Patch for CI

flake.nix

@@ -89,6 +89,11 @@
       inherit (iohkNix.lib) prefixNamesWith;
       removeRecurse = lib.filterAttrsRecursive (n: _: n != "recurseForDerivations");
 
+      macOS-security = pkgs:
+        # make `/usr/bin/security` available in `PATH`, which is needed for stack
+        # on darwin which calls this binary to find certificates
+        pkgs.writeScriptBin "security" ''exec /usr/bin/security "$@"'';
+
       supportedSystems = import ./nix/supported-systems.nix;
       defaultSystem = head supportedSystems;
       customConfig = recursiveUpdate
@@ -145,6 +150,9 @@
         inherit (pkgs.stdenv) hostPlatform;
         project = pkgs.cardanoNodeProject;
 
+        macOS-security =
+          utils.writeScriptBin "security" ''exec /usr/bin/security "$@"'';
+
         # This is used by `nix develop .` to open a devShell
         devShells =
         let
@@ -401,6 +409,7 @@
           inherit (final) haskell-nix;
           inherit (std) incl;
           inherit CHaP;
+          macOS-security = macOS-security (final.pkgs);
         }).appendModule [
           customConfig.haskellNix
         ];

nix/haskell.nix

@@ -4,6 +4,7 @@
 { haskell-nix
 , incl
 , CHaP
+, macOS-security
 }:
 let
 
@@ -279,7 +280,11 @@ let
                   unset TMPDIR
                   export TMPDIR=$(mktemp -d)
                   export TMP=$TMPDIR
-                '';
+                '' + (if pkgs.stdenv.hostPlatform.isDarwin
+                     then ''
+                  export PATH=${macOS-security}/bin:$PATH
+                          ''
+                     else '''');
               packages.cardano-testnet.components.tests.cardano-testnet-golden.preCheck =
                 let
                   # This define files included in the directory that will be passed to `H.getProjectBase` for this test: