From b22e3d6c8ed51632f0e1614d6bb2b1eac782abf0 Mon Sep 17 00:00:00 2001
From: bruwbird <bruwbird@mercari.com>
Date: Sun, 30 Jun 2024 11:07:38 +0900
Subject: [PATCH] ci: update Nix installation action

update Nix installation action to v25 and configure trusted keys
and substituters for improved caching and security.
---
 .github/workflows/ci.yml | 19 +++++++------------
 flake.lock               | 30 +++++++++++++++---------------
 flake.nix                | 22 +++++++++++++++++++---
 3 files changed, 41 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6b9857a0..69a0be4b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,17 +47,12 @@ jobs:
           key: nix-${{ hashFiles('packages.nix') }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v20
+        uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v25
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      
-      - name: "Import Nix store cache"
-        if: "steps.nix-cache.outputs.cache-hit == 'true'"
-        run: "nix-store --import < /tmp/nixcache"
-
-      - name: "Export Nix store cache"
-        if: "steps.nix-cache.outputs.cache-hit != 'true'"
-        run: "nix-store --export $(find /nix/store -maxdepth 1 -name '*-*') > /tmp/nixcache"
-
-      - name: Run tests
+          extra_nix_config: |
+            trusted-public-keys = nix.casatta.it:HseKZh7436/vKXfZDBHbhr7wwAkzjLwY5BIq+OOrITg= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+            substituters = https://nix.casatta.it https://cache.nixos.org/
+      - uses: DeterminateSystems/magic-nix-cache-action@v2
+      - name: "test"
         run: nix develop --command make test-${{matrix.test-vector}}
diff --git a/flake.lock b/flake.lock
index 6d8b32df..ff7061ca 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,16 +3,15 @@
     "crane": {
       "inputs": {
         "nixpkgs": [
-          "lwk-flake",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1713979152,
-        "narHash": "sha256-apdecPuh8SOQnkEET/kW/UcfjCRb8JbV5BKjoH+DcP4=",
+        "lastModified": 1719685792,
+        "narHash": "sha256-WIoVERD4AN6CmfGSRPy3mfPx2dDbRHgzP2V8z6aNbaY=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "a5eca68a2cf11adb32787fc141cddd29ac8eb79c",
+        "rev": "aa5dcd0518a422dfd545d565f0d5a25971fea52a",
         "type": "github"
       },
       "original": {
@@ -74,7 +73,9 @@
     },
     "lwk-flake": {
       "inputs": {
-        "crane": "crane",
+        "crane": [
+          "crane"
+        ],
         "electrs-flake": "electrs-flake",
         "flake-utils": [
           "flake-utils"
@@ -83,7 +84,9 @@
           "nixpkgs"
         ],
         "registry-flake": "registry-flake",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": [
+          "rust-overlay"
+        ]
       },
       "locked": {
         "lastModified": 1718716287,
@@ -168,29 +171,26 @@
     },
     "root": {
       "inputs": {
+        "crane": "crane",
         "flake-utils": "flake-utils",
         "lwk-flake": "lwk-flake",
         "nixpkgs": "nixpkgs",
-        "nixpkgs2": "nixpkgs2"
+        "nixpkgs2": "nixpkgs2",
+        "rust-overlay": "rust-overlay"
       }
     },
     "rust-overlay": {
       "inputs": {
-        "flake-utils": [
-          "lwk-flake",
-          "flake-utils"
-        ],
         "nixpkgs": [
-          "lwk-flake",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1714356894,
-        "narHash": "sha256-W6Mss7AG6bnFT1BqRApHXvLXBrFOu7V0+EUe9iML30s=",
+        "lastModified": 1719627476,
+        "narHash": "sha256-LBfULF+2sCaWmkjmj1LkkGrAS/E9ZdXU1A5wWKjt9p0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "d9b44509b4064f0a3fc9c7c92a603861f52fbedc",
+        "rev": "5be53be9e5c766fc72fc5d65ba8a566cc0c3217f",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index a245d756..7dc12996 100644
--- a/flake.nix
+++ b/flake.nix
@@ -10,6 +10,19 @@
     # blockstream-electrs: init at 0.4.1 #299761
     # https://github.com/NixOS/nixpkgs/pull/299761/commits/680d27ad847801af781e0a99e4b87ed73965c69a
     nixpkgs2.url = "github:NixOS/nixpkgs/680d27ad847801af781e0a99e4b87ed73965c69a";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-utils.follows = "flake-utils";
+      };
+    };
+    crane = {
+      url = "github:ipetkov/crane";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
     # lwk: init at wasm_0.6.3 #14bac28
     # https://github.com/Blockstream/lwk/releases/tag/wasm_0.6.3
     lwk-flake = {
@@ -17,18 +30,21 @@
       inputs = {
         nixpkgs.follows = "nixpkgs";
         flake-utils.follows = "flake-utils";
+        crane.follows = "crane";
+        rust-overlay.follows = "rust-overlay";
       };
     };
   };
-  outputs = { self, nixpkgs, nixpkgs2, flake-utils, lwk-flake }:
+  outputs = { self, nixpkgs, nixpkgs2, rust-overlay, crane, flake-utils, lwk-flake }:
     flake-utils.lib.eachDefaultSystem
       (system:
         let
+          overlays = [ (import rust-overlay) ];
           pkgs = import nixpkgs {
-            system = system;
+            inherit system overlays;
           };
           pkgs2 = import nixpkgs2 {
-            system = system;
+            inherit system overlays;
           };
           blockstream-electrs = pkgs2.blockstream-electrs.overrideAttrs (oldAttrs: {
             cargoBuildFlags = [ "--features liquid" "--bin electrs" ];