Add Nix-based CI workflows

Co-authored-by: dichhead <330471626+dichhead@users.noreply.github.com>

.github/actions/setup-nix/action.yml

@@ -0,0 +1,14 @@
+name: Setup Nix
+description: Install Nix and enable the shared binary cache for flake-based CI jobs
+
+runs:
+  using: composite
+  steps:
+    - name: Install Nix
+      uses: DeterminateSystems/nix-installer-action@main
+      with:
+        extra-conf: |
+          experimental-features = nix-command flakes
+
+    - name: Enable Magic Nix Cache
+      uses: DeterminateSystems/magic-nix-cache-action@main

.github/workflows/ci.yml

@@ -0,0 +1,63 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  flake:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-nix
+      - name: Run flake checks
+        run: nix flake check --print-build-logs
+
+  rust:
+    runs-on: ubuntu-22.04
+    defaults:
+      run:
+        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-nix
+      - name: Check formatting
+        run: cargo fmt --all --check
+      - name: Run clippy
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
+      - name: Run library tests
+        run: cargo test --locked --workspace --lib
+
+  web:
+    runs-on: ubuntu-22.04
+    defaults:
+      run:
+        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-nix
+      - name: Build web bundle
+        run: trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
+      - name: Validate website assembly
+        run: python3 scripts/test_site.py
+      - name: Validate locale lookups
+        run: python3 scripts/test_locales.py
+
+  release-automation:
+    runs-on: ubuntu-22.04
+    defaults:
+      run:
+        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-nix
+      - name: Test release automation
+        run: python3 scripts/test_release.py

.github/workflows/pages.yml

@@ -33,12 +33,16 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-22.04
+    defaults:
+      run:
+        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     outputs:
       tag: ${{ steps.source.outputs.tag }}
       commit: ${{ steps.source.outputs.commit }}
     steps:
       - name: Resolve release source
         id: source
+        shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }}
@@ -70,6 +74,8 @@ jobs:
           # release tag; a shallow clone would label the build `+g<hash>`.
           fetch-depth: 0
 
+      - uses: ./.github/actions/setup-nix
+
       - name: Validate release version
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
@@ -82,30 +88,6 @@ jobs:
             test "v$VERSION" = "$RELEASE_TAG"
           fi
 
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-
-      - uses: Swatinem/rust-cache@v2
-
-      - name: Install trunk
-        uses: taiki-e/install-action@v2
-        with:
-          tool: trunk
-
-      - name: Read wasm-bindgen version
-        id: wasm-bindgen-version
-        shell: bash
-        run: |
-          VERSION=$(sed -n '/name = "wasm-bindgen"/{n;s/version = "\(.*\)"/\1/p;q;}' Cargo.lock)
-          test -n "$VERSION"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Install wasm-bindgen CLI
-        uses: taiki-e/install-action@v2
-        with:
-          tool: wasm-bindgen@${{ steps.wasm-bindgen-version.outputs.version }}
-
       - name: Build web bundle
         run: trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
 

.github/workflows/release.yml

@@ -33,6 +33,9 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: write
+    defaults:
+      run:
+        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
 
     steps:
       - name: Checkout
@@ -43,22 +46,12 @@ jobs:
           # release tag; a shallow clone would label the build `+g<hash>`.
           fetch-depth: 0
 
+      - uses: ./.github/actions/setup-nix
+
       - name: Validate package versions
         id: version
-        shell: bash
         run: python3 scripts/release.py versions --tag "$RELEASE_TAG"
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update -q
-          sudo apt-get install -y \
-            libgl1-mesa-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev \
-            libxkbcommon-dev libwayland-dev libfontconfig1-dev libfreetype6-dev \
-            librsvg2-bin fuse libfuse2
-
       - name: Build
         env:
           OCS_PATREON_TOKEN: ${{ secrets.OCS_PATREON_TOKEN }}
@@ -122,6 +115,9 @@ jobs:
     permissions:
       actions: read
       contents: write
+    defaults:
+      run:
+        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     env:
       SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
 
@@ -134,9 +130,10 @@ jobs:
           # release tag; a shallow clone would label the build `+g<hash>`.
           fetch-depth: 0
 
+      - uses: ./.github/actions/setup-nix
+
       - name: Validate package versions
         id: version
-        shell: bash
         run: python3 scripts/release.py versions --tag "$RELEASE_TAG"
 
       - name: Download shared Linux payload
@@ -542,10 +539,14 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: read
+    defaults:
+      run:
+        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.commit || github.sha }}
+      - uses: ./.github/actions/setup-nix
       - name: Verify native release assets and notes
         env:
           GH_TOKEN: ${{ github.token }}

.github/workflows/weekly-release.yml

@@ -25,6 +25,9 @@ jobs:
   prepare:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-22.04
+    defaults:
+      run:
+        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     outputs:
       ready: ${{ steps.release.outputs.ready }}
       tag: ${{ steps.release.outputs.tag }}
@@ -34,6 +37,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 0
+      - uses: ./.github/actions/setup-nix
       - name: Validate release automation
         run: python3 scripts/test_release.py
       - name: Prepare release and verify published notes

README.md

@@ -131,6 +131,26 @@ Change the language from the application settings. The browser version also uses
 
 ## Build from source
 
+### Nix
+
+The GitHub workflows use the repository flake for a reproducible Rust, web, and automation toolchain. To match CI locally:
+
+```bash
+git clone https://github.com/HakanSeven12/OpenCADStudio.git
+cd OpenCADStudio
+nix develop
+```
+
+From that shell, run the same commands CI does, for example:
+
+```bash
+cargo fmt --all --check
+cargo test --locked --workspace --lib
+trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
+python3 scripts/test_site.py
+python3 scripts/test_release.py
+```
+
 ### Desktop
 
 Requirements:

flake.nix

@@ -132,9 +132,15 @@
               fontconfig
               freetype
               git
+              python3
+              nodejs
+              gh
+              jq
+              wget
+              # CI and local automation scripts rely on these CLIs so GitHub
+              # Actions and contributors can share the same flake-defined env.
               # Web build: `trunk build` per Trunk.toml. wasm-bindgen-cli must
-              # match the wasm-bindgen version Cargo.lock resolves, the same
+              # match the wasm-bindgen version Cargo.lock resolves.
-              # constraint .github/workflows/pages.yml:83 reads out of the lock.
               trunk
               wasm-bindgen-cli
               # Rasterises assets/logo.svg for packaging, as release.yml does.