website
 
       - name: Validate website
-        working-directory: website
-        run: nix develop --command python3 scripts/test_site.py
+        run: nix develop "$GITHUB_WORKSPACE/website" --command python3 "$GITHUB_WORKSPACE/website/scripts/test_site.py"
 
       - name: Assemble landing page
-        working-directory: website
-        run: nix develop --command sh scripts/assemble-site.sh "$GITHUB_WORKSPACE/dist"
+        run: |
+          SCRIPT=$(cat <<'EOF'
+          cd "$GITHUB_WORKSPACE/website"
+          sh "$GITHUB_WORKSPACE/website/scripts/assemble-site.sh" "$GITHUB_WORKSPACE/dist"
+          EOF
+          )
+          nix develop "$GITHUB_WORKSPACE/website" --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Record website source
-        working-directory: website
-        run: nix develop --command bash --noprofile --norc -euo pipefail -c 'git rev-parse HEAD > "$GITHUB_WORKSPACE/dist/site-version.txt"'
+        run: |
+          SCRIPT=$(cat <<'EOF'
+          cd "$GITHUB_WORKSPACE/website"
+          git rev-parse HEAD > "$GITHUB_WORKSPACE/dist/site-version.txt"
+          EOF
+          )
+          nix develop "$GITHUB_WORKSPACE/website" --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Record release version and source
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
           RELEASE_COMMIT: ${{ steps.source.outputs.commit }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           jq -n --arg version "${RELEASE_TAG#v}" --arg commit "$RELEASE_COMMIT" \
             '{version: $version, commit: $commit}' > dist/app/release.json
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # GitHub Pages runs Jekyll, which ignores files; opt out so the
       # wasm-bindgen output is served verbatim.
@@ -130,7 +143,7 @@ jobs:
         env:
           OCS_PATREON_TOKEN: ${{ secrets.OCS_PATREON_TOKEN }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           python3 - <<'PY'
           import json
           import os
@@ -241,6 +254,8 @@ jobs:
           print(f"supporters: {len(supporters)}")
           PY
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # Publish separate light/dark charts for stars and release downloads.
       - name: Generate project growth charts
@@ -254,7 +269,7 @@ jobs:
       # unavailable during deployment.
       - name: Generate videos.json
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           python3 - <<'PY'
           import json
           import re
@@ -313,13 +328,15 @@ jobs:
           print(f"videos: {len(json.loads(output.read_text(encoding='utf-8')))}")
           PY
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # Publish a public snapshot of GitHub discussions.
       - name: Generate discussions.json
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
+          SCRIPT=$(cat <<'EOF'
           QUERY='
             query($owner: String!, $name: String!) {
               repository(owner: $owner, name: $name) {
@@ -365,6 +382,8 @@ jobs:
             > dist/app/discussions.json
           echo "discussions: $(jq 'length' dist/app/discussions.json)"
           EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - uses: actions/upload-pages-artifact@v3
         with: