ci(nix): pin Determinate Nix runtime

.github/workflows/agent-ci.yml

@@ -91,10 +91,16 @@ jobs:
 
       - name: Install pinned Nix environment
         if: runner.os != 'Windows'
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        if: runner.os != 'Windows'
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install pinned Windows Rust
         if: runner.os == 'Windows'
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable action, exact toolchain below

.github/workflows/agent-desktop-build.yml

@@ -94,9 +94,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
@@ -141,9 +146,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
@@ -193,9 +203,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
@@ -237,9 +252,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Cache Agent release dependencies
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
         with:
@@ -312,9 +332,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
@@ -363,9 +388,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Download exact Agent packages
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:

.github/workflows/android-build.yml

@@ -25,10 +25,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -111,10 +115,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download Android artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:

.github/workflows/android-pr-build.yml

@@ -25,10 +25,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:

.github/workflows/auth-pages-build.yml

@@ -19,10 +19,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Test Pages artifact and deployment boundaries
         run: nix build --no-update-lock-file --no-link --print-build-logs .#checks.x86_64-linux.pages
 

.github/workflows/auth-pages-ci.yml

@@ -46,10 +46,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Test Pages artifact and deployment boundaries
         run: nix build --no-update-lock-file --no-link --print-build-logs .#checks.x86_64-linux.pages
 

.github/workflows/auth-pages-dev-publish.yml

@@ -51,10 +51,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install trusted deployment dependencies
         working-directory: services/updates
         run: nix develop --no-update-lock-file ../..#pages -c bun install --frozen-lockfile --ignore-scripts
@@ -108,10 +112,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install trusted deployment dependencies
         working-directory: services/updates
         run: nix develop --no-update-lock-file ../..#pages -c bun install --frozen-lockfile --ignore-scripts

.github/workflows/auth-pages-publish.yml

@@ -42,10 +42,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install trusted deployment dependencies
         working-directory: services/updates
         run: nix develop --no-update-lock-file ../..#pages -c bun install --frozen-lockfile --ignore-scripts

.github/workflows/desktop-build.yml

@@ -28,10 +28,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -97,10 +101,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -176,10 +184,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download Linux desktop artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
@@ -201,10 +213,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download macOS desktop artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
@@ -350,10 +366,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download Windows desktop artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:

.github/workflows/desktop-pr-build.yml

@@ -34,10 +34,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -91,10 +95,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -127,10 +135,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -266,10 +278,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download Windows artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with: