From 5e905a0e6cb6df77397fb337a183776fd6355bd8 Mon Sep 17 00:00:00 2001 From: "rigelbuild-renovate[bot]" <319700990+rigelbuild-renovate[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 11:00:23 +0000 Subject: [PATCH] chore(deps): update cachix/install-nix-action digest to 13d8dd5 --- .github/workflows/ci.yml | 18 +++++++++--------- .github/workflows/eng-docs-deploy.yml | 2 +- .github/workflows/release.yml | 12 ++++++------ .github/workflows/renovate.yml | 2 +- 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8ec48eac0..2f4c3358d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -217,7 +217,7 @@ jobs: # triggering ref. ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }} - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The whole toolchain — language runtimes AND the nixpkgs tools — is # built from nix below, and the devenv flake it fetches needs flakes, so @@ -344,7 +344,7 @@ jobs: ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }} - if: matrix.run == 'true' - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The whole toolchain — language runtimes AND the nixpkgs tools — is # built from nix below, and the devenv flake it fetches needs flakes, so @@ -614,7 +614,7 @@ jobs: # on every other event (see setup's checkout). ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }} - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The whole toolchain — language runtimes AND the nixpkgs tools — is # built from nix below, and the devenv flake it fetches needs flakes, so @@ -839,7 +839,7 @@ jobs: # on every other event (see setup's checkout). ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }} - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The whole toolchain — language runtimes AND the nixpkgs tools — is # built from nix below, and the devenv flake it fetches needs flakes, so @@ -1083,7 +1083,7 @@ jobs: # on every other event (see setup's checkout). ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }} - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The whole toolchain — language runtimes AND the nixpkgs tools — is # built from nix below, and the devenv flake it fetches needs flakes, so @@ -1365,7 +1365,7 @@ jobs: # on every other event (see setup's checkout). ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }} - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The whole toolchain — language runtimes AND the nixpkgs tools — is # built from nix below, and the devenv flake it fetches needs flakes, so @@ -1678,7 +1678,7 @@ jobs: # on every other event (see setup's checkout). ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }} - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The whole toolchain — Go + bun — is built from nix (Global Constraint # 3), never a `setup-go` drift. nix runs on macos-14. The two caches @@ -2643,7 +2643,7 @@ jobs: # cleanly, matching the moon job's checkout. fetch-depth: 0 - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The SAME two-cache trust posture as the moon job — the two # substituters the nix builds use plus their trusted keys, never @@ -2780,7 +2780,7 @@ jobs: # cleanly, matching the forge regen lane's checkout. fetch-depth: 0 - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The SAME two-cache trust posture as the moon job — the two # substituters the nix builds use plus their trusted keys, never diff --git a/.github/workflows/eng-docs-deploy.yml b/.github/workflows/eng-docs-deploy.yml index 691ef0a59..d8b5a3d3b 100644 --- a/.github/workflows/eng-docs-deploy.yml +++ b/.github/workflows/eng-docs-deploy.yml @@ -39,7 +39,7 @@ jobs: # ci.yml's checkout (ci.yml:130-135). fetch-depth: 0 - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # The docsite build runs under moon, whose toolchain (bun/node/moon) # comes from nix, not `setup-*` actions — the same posture ci.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4e2de8815..78508fabd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -234,7 +234,7 @@ jobs: echo "should_publish=$should_publish" >> "$GITHUB_OUTPUT" echo "changed-path gate over the image closure set: should_publish=$should_publish" - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 if: steps.gate.outputs.should_publish == 'true' with: # nix-command + flakes for the RigelBuild forks' flakes. The two caches @@ -393,7 +393,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # Caches declared inline, never via accept-flake-config: that would # trust the nixConfig of any evaluated flake and let a branch inject @@ -508,7 +508,7 @@ jobs: with: ref: ${{ needs.release-pr.outputs.sha }} - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # nix-command + flakes; the toolchain (Go + bun) is built from nix # (Global Constraint 3), never `setup-go`. The two caches are declared @@ -630,7 +630,7 @@ jobs: with: ref: ${{ needs.release-pr.outputs.sha }} - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # nix-command + flakes for the RigelBuild forks' flakes. The two caches # are declared HERE, not delegated via `accept-flake-config` — that @@ -917,7 +917,7 @@ jobs: ref: ${{ needs.release-pr.outputs.sha }} fetch-depth: 0 - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # nix-command + flakes for the RigelBuild forks' flakes. The two caches # are declared HERE, not delegated via `accept-flake-config` — that @@ -1164,7 +1164,7 @@ jobs: echo "should_publish=$should_publish" >> "$GITHUB_OUTPUT" echo "changed-path gate over the runner-image closure set: should_publish=$should_publish" - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 if: steps.gate.outputs.should_publish == 'true' with: # The two caches are declared HERE rather than delegated via diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 440543b19..508bc44d5 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -50,7 +50,7 @@ jobs: # shallow single-ref checkout. fetch-depth: 0 - - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31 with: # Same trust posture as ci.yml — name the two caches the devenv build # legitimately uses in this reviewed file rather than delegating via