refactor: harmonized nix ci alignment

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+permissions:
+  contents: read
+  id-token: write
+  actions: write
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  checks:
+    name: Nix checks
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      actions: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@main
+
+      - name: Set up Nix store cache
+        uses: nix-community/cache-nix-action@v6
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock', 'Cargo.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          gc-max-store-size-linux: 10G
+          purge: true
+          purge-prefixes: nix-${{ runner.os }}-
+          purge-created: 14
+          purge-last-access: 7
+          purge-primary-key: never
+
+      - name: Run all flake checks
+        run: nix flake check -L --show-trace

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
   push:
     tags:
-      - '**[0-9]+.[0-9]+.[0-9]+*'
+      - "**[0-9]+.[0-9]+.[0-9]+*"
 
 jobs:
   plan:
@@ -17,6 +17,7 @@ jobs:
       tag: ${{ !github.event.pull_request && github.ref_name || '' }}
       tag-flag: ${{ !github.event.pull_request && format('--tag={0}', github.ref_name) || '' }}
       publishing: ${{ !github.event.pull_request }}
+      ort-version: ${{ steps.ort_version.outputs.value }}
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
@@ -25,11 +26,27 @@ jobs:
           submodules: recursive
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v27
+        uses: DeterminateSystems/determinate-nix-action@main
         with:
-          extra_nix_config: |
+          extra-conf: |
             experimental-features = nix-command flakes
 
+      - name: Set up Nix store cache
+        uses: nix-community/cache-nix-action@v6
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock', 'Cargo.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          gc-max-store-size-linux: 10G
+          purge: true
+          purge-prefixes: nix-${{ runner.os }}-
+          purge-created: 14
+          purge-last-access: 7
+          purge-primary-key: never
+
+      - name: Read ORT version from flake
+        id: ort_version
+        run: echo "value=$(nix eval .#lib.ortVersion --raw)" >> "$GITHUB_OUTPUT"
+
       - name: Verify ort-version matches nixpkgs onnxruntime
         run: nix flake check --system x86_64-linux -L
 
@@ -78,7 +95,7 @@ jobs:
 
       - name: Load ONNX Runtime version
         shell: bash
-        run: echo "ORT_VER=$(tr -d '[:space:]' < ort-version)" >> "$GITHUB_ENV"
+        run: echo "ORT_VER=${{ needs.plan.outputs.ort-version }}" >> "$GITHUB_ENV"
 
       - name: Install Rust non-interactively if not already installed
         if: ${{ matrix.container }}
@@ -108,7 +125,7 @@ jobs:
         run: |
           mkdir -p lib
           rm -f lib/*
-      
+
       # Windows PowerShell
       - name: Prepare lib dir (Windows)
         if: runner.os == 'Windows'
@@ -158,7 +175,6 @@ jobs:
           echo "lib/ contents:"
           ls -l lib || dir lib
       # ===== END: Injected ORT staging =====
-
       - name: Install dependencies
         run: |
           ${{ matrix.packages_install }}
@@ -186,21 +202,37 @@ jobs:
             ${{ env.BUILD_MANIFEST_NAME }}
 
   build_and_push_docker_image:
-    name: Build and Push Docker Image
+    name: Build and Push Docker Image (Nix)
     runs-on: ubuntu-latest
     needs: [plan]
     if: ${{ needs.plan.outputs.publishing == 'true' }}
     permissions:
       contents: read
+      id-token: write
       packages: write
+      actions: write
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
         with:
           submodules: recursive
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@main
+
+      - name: Set up Nix store cache
+        uses: nix-community/cache-nix-action@v6
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock', 'Cargo.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          gc-max-store-size-linux: 10G
+          purge: true
+          purge-prefixes: nix-${{ runner.os }}-
+          purge-created: 14
+          purge-last-access: 7
+          purge-primary-key: never
+
+      - name: Build Docker image with Nix
+        run: nix build .#dockerImage -L --show-trace
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
@@ -215,15 +247,16 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
 
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Load and push Docker image
+        env:
+          IMAGE_NAME: ghcr.io/${{ github.repository }}
+          IMAGE_TAG: ${{ needs.plan.outputs.tag }}
+        run: |
+          docker load < result
+          docker tag "minne:1.0.3" "$IMAGE_NAME:$IMAGE_TAG"
+          docker tag "minne:1.0.3" "$IMAGE_NAME:latest"
+          docker push "$IMAGE_NAME:$IMAGE_TAG"
+          docker push "$IMAGE_NAME:latest"
 
   build-global-artifacts:
     needs: [plan, build-local-artifacts]