Use cargo crane in Nix flake and set up cachix action

[benjajaja]

• Crane allows to separately cache dependencies, use cachix, and more
• Fenix seems to be the preferred way to overlay a specific rust version
• Let fenix use rust-toolchain.toml to pick up the exact version
• Exception for fmt, uses nightly pinned by flake.lock (the CI job uses nightly at the current time)
• Add nix github actions job that runs flake checks (clippy, fmt, and tests)
• Remove obsolete macos/darwin inputs
• Update all flake inputs
• Allow specific unused_variables for macos (fix warning)

The job took 16m, but it should speed up substantially since the dependencies are cached separately. I've used this setup successfully in some of my projects - it should end up taking less time than the non-nix checks, at least when dependencies did not change.

@ulyssa you would need to register at https://www.cachix.org/, it's free for public repos. Then create a new cache (call it iamb-ci, for example), click Settings, click Auth tokens, select "Never" for expiry, and click Generate. Copy the token, and add it as CACHIX_AUTH_TOKEN secret in the github project Settings -> Actions -> Repository secrets.
Alternatively, I can give you the token for my public iamb cache at https://app.cachix.org/cache/iamb-ci.

Fixes #533

[benjajaja]

For reference, with cachix the jobs take 1-5 minutes if the dependencies didn't change: https://github.com/benjajaja/iamb/actions/runs/18530985398/job/52815174904?pr=1

[eclairevoyant]

this and openssl aren't used

[benjajaja]

thank you! removed.

[ulyssa]

Thank you for adding this! I'll hold off on making it a required check for PRs for now, but hopefully it'll make it more obvious when a change breaks the Nix flakes. 🤞

I've made an iamb-prs cache and added a CACHIX_AUTH_TOKEN to the repository secrets for it.

[ulyssa]

For some reason, it doesn't seem to be using the cache. Looking at the configuration for cachix-action, I thought that it might just need useDaemon: false, but setting that didn't fix it either, and it still ends with the "Pushing is disabled" message.

I'll merge it for now, since having something that tests running Nix is better than nothing. Maybe the action only does pushing on main?

[ulyssa]

Maybe the action only does pushing on main?

Looks like that's the case. The main job successfully pushed to the cache.

[benjajaja]

Yes it looks good on main, thank you for setting up the cache!