From 0b9cd9cc77d08a62c40f1dd971cf26e0ab169403 Mon Sep 17 00:00:00 2001
From: Manu <manu@snapdragon.cc>
Date: Sun, 12 Jul 2026 08:39:06 +0100
Subject: [PATCH 1/2] ci: add nix flake verification and build job

Verifies all pinned flake inputs (narHash check for every input,
including the three skia-binaries tarballs), evaluates flake outputs
for all systems, and builds the three packages on x86_64-linux.
Paths-filtered so it only runs when the flake, nix definitions, or
Cargo manifests change. Closes the gap where lock-file PRs like #171
had no machine verification.
---
 .github/workflows/nix.yml | 49 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/nix.yml

diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
new file mode 100644
index 0000000..ac1b2a8
--- /dev/null
+++ b/.github/workflows/nix.yml
@@ -0,0 +1,49 @@
+name: nix
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - flake.nix
+      - flake.lock
+      - .nix/**
+      - Cargo.toml
+      - Cargo.lock
+      - .github/workflows/nix.yml
+  pull_request:
+    branches:
+      - main
+    paths:
+      - flake.nix
+      - flake.lock
+      - .nix/**
+      - Cargo.toml
+      - Cargo.lock
+      - .github/workflows/nix.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nix-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  nix:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: cachix/install-nix-action@v31
+
+      - name: Verify all pinned flake inputs (all platforms)
+        run: nix flake archive
+
+      - name: Evaluate flake outputs for all systems
+        run: nix flake check --all-systems --no-build
+
+      - name: Build packages (x86_64-linux)
+        run: nix build .#vykar .#vykar-server .#vykar-gui --print-build-logs

From 438db7039f19df80cf2043d3cabf1543b7579f4f Mon Sep 17 00:00:00 2001
From: Manu <manu@snapdragon.cc>
Date: Sun, 12 Jul 2026 09:40:32 +0100
Subject: [PATCH 2/2] ci(nix): fail fast when skia-binaries pins drift from
 Cargo.lock

skia-bindings' build script does not validate the archive supplied via
SKIA_BINARIES_URL, so a stale flake pin silently builds against outdated
skia binaries instead of failing the build.
---
 .github/workflows/nix.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index ac1b2a8..f79807f 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -39,6 +39,23 @@ jobs:
 
       - uses: cachix/install-nix-action@v31
 
+      # skia-bindings' build script does NOT validate the archive passed via
+      # SKIA_BINARIES_URL (upstream `// TODO: verify key`), so a stale pin
+      # builds successfully against outdated skia binaries instead of failing.
+      # Enforce the version match explicitly.
+      - name: Check skia-binaries pins match Cargo.lock
+        run: |
+          crate_version=$(grep -A1 'name = "skia-bindings"' Cargo.lock | sed -n 's/^version = "\(.*\)"/\1/p')
+          test -n "$crate_version" || { echo "::error::skia-bindings not found in Cargo.lock"; exit 1; }
+          grep -oE 'https://github.com/rust-skia/skia-binaries/releases/download/[^"]+' flake.nix | while read -r url; do
+            tag=$(echo "$url" | cut -d/ -f8)
+            if [ "$tag" != "$crate_version" ]; then
+              echo "::error::flake.nix pins skia-binaries $tag but Cargo.lock has skia-bindings $crate_version: $url"
+              exit 1
+            fi
+          done
+          echo "All skia-binaries pins match skia-bindings $crate_version"
+
       - name: Verify all pinned flake inputs (all platforms)
         run: nix flake archive