update-certify.yml

--- # !yamlfmt!:ignore
# Generated by `nixcfg ci workflow generate` -- do not hand-edit.
# Source of truth: lib/update/ci/workflow_defs.py.
name: "Update: Certify"

on:
  # Disabled: keep the workflow valid without automatic or manual triggers.
  workflow_call:
    inputs:
      ref:
        description: Branch to certify. Defaults to the update branch from the refresh workflow.
        required: false
        default: update_flake_lock_action
        type: string

permissions:
  contents: read

concurrency:
  group: flake-update-certify
  cancel-in-progress: false

env:
  CACHIX_NAME: gkze
  UPDATE_BRANCH: update_flake_lock_action

jobs:
  select-ref:
    runs-on: ubuntu-24.04
    outputs:
      ref: ${{ steps.resolve.outputs.ref }}
      exists: ${{ steps.resolve.outputs.exists }}
    steps:
      - name: Resolve certification ref
        id: resolve
        env:
          GITHUB_TOKEN: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          TARGET_REF: >-
            ${{ github.event_name == 'workflow_dispatch' && inputs.ref || env.UPDATE_BRANCH }}
          WORKFLOW_RUN_CONCLUSION: ${{ github.event.workflow_run.conclusion || '' }}
          WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha || '' }}
        run: |
          ref="${TARGET_REF}"
          echo "ref=$ref" >> "$GITHUB_OUTPUT"
          if [ "${GITHUB_EVENT_NAME}" = "workflow_run" ] && \
            [ "${WORKFLOW_RUN_CONCLUSION}" != "success" ]; then
            echo \
              "Refresh workflow concluded with '${WORKFLOW_RUN_CONCLUSION}';" \
              "checking '${ref}' for partial certification." \
              >&2
          fi
          repo_url="https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          if ! git ls-remote --exit-code --heads "$repo_url" "refs/heads/$ref" >/dev/null 2>&1; then
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "No update branch '$ref' found; skipping certification." >&2
            exit 0
          fi
          if [ "${GITHUB_EVENT_NAME}" = "workflow_run" ] && \
            [ -n "${WORKFLOW_RUN_HEAD_SHA}" ]; then
            tmp_dir="$(mktemp -d)"
            trap 'rm -rf "$tmp_dir"' EXIT
            git init -q "$tmp_dir"
            git -C "$tmp_dir" fetch --no-tags --filter=blob:none "$repo_url" \
              "+refs/heads/$ref:refs/remotes/origin/$ref"
            if ! git -C "$tmp_dir" cat-file -e "${WORKFLOW_RUN_HEAD_SHA}^{commit}" 2>/dev/null || \
              ! git -C "$tmp_dir" merge-base --is-ancestor \
                "${WORKFLOW_RUN_HEAD_SHA}" "refs/remotes/origin/$ref"; then
              echo "exists=false" >> "$GITHUB_OUTPUT"
              echo \
                "Update branch '$ref' does not contain workflow_run head" \
                "'${WORKFLOW_RUN_HEAD_SHA}'; skipping stale certification." \
                >&2
              exit 0
            fi
          fi
          echo "exists=true" >> "$GITHUB_OUTPUT"

  quality-gates:
    needs: select-ref
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Run shared fast quality checks
        run: |
          nix build .#checks.x86_64-linux.format-repo
          nix build .#checks.x86_64-linux.lint-editorconfig
          nix build .#checks.x86_64-linux.format-yaml-yamlfmt
          nix build .#checks.x86_64-linux.lint-yaml-yamllint
          nix build .#checks.x86_64-linux.format-web-oxfmt
          nix build .#checks.x86_64-linux.lint-web-oxlint
          nix build .#checks.x86_64-linux.format-python-pyupgrade
          nix build .#checks.x86_64-linux.format-python-ruff
          nix build .#checks.x86_64-linux.lint-python-compile
          nix build .#checks.x86_64-linux.lint-python-ruff
          nix build .#checks.x86_64-linux.lint-python-ty
          nix build .#checks.x86_64-linux.lint-workflows-actionlint
      - name: Verify pinned action annotations with pinact
        env:
          GITHUB_TOKEN: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
        run: nix run --inputs-from . nixpkgs#pinact -- run --check
      - name: Run shared deep verification checks
        run: |
          nix build .#checks.x86_64-linux.test-nix-default-api
          nix build .#checks.x86_64-linux.test-nix-package-helpers
          nix build .#checks.x86_64-linux.test-nix-opencode-desktop
          nix build .#checks.x86_64-linux.cache-electron-runtimes
          nix build .#checks.x86_64-linux.test-python-pytest
          nix build .#checks.x86_64-linux.verify-workflow-generated
      - name: Verify crate2nix artifacts are fresh
        run: nix run .#nixcfg -- ci pipeline crate2nix

  darwin-full-smoke:
    needs: select-ref
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: macos-15
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Pre-fetch flake inputs
        run: nix run .#nixcfg -- ci workflow prefetch-flake-inputs
      - name: Dry-run full Darwin outputs
        run: nix run .#nixcfg -- ci workflow darwin eval-full-smoke

  warm-fod-cache-darwin:
    needs:
      - select-ref
      - darwin-full-smoke
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: macos-15
    timeout-minutes: 180
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Free disk space
        run: nix run .#nixcfg -- ci workflow free-disk-space
      - name: Warm dependency cache for aarch64-darwin
        run: nix run .#nixcfg -- ci cache fod

  warm-fod-cache-x86_64-linux:
    needs: select-ref
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 180
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Warm dependency cache for x86_64-linux
        run: nix run .#nixcfg -- ci cache fod

  warm-fod-cache-aarch64-linux:
    needs: select-ref
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 180
    steps:
      - name: Check out update branch archive
        env:
          CHECKOUT_REF: ${{ needs.select-ref.outputs.ref }}
          GITHUB_TOKEN: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          tmp_dir="$(mktemp -d)"
          trap 'rm -rf "$tmp_dir"' EXIT
          curl --fail --location --location-trusted --silent --show-error \
            --header "Authorization: Bearer ${GITHUB_TOKEN}" \
            --header "X-GitHub-Api-Version: 2022-11-28" \
            --output "$tmp_dir/repo.tar.gz" \
            "${GITHUB_API_URL:-https://api.github.com}/repos/${GITHUB_REPOSITORY}/tarball/${CHECKOUT_REF}"
          tar -xzf "$tmp_dir/repo.tar.gz" --strip-components=1
          git init -q
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add -A
          git commit -q -m "workspace snapshot"
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Warm dependency cache for aarch64-linux
        run: nix run .#nixcfg -- ci cache fod

  darwin-priority-heavy:
    name: ${{ matrix.package }}
    needs:
      - select-ref
      - darwin-full-smoke
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: macos-15
    timeout-minutes: 240
    strategy:
      fail-fast: false
      max-parallel: 8
      matrix:
        include:
          - package: codex-v8-native
            target: .#pkgs.aarch64-darwin.codex-v8-native
          - package: goose-cli-v8-native
            target: .#pkgs.aarch64-darwin.goose-cli-v8-native
          - package: zed-editor-nightly
            target: .#pkgs.aarch64-darwin.zed-editor-nightly
          - package: opencode
            target: .#pkgs.aarch64-darwin.opencode
          - package: opencode-desktop-dev
            target: .#pkgs.aarch64-darwin.opencode-desktop-dev
            fod_package: opencode-desktop
          - package: codex
            target: .#pkgs.aarch64-darwin.codex
          - package: gemini-cli
            target: .#pkgs.aarch64-darwin.gemini-cli
          - package: element-desktop
            target: .#pkgs.aarch64-darwin.element-desktop
          - package: linear-cli
            target: .#pkgs.aarch64-darwin.linear-cli
          - package: neovide
            target: .#pkgs.aarch64-darwin.neovide
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Free disk space
        run: nix run .#nixcfg -- ci workflow free-disk-space
      - name: Pre-fetch flake inputs
        run: nix run .#nixcfg -- ci workflow prefetch-flake-inputs
      - name: Warm dependency cache for ${{ matrix.package }}
        run: >-
          nix run .#nixcfg -- ci cache fod --package "${{ matrix.fod_package || matrix.package }}"
      - name: Build heavy target (${{ matrix.package }})
        run: nix build --impure ${{ matrix.target }}

  darwin-extra-heavy:
    name: ${{ matrix.package }}
    needs:
      - select-ref
      - darwin-full-smoke
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: macos-15
    timeout-minutes: 240
    strategy:
      fail-fast: false
      max-parallel: 8
      matrix:
        include:
          - package: goose-cli
            target: .#pkgs.aarch64-darwin.goose-cli
          - package: gitbutler
            target: .#pkgs.aarch64-darwin.gitbutler
          - package: superset
            target: .#pkgs.aarch64-darwin.superset
          - package: scratch
            target: .#pkgs.aarch64-darwin.scratch
          - package: czkawka
            target: .#pkgs.aarch64-darwin.czkawka
          - package: lumen
            target: .#pkgs.aarch64-darwin.lumen
          - package: mountpoint-s3
            target: .#pkgs.aarch64-darwin.mountpoint-s3
          - package: mux
            target: .#pkgs.aarch64-darwin.mux
          - package: rust-analyzer-unwrapped
            target: .#pkgs.aarch64-darwin.rust-analyzer-unwrapped
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Free disk space
        run: nix run .#nixcfg -- ci workflow free-disk-space
      - name: Pre-fetch flake inputs
        run: nix run .#nixcfg -- ci workflow prefetch-flake-inputs
      - name: Warm dependency cache for ${{ matrix.package }}
        run: nix run .#nixcfg -- ci cache fod --package "${{ matrix.package }}"
      - name: Build extra heavy target (${{ matrix.package }})
        run: nix build --impure ${{ matrix.target }}

  darwin-shared:
    needs:
      - select-ref
      - darwin-full-smoke
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: macos-15
    timeout-minutes: 180
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Free disk space
        run: nix run .#nixcfg -- ci workflow free-disk-space
      - name: Pre-fetch flake inputs
        run: nix run .#nixcfg -- ci workflow prefetch-flake-inputs
      - name: Warm shared Darwin dependency cache
        run: nix run .#nixcfg -- ci cache fod
      - name: Build shared Darwin closure
        run: |
          nix run .#nixcfg -- ci cache closure \
            --mode intersection \
            --exclude-ref .#pkgs.aarch64-darwin.codex-v8-native \
            --exclude-ref .#pkgs.aarch64-darwin.goose-cli-v8-native \
            --exclude-ref .#pkgs.aarch64-darwin.zed-editor-nightly \
            --exclude-ref .#pkgs.aarch64-darwin.opencode \
            --exclude-ref .#pkgs.aarch64-darwin.opencode-desktop-dev \
            --exclude-ref .#pkgs.aarch64-darwin.codex \
            --exclude-ref .#pkgs.aarch64-darwin.gemini-cli \
            --exclude-ref .#pkgs.aarch64-darwin.element-desktop \
            --exclude-ref .#pkgs.aarch64-darwin.linear-cli \
            --exclude-ref .#pkgs.aarch64-darwin.neovide \
            --exclude-ref .#pkgs.aarch64-darwin.goose-cli \
            --exclude-ref .#pkgs.aarch64-darwin.gitbutler \
            --exclude-ref .#pkgs.aarch64-darwin.superset \
            --exclude-ref .#pkgs.aarch64-darwin.scratch \
            --exclude-ref .#pkgs.aarch64-darwin.czkawka \
            --exclude-ref .#pkgs.aarch64-darwin.lumen \
            --exclude-ref .#pkgs.aarch64-darwin.mountpoint-s3 \
            --exclude-ref .#pkgs.aarch64-darwin.mux \
            --exclude-ref .#pkgs.aarch64-darwin.rust-analyzer-unwrapped \
            .#darwinConfigurations.argus.system \
            .#darwinConfigurations.rocinante.system

  darwin-argus:
    needs:
      - select-ref
      - darwin-priority-heavy
      - darwin-shared
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: macos-15
    timeout-minutes: 240
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Free disk space
        run: nix run .#nixcfg -- ci workflow free-disk-space
      - name: Install tools required only for full Darwin host builds
        run: nix run .#nixcfg -- ci workflow install-darwin-tools
      - name: Pre-fetch flake inputs
        run: nix run .#nixcfg -- ci workflow prefetch-flake-inputs
      - run: nix run .#nixcfg -- ci workflow build-darwin-config argus

  darwin-rocinante:
    needs:
      - select-ref
      - darwin-priority-heavy
      - darwin-shared
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: macos-15
    timeout-minutes: 240
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Free disk space
        run: nix run .#nixcfg -- ci workflow free-disk-space
      - name: Install tools required only for full Darwin host builds
        run: nix run .#nixcfg -- ci workflow install-darwin-tools
      - name: Pre-fetch flake inputs
        run: nix run .#nixcfg -- ci workflow prefetch-flake-inputs
      - run: nix run .#nixcfg -- ci workflow build-darwin-config rocinante

  linux-x86_64:
    needs: select-ref
    if: needs.select-ref.outputs.exists == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Warm dependency cache for nixcfg
        run: nix run .#nixcfg -- ci cache fod --package nixcfg
      - name: Build representative Linux output
        run: nix build .#pkgs.x86_64-linux.nixcfg
      - name: List update targets
        run: nix run .#nixcfg -- ci workflow list-update-targets

  publish-pr-certification:
    needs:
      - select-ref
      - quality-gates
      - darwin-priority-heavy
      - darwin-extra-heavy
      - darwin-shared
      - darwin-argus
      - darwin-rocinante
      - linux-x86_64
    if: always() && !cancelled() && needs.select-ref.outputs.exists == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      actions: read
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          ref: ${{ needs.select-ref.outputs.ref }}
      # Determinate Nix v3.17.1
      # Nix uses this token for external api.github.com flake fetches.
      # The default github.token produces HTTP 401 "Bad credentials" there.
      - uses: DeterminateSystems/determinate-nix-action@a18f73c54ca8525de051e73c31512a67f44df919
        with:
          github-token: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ${{ env.CACHIX_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: zed
          useDaemon: true
      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/nix/tarball-cache
            ~/.cache/nix/tarball-cache-v2
          key: >-
            nix-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles( 'flake.lock',
            'packages/**/sources.json', 'overlays/**/sources.json', 'packages/**/uv.lock',
            'packages/**/deno-deps.json', 'packages/**/build.zig.zon.nix', 'packages/**/Cargo.nix',
            'packages/**/crate-hashes.json', 'overlays/**/Cargo.nix',
            'overlays/**/crate-hashes.json', 'packages/superset/bun.nix',
            'packages/superset/bun.lock' ) }}
          restore-keys: |
            nix-cache-${{ runner.os }}-${{ runner.arch }}-
            nix-cache-${{ runner.os }}-
      - name: Resolve update PR
        id: pr
        env:
          GH_TOKEN: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
          PR_HEAD_REF: ${{ github.repository_owner }}:${{ needs.select-ref.outputs.ref }}
        run: |
          pr_number="$(gh pr list \
            --repo "${GITHUB_REPOSITORY}" \
            --head "${PR_HEAD_REF}" \
            --state open \
            --json number \
            --jq '.[0].number // ""')"
          if [ -z "${pr_number}" ]; then
            echo "found=false" >> "$GITHUB_OUTPUT"
            echo "No open PR found for ref '${PR_HEAD_REF}'; skipping update." >&2
            exit 0
          fi
          echo "found=true" >> "$GITHUB_OUTPUT"
          echo "number=${pr_number}" >> "$GITHUB_OUTPUT"
      - name: Capture current PR body
        if: steps.pr.outputs.found == 'true'
        env:
          GH_TOKEN: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
        run: >-
          gh pr view "${{ steps.pr.outputs.number }}" --repo "${{ github.repository }}" --json body
          --template '{{.body}}' > /tmp/pr-body-current.md
      - name: Capture certification workflow run metadata
        if: steps.pr.outputs.found == 'true'
        env:
          GH_TOKEN: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
        run: >-
          gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }} >
          /tmp/certification-run.json
      - name: Capture certification job results
        if: steps.pr.outputs.found == 'true'
        env:
          GH_TOKEN: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
        run: >-
          gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id
          }}/jobs?per_page=100" > /tmp/certification-jobs.json
      - name: Render updated PR body
        if: steps.pr.outputs.found == 'true'
        run: >-
          nix run .#nixcfg -- ci workflow render-certification-pr-body --existing-body
          /tmp/pr-body-current.md --output /tmp/pr-body-updated.md --run-json
          /tmp/certification-run.json --jobs-json /tmp/certification-jobs.json --cachix-name "${{
          env.CACHIX_NAME }}"
      - name: Update PR body with certification details
        if: steps.pr.outputs.found == 'true'
        env:
          GH_TOKEN: ${{ secrets.UPDATE_SELF_HEAL_GITHUB_TOKEN }}
        run: >-
          gh pr edit "${{ steps.pr.outputs.number }}" --repo "${{ github.repository }}" --body-file
          /tmp/pr-body-updated.md