feat(flake): crane dep-split so releases recompile only the abgen crate

Dependency crates now build in their own derivation keyed on the
manifests/lockfile (verified drv-stable across source edits), which is
what makes the magic nix cache pay: warm linux legs replay the deps
derivation and compile just the abgen crate (132s local vs 13min full).
crane is pinned to the v0.23.4 release tag + narHash; audited 2026-07-22:
pure-nix lib (~3k lines, no binaries), network access only through
fixed-output fetches pinned by our own Cargo.lock checksums. Magic nix
cache returns to the linux legs alongside it.

Author: eordano

.github/workflows/release.yml

@@ -49,6 +49,10 @@ jobs:
     steps:
       - if: matrix.builder == 'nix'
         uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+      # pays off only with the crane dep-split in the flake: the deps
+      # derivation is what gets replayed across releases
+      - if: matrix.builder == 'nix'
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: setup (checkout + toolchains)
         run: |

DEVELOPMENT.md

@@ -184,10 +184,12 @@ the lib sets `#[global_allocator] mimalloc`; any downstream embedding the lib in
 ## Releasing
 
 The release pipeline (`.github/workflows/release.yml`) is plain shell on GitHub-hosted
-runners; the only non-shell steps are Determinate Systems' sha-pinned nix installer on
-the linux legs and first-party actions/cache for the mac legs' cargo caches (measured:
-warm mac caches cut those legs 2-4x; a nix binary cache moved nothing because the whole
-build is one derivation, and its ~9GB would evict the mac caches from the 10GB budget). Every target builds **once**: Linux via
+runners; the only non-shell steps are Determinate Systems' sha-pinned nix installer +
+Magic Nix Cache on the linux legs and first-party actions/cache for the mac legs' cargo
+caches. Measured rationale: warm mac cargo caches cut those legs 2-4x, and the nix cache
+only pays because the flake splits dependency compilation into its own crane derivation
+(keyed on manifests/lockfile, stable across source edits) - without the split, a store
+cache replayed nothing. Every target builds **once**: Linux via
 `nix build` from the committed flake.lock (hermetic; reproduce locally with `nix build` -
 the archives bundle the loader + libs behind the `abgen` entry script and run on any
 Linux, including NixOS); Windows and macOS via the pinned rustup toolchain with

flake.lock

@@ -3,15 +3,21 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # cargo dep-split: dependency crates compile in their own derivation keyed
+    # on the manifests/lockfile, so releases only recompile the abgen crate.
+    # Release-tag pin + narHash in flake.lock; audited 2026-07-22 (pure nix
+    # lib, ~3k lines, only Cargo.lock-checksum-pinned fixed-output fetches).
+    crane.url = "github:ipetkov/crane/v0.23.4";
   };
 
-  outputs = { self, nixpkgs }:
+  outputs = { self, nixpkgs, crane }:
     let
       systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
 
       perSystem = nixpkgs.lib.genAttrs systems (system:
         let
           pkgs = import nixpkgs { inherit system; };
+          craneLib = crane.mkLib pkgs;
 
           nativeDeps = with pkgs; [
             cargo
@@ -28,18 +34,22 @@
           crateVersion = (builtins.fromTOML (builtins.readFile ./crate/Cargo.toml)).package.version;
           gitCommit = if self ? rev then builtins.substring 0 12 self.rev else "unknown";
 
-          abgenPkg = pkgs.rustPlatform.buildRustPackage {
+          commonArgs = {
             pname = "abgen";
             version = crateVersion;
-            env.ABGEN_GIT_COMMIT = gitCommit;
             src = self;
-            cargoLock = {
-              lockFile = ./Cargo.lock;
-            };
             nativeBuildInputs = with pkgs; [ cmake pkg-config git ];
-            cargoBuildFlags = [ "--bin" "abgen" ];
             doCheck = false;
           };
+          cargoArtifacts = craneLib.buildDepsOnly commonArgs;
+
+          abgenPkg = craneLib.buildPackage (commonArgs // {
+            inherit cargoArtifacts;
+            # final derivation only: on cargoArtifacts this would defeat
+            # commit-to-commit dep caching
+            env.ABGEN_GIT_COMMIT = gitCommit;
+            cargoExtraArgs = "--bin abgen";
+          });
         in
         {
           devShells.default = pkgs.mkShell {
@@ -53,9 +63,11 @@
 
           packages.default = abgenPkg;
 
-          packages.abgen-corpus = abgenPkg.overrideAttrs (old: {
+          packages.abgen-corpus = craneLib.buildPackage (commonArgs // {
+            inherit cargoArtifacts;
             pname = "abgen-corpus";
-            cargoBuildFlags = [ "--bin" "abgen-corpus" ];
+            env.ABGEN_GIT_COMMIT = gitCommit;
+            cargoExtraArgs = "--bin abgen-corpus";
           });
 
           packages.dockerImage =