feat: initial v3 rewrite

nix/packages/pkgs.nix

@@ -0,0 +1,48 @@
+{
+  inputs,
+  system,
+  ...
+}: let
+  inherit (inputs) pkgs;
+in rec {
+  setupScript = pkgs.writeShellScriptBin "setup_nix_ci" (builtins.readFile ./scripts/setup_nix_ci.sh);
+  finalizeScript = pkgs.writeShellScriptBin "finalize_nix_ci" (builtins.readFile ./scripts/finalize_nix_ci.sh);
+  image = pkgs.dockerTools.buildImage {
+    name = "nix-ci";
+    fromImage = let
+      hashes = {
+        "x86_64-linux" = "sha256-kJ7dqje5o1KPr3RDZ7/THbhMSoiCU1C/7HshDrNfwnM=";
+        "aarch64-linux" = "sha256-jz+Z3Ji+hy5d9ImOh/YOKCqy9P9/cseSov+5J/O95bg=";
+      };
+      # check digest of tags like nixos-24.11-aarch64-linux etc.
+      digests = {
+        "x86_64-linux" = "sha256:345f210dea4cbd049e2d01d13159c829066dfb6e273cdd49ea878186d17b19f7";
+        "aarch64-linux" = "sha256:66163fdf446d851416dd4e9be28c0794d9c2550214a57a846957699a3f5747f6";
+      };
+      hash = hashes.${system} or (throw "Unsupported system");
+      imageDigest = digests.${system} or (throw "Unsupported system");
+    in
+      pkgs.dockerTools.pullImage {
+        imageName = "nixpkgs/nix-flakes";
+        inherit hash imageDigest;
+      };
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      paths = with pkgs;
+        [
+          gitMinimal
+          gnugrep
+          gnused
+          coreutils
+          diffutils
+          cachix
+          attic-client
+        ]
+        ++ [
+          setupScript
+          finalizeScript
+        ];
+      pathsToLink = ["/bin"];
+    };
+  };
+}

nix/packages/scripts/finalize_nix_ci.sh

@@ -0,0 +1,40 @@
+echo -e "\\e[0Ksection_start:`date +%s`:finalize_nix_ci[collapsed=true]\\r\\e[0KFinalizing Nix CI..."
+  nix path-info --all > /tmp/nix-store-after
+  echo "Finding new paths..."
+  NEW_PATHS=$(diff --new-line-format="%L" \
+    --old-line-format="" --unchanged-line-format="" \
+    /tmp/nix-store-before /tmp/nix-store-after)
+  COUNT=$(wc -l <<<"$NEW_PATHS")
+
+  if [[ "$NIX_CI_CACHE_STRATEGY" == "auto" ]]; then
+    export NIX_CI_CACHE_STRATEGY="${NIX_CI_RUNNER_CACHE_STRATEGY:-${NIX_CI_DEFAULT_CACHE_STRATEGY:-none}}";
+  fi
+
+  if [ -z "$NIX_CI_DISABLE_CACHE" ]; then
+    echo -e "\\e[0Ksection_start:`date +%s`:cache_push[collapsed=true]\\r\\e[0KPushing $COUNT new store paths to cache ($NIX_CI_CACHE_STRATEGY)"
+      echo -n "$NEW_PATHS" | {
+        case "$NIX_CI_CACHE_STRATEGY" in
+          "runner")
+            export RUNNER_CACHE=''${RUNNER_CACHE:-"file://$(pwd)/.nix-cache"}
+            # add ^* to all store paths ending in .drv (prevent warning log spam)
+            sed '/\.drv$/s/$/^*/' | nix copy --quiet --to "$RUNNER_CACHE" --stdin || true
+            ;;
+          "attic")
+            attic push --stdin ci:$ATTIC_CACHE || true
+            ;;
+          "cachix")
+            cachix push $CACHIX_CACHE || true
+            ;;
+          "none")
+            echo "Cache strategy is none, doing nothing..."
+            ;;
+          *)
+            echo "WARNING: Invalid cache strategy set: '$NIX_CI_CACHE_STRATEGY'"
+            ;;
+        esac
+      }
+    echo -e "\\e[0Ksection_end:`date +%s`:cache_push\\r\\e[0K"
+  else
+    echo "Caching disabled, not uploading $COUNT new store entries..."
+  fi
+echo -e "\\e[0Ksection_end:`date +%s`:finalize_nix_ci\\r\\e[0K"

nix/packages/scripts/setup_nix_ci.sh

@@ -0,0 +1,48 @@
+echo -e "\\e[0Ksection_start:`date +%s`:nix_setup[collapsed=true]\\r\\e[0KSetting up Nix CI"
+  nix path-info --all > /tmp/nix-store-before
+
+  if [[ "$NIX_CI_CACHE_STRATEGY" == "auto" ]]; then
+    export NIX_CI_CACHE_STRATEGY="${NIX_CI_RUNNER_CACHE_STRATEGY:-${NIX_CI_DEFAULT_CACHE_STRATEGY:-none}}";
+    echo "NIX_CI_CACHE_STRATEGY was set to auto, selected '$NIX_CI_CACHE_STRATEGY' for this job"
+  fi
+
+  if [ -z "$NIX_CI_DISABLE_CACHE" ]; then
+    echo -e "\\e[0Ksection_start:`date +%s`:cache_setup[collapsed=true]\\r\\e[0KConfiguring cache ($NIX_CI_CACHE_STRATEGY)"
+      case "$NIX_CI_CACHE_STRATEGY" in
+        "runner")
+          export RUNNER_CACHE=''${RUNNER_CACHE:-"file://$(pwd)/.nix-cache"}
+          echo "Runner Cache: $RUNNER_CACHE"
+          export NIX_CONFIG="$NIX_CONFIG
+            extra-trusted-substituters = $RUNNER_CACHE?priority=10&trusted=true
+            extra-substituters = $RUNNER_CACHE?priority=10&trusted=true
+          "
+          ;;
+        "attic")
+          echo "Attic Cache: $ATTIC_CACHE"
+          attic login --set-default ci "$ATTIC_SERVER" "$ATTIC_TOKEN" || true
+          attic use "$ATTIC_CACHE" || true
+          ;;
+        "cachix")
+          echo "Cachix Cache: $CACHIX_CACHE"
+          cachix use "$CACHIX_CACHE" || true
+          ;;
+        "none")
+          echo "Cache strategy is none, doing nothing..."
+          ;;
+        *)
+          echo "WARNING: Invalid cache strategy set: '$NIX_CI_CACHE_STRATEGY'"
+          ;;
+      esac
+    echo -e "\\e[0Ksection_end:`date +%s`:cache_setup\\r\\e[0K"
+  else
+    echo "Caching disabled (NIX_CI_DISABLE_CACHE), skipping cache configuration..."
+  fi
+
+  # load the job's deps only if the name was passed
+  if [[ ! -z $1 ]]; then
+    echo -e "\\e[0Ksection_start:`date +%s`:nix_deps[collapsed=true]\\r\\e[0KFetching Nix dependencies for job"
+      nix build .#$1
+      source $(readlink -f result)
+    echo -e "\\e[0Ksection_end:`date +%s`:nix_deps\\r\\e[0K"
+  fi
+echo -e "\\e[0Ksection_end:`date +%s`:nix_setup\\r\\e[0K"