Use Nix tooling in Forgejo actions

.forgejo/workflows/ci-gates.yml

@@ -50,64 +50,28 @@ jobs:
           tar -xzf .repo/src.tgz -C .repo --strip-components=1
           rm -f .repo/src.tgz
 
-      - name: Bootstrap Rust + web build tools
+      - name: Check Nix toolchain
         shell: bash
         run: |
           set -euo pipefail
           cd .repo
-          install -d -m 755 "$HOME/.local/bin"
-          echo "PATH=$HOME/.local/bin:$PATH" >> "$GITHUB_ENV"
-          export PATH="$HOME/.local/bin:$PATH"
-
-          if ! command -v curl >/dev/null 2>&1; then
-            echo "error: curl is required"
-            exit 2
-          fi
-
-          if ! command -v cargo >/dev/null 2>&1; then
-            curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
-            . "$HOME/.cargo/env"
-          elif [[ -f "$HOME/.cargo/env" ]]; then
-            . "$HOME/.cargo/env"
-          fi
-
-          rustup target add wasm32-unknown-unknown
-
-          if ! command -v trunk >/dev/null 2>&1; then
-            trunk_version="0.21.14"
-            arch="$(uname -m)"
-            case "${arch}" in
-              x86_64|amd64) trunk_target="x86_64-unknown-linux-gnu" ;;
-              aarch64|arm64) trunk_target="aarch64-unknown-linux-gnu" ;;
-              *)
-                echo "error: unsupported runner arch for trunk prebuilt binary: ${arch}"
-                exit 2
-                ;;
-            esac
-            curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${trunk_version}/trunk-${trunk_target}.tar.gz" \
-              | tar -xz -C "$HOME/.local/bin" trunk
-          fi
-
-          cargo --version
-          rustc --version
-          trunk --version
+          nix develop --accept-flake-config -c cargo --version
+          nix develop --accept-flake-config -c rustc --version
+          nix develop --accept-flake-config -c trunk --version
 
       - name: ECP lint
         shell: bash
         run: |
           set -euo pipefail
           cd .repo
-          bash ./scripts/ecp-lint.sh
+          nix develop --accept-flake-config -c bash ./scripts/ecp-lint.sh
 
       - name: Rust tests (core subset)
         shell: bash
         run: |
           set -euo pipefail
           cd .repo
-          if [[ -f "$HOME/.cargo/env" ]]; then
-            . "$HOME/.cargo/env"
-          fi
-          cargo test -p ec-core -p ec-crypto -p ec-moq -p ec-iroh -p ec-linux-iptv
+          nix develop --accept-flake-config -c cargo test -p ec-core -p ec-crypto -p ec-moq -p ec-iroh -p ec-linux-iptv
 
       - name: Duplicate publisher proof gates
         shell: bash
@@ -143,8 +107,4 @@ jobs:
         run: |
           set -euo pipefail
           cd .repo
-          if [[ -f "$HOME/.cargo/env" ]]; then
-            . "$HOME/.cargo/env"
-          fi
-          cd apps/web
-          env -u NO_COLOR trunk build --release --public-url /
+          nix develop --accept-flake-config -c bash -c 'cd apps/web && env -u NO_COLOR trunk build --release --public-url /'