release: v1.0.0

.github/actions/setup-nix/action.yml

@@ -0,0 +1,63 @@
+name: Set up Nix with Cachix
+description: >-
+  Install Nix with flakes enabled and configure Cachix. Pushes to the binary
+  cache only on non-pull_request events that carry an auth token; every other
+  run (including fork pull requests) is pull-only.
+
+inputs:
+  cachix-cache:
+    description: Cachix cache name. When empty, Cachix is not configured at all.
+    required: false
+    default: ""
+  cachix-auth-token:
+    description: >-
+      Cachix auth token. When empty — or on pull_request events — the cache is
+      configured pull-only so untrusted runs can never push.
+    required: false
+    default: ""
+  github-token:
+    description: GitHub token handed to the Nix installer to raise API rate limits.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install Nix
+      uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      with:
+        github_access_token: ${{ inputs.github-token }}
+        extra_nix_config: |
+          experimental-features = nix-command flakes
+
+    # Decide push vs pull-only once, off the event name and token presence,
+    # so both Cachix steps share a single source of truth. The token is read
+    # from the environment rather than interpolated into the script body.
+    - name: Resolve Cachix mode
+      id: cachix-mode
+      shell: bash
+      env:
+        CACHIX_AUTH_TOKEN: ${{ inputs.cachix-auth-token }}
+        EVENT_NAME: ${{ github.event_name }}
+      run: |
+        set -euo pipefail
+        push=false
+        if [[ -n "$CACHIX_AUTH_TOKEN" && "$EVENT_NAME" != "pull_request" ]]; then
+          push=true
+        fi
+        printf 'push=%s\n' "$push" >> "$GITHUB_OUTPUT"
+
+    - name: Configure Cachix (pull-only)
+      if: ${{ inputs.cachix-cache != '' && steps.cachix-mode.outputs.push != 'true' }}
+      uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+      with:
+        name: ${{ inputs.cachix-cache }}
+        extraPullNames: nix-community
+        skipPush: true
+
+    - name: Configure Cachix (push-enabled)
+      if: ${{ inputs.cachix-cache != '' && steps.cachix-mode.outputs.push == 'true' }}
+      uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+      with:
+        name: ${{ inputs.cachix-cache }}
+        authToken: ${{ inputs.cachix-auth-token }}
+        extraPullNames: nix-community

.github/workflows/ci.yml

@@ -15,79 +15,99 @@ permissions:
   contents: read
 
 jobs:
-  verify:
-    name: verify (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
+  nix:
+    name: nix flake check (${{ matrix.system }})
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        include:
+          - system: x86_64-linux
+            runner: ubuntu-latest
+          - system: aarch64-darwin
+            runner: macos-latest
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Install SBCL (Linux)
-        if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y sbcl
-
-      - name: Install SBCL (macOS)
-        if: runner.os == 'macOS'
-        run: brew install sbcl
 
-      - name: Report SBCL version
-        run: sbcl --version
-
-      - name: Run full verification gate
-        run: sbcl --script scripts/verify.lisp
+      - name: Set up Nix with Cachix
+        uses: ./.github/actions/setup-nix
+        with:
+          cachix-cache: ${{ vars.CACHIX_CACHE }}
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # Runs the hermetic test/paredit-lint/formatting checks from flake.nix
+      # (cl-prolog and cl-weave come from flake inputs, not a vendored copy).
+      # --all-systems evaluates every entry in flake.nix's `systems` list, not
+      # just the runner's own: without it a platform this flake advertises but
+      # can no longer evaluate (as x86_64-darwin became once nixpkgs 26.11
+      # dropped it) stays invisible to CI on both matrix runners. Foreign
+      # systems are evaluated, not built, so this stays cheap.
+      - name: Run flake checks
+        run: nix flake check --all-systems --print-build-logs
 
       - name: Check diff hygiene
         run: git diff --check
 
   coverage:
     name: coverage
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
-        with:
-          submodules: recursive
 
-      - name: Install SBCL
-        run: sudo apt-get update && sudo apt-get install -y sbcl
+      - name: Set up Nix with Cachix
+        uses: ./.github/actions/setup-nix
+        with:
+          cachix-cache: ${{ vars.CACHIX_CACHE }}
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate coverage report
-        run: sbcl --script scripts/coverage.lisp
+        run: |
+          set -euo pipefail
+          nix build .#coverage-report --print-build-logs
+          cp -rL result coverage-report
 
       - name: Upload coverage report
         uses: actions/upload-artifact@v4
         with:
           name: coverage-report
-          path: coverage/
+          path: coverage-report/
           if-no-files-found: error
 
-  # Best-effort: exercises contrib/, which pulls Quicklisp plus the
-  # vendor/ git submodules (nerima-lisp/cl-prolog, nerima-lisp/cl-weave). Kept
-  # separate from `verify` and allowed to fail so that submodule/network
-  # flakiness never blocks a core merge, per contrib/README.md's policy
-  # that contrib is opt-in and isolated from the core build and CI.
+  # Best-effort: exercises contrib/, which pulls Quicklisp (for clweb) on top
+  # of cl-prolog/cl-weave from this flake's Nix inputs. Kept separate from
+  # `nix` and allowed to fail so that Quicklisp/network flakiness never
+  # blocks a core merge, per contrib/README.md's policy that contrib is
+  # opt-in and isolated from the core build and CI.
   contrib:
     name: contrib (opt-in, best-effort)
     runs-on: ubuntu-latest
     continue-on-error: true
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
-        with:
-          submodules: recursive
 
-      - name: Install SBCL
-        run: sudo apt-get update && sudo apt-get install -y sbcl
+      - name: Set up Nix with Cachix
+        uses: ./.github/actions/setup-nix
+        with:
+          cachix-cache: ${{ vars.CACHIX_CACHE }}
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Quicklisp
         run: |
-          curl -fsSL -o /tmp/quicklisp.lisp https://beta.quicklisp.org/quicklisp.lisp
-          sbcl --non-interactive \
-            --load /tmp/quicklisp.lisp \
-            --eval '(quicklisp-quickstart:install)'
-
+          set -euo pipefail
+          nix develop --command bash -c '
+            curl -fsSL -o /tmp/quicklisp.lisp https://beta.quicklisp.org/quicklisp.lisp
+            sbcl --non-interactive \
+              --load /tmp/quicklisp.lisp \
+              --eval "(quicklisp-quickstart:install)"
+          '
+
+      # `nix develop` puts cl-prolog/cl-weave from this flake's inputs on
+      # CL_SOURCE_REGISTRY (see flake.nix devShells.default.shellHook).
       - name: Run contrib verification
-        run: sbcl --script contrib/verify-contrib.lisp
+        run: nix develop --command sbcl --script contrib/verify-contrib.lisp

.github/workflows/docs.yml

@@ -5,6 +5,8 @@ on:
     branches: [main]
     paths:
       - "docs/**"
+      - "flake.nix"
+      - "flake.lock"
       - ".github/workflows/docs.yml"
   workflow_dispatch:
 
@@ -23,24 +25,31 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
         with:
-          python-version: "3.12"
+          persist-credentials: false
 
-      - name: Install MkDocs Material
-        run: pip install --disable-pip-version-check mkdocs-material
+      - name: Set up Nix with Cachix
+        uses: ./.github/actions/setup-nix
+        with:
+          cachix-cache: ${{ vars.CACHIX_CACHE }}
+          # Never hand the push token to pull_request runs (local `./` action is
+          # resolved from the PR head). Empty token => pull-only.
+          cachix-auth-token: ${{ github.event_name != 'pull_request' && secrets.CACHIX_AUTH_TOKEN || '' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build documentation
-        timeout-minutes: 5
-        run: mkdocs build --strict --config-file docs/mkdocs.yml
+        timeout-minutes: 10
+        run: |
+          set -euo pipefail
+          nix build .#docs --print-build-logs
+          cp -rL result public
+          chmod -R u+w public
 
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
-          path: site
+          path: public
 
   deploy:
     name: Deploy documentation
@@ -55,4 +64,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.gitignore

@@ -26,6 +26,10 @@ system-index.txt
 cl-tty-kit
 !cl-tty-kit.asd
 
+# Nix build result symlinks (`nix build`, `nix build .#<output>`)
+/result
+/result-*
+
 # Editor and OS noise
 *~
 \#*\#