ci: Switch to ossystems/nix-actions and drop build matrix

Replace the hand-rolled CI and update-flake workflows with
ossystems/nix-actions composite actions. The CI action builds every
nixosConfigurations toplevel, so the per-host matrix is gone. Workflows
run on the self-hosted runner, dropping install-nix and cachix.

Author: znaniye

.github/workflows/ci.yaml

@@ -12,45 +12,10 @@ on:
       - 'flake.lock'
 
 jobs:
-  check:
-    runs-on: ubuntu-latest
+  ci:
+    runs-on: self-hosted
     steps:
-    - uses: actions/checkout@v6
-    - name: Install Nix
-      uses: nixbuild/nix-quick-install-action@v34
-      with:
-        nix_conf: experimental-features = nix-command flakes repl-flake
-    - uses: cachix/cachix-action@v17
-      with:
-        name: ossystems-lab
-        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-    - name: Install SSH Private Key
-      uses: webfactory/ssh-agent@v0.10.0
-      with:
-        ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
-    - run: nix flake check
-
-  nixos:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        nixosConfiguration:
-          - centrium
-          - hyper
-          - pikachu
-    steps:
-    - run: sudo apt-get clean
-    - uses: actions/checkout@v6
-    - name: Install Nix
-      uses: nixbuild/nix-quick-install-action@v34
-      with:
-        nix_conf: experimental-features = nix-command flakes repl-flake
-    - uses: cachix/cachix-action@v17
-      with:
-        name: ossystems-lab
-        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-    - name: Install SSH Private Key
-      uses: webfactory/ssh-agent@v0.10.0
-      with:
-        ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
-    - run: nix -Lv build ".#nixosConfigurations.${{ matrix.nixosConfiguration }}.config.system.build.toplevel"
+      - uses: ossystems/nix-actions@v1
+        with:
+          checks: true
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

.github/workflows/update-flake.yaml

@@ -6,18 +6,11 @@ on:
 
 jobs:
   lockfile:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Install Nix
-        uses: nixbuild/nix-quick-install-action@v34
+      - uses: ossystems/nix-actions/update-flake@v1
         with:
-          nix_conf: experimental-features = nix-command flakes repl-flake
-      - name: Update flake.lock
-        id: update
-        uses: DeterminateSystems/update-flake-lock@v28
-        with:
-          token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
-      - name: Print PR number
-        run: echo Pull request number is ${{ steps.update.outputs.pull-request-number }}.
+          base-branch: master