ci(release): retain pinned Nix packages in Cachix

.github/workflows/nix-cache.yml

@@ -0,0 +1,58 @@
+name: Nix Cache
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: Tag whose Nix packages to retain in Cachix
+        type: string
+        required: true
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Tag whose Nix packages to retain in Cachix
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+env:
+  CACHIX_NAME: hakula
+
+jobs:
+  publish:
+    name: Pin (${{ matrix.system }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - system: x86_64-linux
+            runner: ubuntu-latest
+          - system: aarch64-darwin
+            runner: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          ref: refs/tags/${{ inputs.tag }}
+
+      - name: Set up Nix
+        uses: ./.github/actions/setup-nix
+        with:
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Build and pin package
+        env:
+          CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          TAG: ${{ inputs.tag }}
+          SYSTEM: ${{ matrix.system }}
+        run: |
+          store_path=$(nix build --no-link --print-out-paths --print-build-logs)
+          cachix push "$CACHIX_NAME" "$store_path"
+          cachix pin "$CACHIX_NAME" "oxide-code-${TAG}-${SYSTEM}" "$store_path" --keep-revisions 2

.github/workflows/release.yml

@@ -206,10 +206,20 @@ jobs:
           if-no-files-found: error
           overwrite: true
 
+  nix:
+    name: Pin Nix packages
+    if: github.ref_type == 'tag' && !inputs.notes
+    needs: tagged-ci
+    uses: ./.github/workflows/nix-cache.yml
+    with:
+      tag: ${{ github.ref_name }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
   publish:
     name: Publish GitHub Release
     if: github.ref_type == 'tag'
-    needs: [tagged-ci, build]
+    needs: [tagged-ci, build, nix]
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -248,7 +258,14 @@ jobs:
             options+=(--prerelease)
           fi
 
-          gh release create "$GITHUB_REF_NAME" release-assets/* "${options[@]}"
+          gh release create "$GITHUB_REF_NAME" \
+            release-assets/oxide-code-x86_64-unknown-linux-gnu.tar.gz \
+            release-assets/oxide-code-x86_64-unknown-linux-gnu.sha256 \
+            release-assets/oxide-code-aarch64-apple-darwin.tar.gz \
+            release-assets/oxide-code-aarch64-apple-darwin.sha256 \
+            release-assets/oxide-code-x86_64-pc-windows-msvc.zip \
+            release-assets/oxide-code-x86_64-pc-windows-msvc.sha256 \
+            "${options[@]}"
 
   formula:
     name: Check Homebrew Formula

RELEASING.md

@@ -2,6 +2,10 @@
 
 Pushing a tag that matches `v[0-9]+.*` starts `.github/workflows/release.yml`, which waits for a passing CI run on the tagged commit, builds and checks every target, and publishes a GitHub Release with the tag's `CHANGELOG.md` section as its notes. A tag with a prerelease suffix, such as `v0.1.0-rc.1`, publishes a prerelease.
 
+Before publication, the workflow pushes the flake's x86_64 Linux and Apple Silicon macOS packages to the `hakula` Cachix cache and pins each as `oxide-code-<tag>-<system>` to retain its closure.
+
+To restore a published tag's cache pin, run `gh workflow run nix-cache.yml -f tag=vX.Y.Z`.
+
 ## Versioning
 
 - **Through 0.1.0:** tag `v0.1.0-alpha.N` from `main` whenever a user-visible batch or a fix for shipped behavior lands. Once only the release gates remain open in the [`v0.1.0` milestone](https://github.com/hakula139/oxide-code/milestone/1), tag `v0.1.0-rc.1`. There is no beta stage.