Add flake.nix and adjust release job

.github/workflows/ci.yml

@@ -32,3 +32,18 @@ jobs:
         run: echo 'object W' > /tmp/W.scala && scala-cli compile /tmp/W.scala
 
       - run: ./mill _.test
+
+  nix:
+    name: Validate flake
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - run: nix flake show

.github/workflows/release.yml

@@ -98,6 +98,7 @@ jobs:
     permissions:
       contents: write
       id-token: write
+      pull-requests: write
 
     steps:
       - name: Download all artifacts
@@ -122,3 +123,49 @@ jobs:
         with:
           files: artifacts/*
           generate_release_notes: true
+
+      - name: Save checksums before checkout
+        run: cp artifacts/checksums.txt /tmp/checksums.txt
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: main
+
+      - name: Update flake.nix
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+
+          # Convert hex sha256 to Nix SRI format (sha256-<base64>)
+          sri_hash() {
+            echo -n "$1" | xxd -r -p | base64 | tr -d '\n' | sed 's/^/sha256-/'
+          }
+
+          LINUX_X86=$(sri_hash "$(grep "linux-x86_64.tar.gz" /tmp/checksums.txt | awk '{print $1}')")
+          LINUX_ARM=$(sri_hash "$(grep "linux-aarch64.tar.gz" /tmp/checksums.txt | awk '{print $1}')")
+          MACOS_ARM=$(sri_hash "$(grep "macos-arm64.tar.gz" /tmp/checksums.txt | awk '{print $1}')")
+          MACOS_X86=$(sri_hash "$(grep "macos-x86_64.tar.gz" /tmp/checksums.txt | awk '{print $1}')")
+
+          sed -i "s|version = \".*\";|version = \"${VERSION}\";|" flake.nix
+          sed -i "/linux-x86_64/{n;s|hash = \".*\";|hash = \"${LINUX_X86}\";|}" flake.nix
+          sed -i "/linux-aarch64/{n;s|hash = \".*\";|hash = \"${LINUX_ARM}\";|}" flake.nix
+          sed -i "/macos-x86_64/{n;s|hash = \".*\";|hash = \"${MACOS_X86}\";|}" flake.nix
+          sed -i "/macos-arm64/{n;s|hash = \".*\";|hash = \"${MACOS_ARM}\";|}" flake.nix
+
+      - name: Create PR for flake update
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          BRANCH="update-flake-${VERSION}"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add flake.nix
+          git diff --cached --quiet && echo "No changes" && exit 0
+          git checkout -b "${BRANCH}"
+          git commit -m "Update flake.nix to ${VERSION}"
+          git push -u origin "${BRANCH}"
+          gh pr create \
+            --title "Update flake.nix to ${VERSION}" \
+            --body "Automated update of flake.nix hashes for release v${VERSION}." \
+            --base main \
+            --head "${BRANCH}"
+        env:
+          GH_TOKEN: ${{ github.token }}

.gitignore

@@ -18,3 +18,4 @@ langoustine-tracer
 .claude
 ai
 .cellar
+result

flake.nix

@@ -0,0 +1,106 @@
+{
+  description = "Look up the public API of any JVM dependency from the terminal";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs = { self, nixpkgs }:
+    let
+      version = "0.1.0-M4";
+
+      # Per-platform release artifact metadata
+      platforms = {
+        x86_64-linux = {
+          archive = "cellar-${version}-linux-x86_64.tar.gz";
+          hash = "sha256-w5MXP2a19HxJhN27a648zODMqEsVN/WKb5Y+5p2zyxY=";
+        };
+        aarch64-linux = {
+          archive = "cellar-${version}-linux-aarch64.tar.gz";
+          hash = "sha256-3c3cXX1bzIPvDNQOh9ujPoyW81XGVvrW9OAXEe69gc4=";
+        };
+        x86_64-darwin = {
+          archive = "cellar-${version}-macos-x86_64.tar.gz";
+          hash = "sha256-+zrj/SCv6cdos6+vZWXe0hQD7rpCPjHujpTBdSHMsCc=";
+        };
+        aarch64-darwin = {
+          archive = "cellar-${version}-macos-arm64.tar.gz";
+          hash = "sha256-fEHoxWJKJwXhqCEfF1ZH8wsZDpHKDG05ao3fqLp257I=";
+        };
+      };
+
+      eachSystem = nixpkgs.lib.genAttrs (builtins.attrNames platforms);
+    in
+    {
+      packages = eachSystem (system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          meta = platforms.${system};
+          src = pkgs.fetchurl {
+            url = "https://github.com/VirtusLab/cellar/releases/download/v${version}/${meta.archive}";
+            hash = meta.hash;
+          };
+        in
+        {
+          default = pkgs.stdenv.mkDerivation {
+            pname = "cellar";
+            inherit version src;
+
+            sourceRoot = ".";
+
+            nativeBuildInputs = pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
+              pkgs.autoPatchelfHook
+              pkgs.glibc
+            ];
+
+            unpackPhase = ''
+              tar xzf $src
+            '';
+
+            installPhase = ''
+              mkdir -p $out/bin
+              cp cellar $out/bin/cellar
+              chmod +x $out/bin/cellar
+            '';
+
+            meta = with pkgs.lib; {
+              description = "Look up the public API of any JVM dependency from the terminal";
+              homepage = "https://github.com/VirtusLab/cellar";
+              license = licenses.mpl20;
+              platforms = [ system ];
+              mainProgram = "cellar";
+            };
+          };
+
+          # Install a locally-built binary into the nix profile.
+          # Usage: ./mill cli.nativeImage && nix profile install --impure .#dev
+          dev = let
+            binary = builtins.path {
+              path = builtins.toPath "${builtins.getEnv "PWD"}/out/cli/nativeImage.dest/native-executable";
+              name = "cellar-native-executable";
+            };
+          in pkgs.stdenv.mkDerivation {
+            pname = "cellar";
+            version = "dev";
+            dontUnpack = true;
+
+            installPhase = ''
+              mkdir -p $out/bin
+              cp ${binary} $out/bin/cellar
+              chmod +x $out/bin/cellar
+            '';
+
+            meta = with pkgs.lib; {
+              description = "Look up the public API of any JVM dependency from the terminal (dev build)";
+              homepage = "https://github.com/VirtusLab/cellar";
+              license = licenses.mpl20;
+              platforms = [ system ];
+              mainProgram = "cellar";
+            };
+          };
+        }
+      );
+
+      overlays.default = final: prev: {
+        cellar = self.packages.${final.system}.default;
+      };
+    };
+}