nix-shell.yml

name: "Nix Shell Build"
on:
  pull_request:
    branches: ["main", "nix"]
  push:
    branches: ["main", "nix"]

permissions:
  contents: read

jobs:
  nix-build:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            crates.io:443
            index.crates.io:443
            static.crates.io:443
            static.rust-lang.org:443
            nixos.org:443
            cache.nixos.org:443
            channels.nixos.org:443
            releases.nixos.org:443
            tarballs.nixos.org:443

      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          submodules: true
      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: rrbutani/use-nix-shell-action@59a52b2b9bbfe3cc0e7deb8f9059abe37a439edf # v1.1.0
        with:
          file: shell.nix
      - name: Add Nightly
        run: rustup toolchain install nightly-x86_64-unknown-linux-gnu
      - name: Add Rustup
        run: rustup component add rustfmt --toolchain nightly-x86_64-unknown-linux-gnu
      - name: Build
        run: just build