nix: switch to flakoboros

.github/workflows/nix.yml

@@ -1,54 +1,32 @@
 name: "CI - Nix"
-
 on:
   push:
     branches:
       - devel
   pull_request:
-
 jobs:
-  nix-full:
+  nix:
     runs-on: "${{ matrix.os }}-latest"
     strategy:
-      fail-fast: false
       matrix:
         os: [ubuntu, macos]
+        extends: ["", "pkgs-full.py-pinocchio"]
     steps:
       - uses: actions/checkout@v6
       - uses: cachix/install-nix-action@v31
-      - uses: cachix/cachix-action@v16
+      - uses: cachix/cachix-action@v17
         with:
           name: gepetto
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - run: nix build -L
-
-  nix-split:
-    runs-on: "${{ matrix.os }}-latest"
-    strategy:
-      matrix:
-        os: [ubuntu, macos]
-    steps:
-      - uses: actions/checkout@v6
-      - uses: cachix/install-nix-action@v31
-      - uses: cachix/cachix-action@v16
-        with:
-          name: gepetto
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - run: nix build -L .#libpinocchio
-      - run: nix build -L .#pinocchio-py
-
+      - run: nix flake check -L
+      - run: nix build -L ".#${{ matrix.extends }}" --cores 2
   check:
     if: always()
     name: check-macos-linux-nix
-
+    runs-on: ubuntu-latest
     needs:
-      - nix-full
-      - nix-split
-
-    runs-on: Ubuntu-latest
-
+      - nix
     steps:
-      - name: Decide whether the needed jobs succeeded or failed
-        uses: re-actors/alls-green@release/v1
+      - uses: re-actors/alls-green@release/v1
         with:
           jobs: ${{ toJSON(needs) }}

.github/workflows/update-flake-lock.yml

@@ -1,19 +1,31 @@
 name: update-flake-lock
-
 on:
   workflow_dispatch:
   schedule:
     - cron: '0 1 5 * *'
-
 jobs:
-  lockfile:
-    runs-on: ubuntu-latest
+  update-flake-inputs:
+    runs-on: ubuntu-slim
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
+      - name: Generate GitHub App Token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.GEPETTO_NIX_APP_ID }}
+          private-key: ${{ secrets.GEPETTO_NIX_APP_PRIVATE_KEY }}
       - name: Checkout repository
         uses: actions/checkout@v6
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-      - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@main
         with:
-          token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
+          token: ${{ steps.app-token.outputs.token }}
+      - name: Setup Nix
+        uses: cachix/install-nix-action@v31
+      - name: Update flake inputs
+        uses: mic92/update-flake-inputs@v1
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          pr-labels: 'no-changelog'
+          git-author-name: 'hrp2-14'
+          git-author-email: '40568249+hrp2-14@users.noreply.github.com'