From 9802cfdb1446bee97d3d550e7dd9f4d7473a2d78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Benoit?= <jerome.benoit@piment-noir.org>
Date: Sat, 17 Jan 2026 01:22:49 +0100
Subject: [PATCH 1/6] fix(nix): resolve hash race condition in parallel matrix
 jobs

Refactor update-nix-hashes workflow to fix race condition where
concurrent matrix jobs overwrite each other's changes to hashes.json.

- Parallelize hash computation using artifacts instead of direct commits
- Add commit-node-modules-hashes job to consolidate all hashes atomically
- Add --autostash to git pull --rebase for robustness
- Remove update-hashes.sh (logic inlined in workflow)
- Use macos-15-intel for x86_64-darwin consistency

Fixes #8977
---
 .github/workflows/nix-desktop.yml       |   4 +-
 .github/workflows/update-nix-hashes.yml | 177 ++++++++++++++++++++----
 nix/scripts/update-hashes.sh            | 119 ----------------
 3 files changed, 150 insertions(+), 150 deletions(-)
 delete mode 100755 nix/scripts/update-hashes.sh

diff --git a/.github/workflows/nix-desktop.yml b/.github/workflows/nix-desktop.yml
index 01cfaed78b4..3d7c4803133 100644
--- a/.github/workflows/nix-desktop.yml
+++ b/.github/workflows/nix-desktop.yml
@@ -9,6 +9,7 @@ on:
       - "nix/**"
       - "packages/app/**"
       - "packages/desktop/**"
+      - ".github/workflows/nix-desktop.yml"
   pull_request:
     paths:
       - "flake.nix"
@@ -16,6 +17,7 @@ on:
       - "nix/**"
       - "packages/app/**"
       - "packages/desktop/**"
+      - ".github/workflows/nix-desktop.yml"
   workflow_dispatch:
 
 jobs:
@@ -26,7 +28,7 @@ jobs:
         os:
           - blacksmith-4vcpu-ubuntu-2404
           - blacksmith-4vcpu-ubuntu-2404-arm
-          - macos-15
+          - macos-15-intel
           - macos-latest
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
diff --git a/.github/workflows/update-nix-hashes.yml b/.github/workflows/update-nix-hashes.yml
index 19373f748f2..32224bade7c 100644
--- a/.github/workflows/update-nix-hashes.yml
+++ b/.github/workflows/update-nix-hashes.yml
@@ -10,11 +10,13 @@ on:
       - "bun.lock"
       - "package.json"
       - "packages/*/package.json"
+      - ".github/workflows/update-nix-hashes.yml"
   pull_request:
     paths:
       - "bun.lock"
       - "package.json"
       - "packages/*/package.json"
+      - ".github/workflows/update-nix-hashes.yml"
 
 jobs:
   update-flake:
@@ -43,9 +45,9 @@ jobs:
       - name: Update ${{ env.TITLE }}
         run: |
           set -euo pipefail
-          echo "📦 Updating $TITLE..."
+          echo "Updating $TITLE..."
           nix flake update
-          echo "✅ $TITLE updated successfully"
+          echo "$TITLE updated successfully"
 
       - name: Commit ${{ env.TITLE }} changes
         env:
@@ -53,7 +55,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          echo "🔍 Checking for changes in tracked files..."
+          echo "Checking for changes in tracked files..."
 
           summarize() {
             local status="$1"
@@ -71,29 +73,29 @@ jobs:
           FILES=(flake.lock flake.nix)
           STATUS="$(git status --short -- "${FILES[@]}" || true)"
           if [ -z "$STATUS" ]; then
-            echo "✅ No changes detected."
+            echo "No changes detected."
             summarize "no changes"
             exit 0
           fi
 
-          echo "📝 Changes detected:"
+          echo "Changes detected:"
           echo "$STATUS"
-          echo "🔗 Staging files..."
+          echo "Staging files..."
           git add "${FILES[@]}"
-          echo "💾 Committing changes..."
+          echo "Committing changes..."
           git commit -m "Update $TITLE"
-          echo "✅ Changes committed"
+          echo "Changes committed"
 
           BRANCH="${TARGET_BRANCH:-${GITHUB_REF_NAME}}"
-          echo "🌳 Pulling latest from branch: $BRANCH"
-          git pull --rebase origin "$BRANCH"
-          echo "🚀 Pushing changes to branch: $BRANCH"
+          echo "Pulling latest from branch: $BRANCH"
+          git pull --rebase --autostash origin "$BRANCH"
+          echo "Pushing changes to branch: $BRANCH"
           git push origin HEAD:"$BRANCH"
-          echo "✅ Changes pushed successfully"
+          echo "Changes pushed successfully"
 
           summarize "committed $(git rev-parse --short HEAD)"
 
-  update-node-modules-hash:
+  compute-node-modules-hash:
     needs: update-flake
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     strategy:
@@ -111,7 +113,6 @@ jobs:
     runs-on: ${{ matrix.host }}
     env:
       SYSTEM: ${{ matrix.system }}
-      TITLE: node_modules hash (${{ matrix.system }})
 
     steps:
       - name: Checkout repository
@@ -125,6 +126,97 @@ jobs:
       - name: Setup Nix
         uses: nixbuild/nix-quick-install-action@v34
 
+      - name: Compute node_modules hash
+        run: |
+          set -euo pipefail
+
+          DUMMY="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+          HASH_FILE="nix/hashes.json"
+          OUTPUT_FILE="hash-${SYSTEM}.txt"
+
+          export NIX_KEEP_OUTPUTS=1
+          export NIX_KEEP_DERIVATIONS=1
+
+          BUILD_LOG=$(mktemp)
+          TMP_JSON=$(mktemp)
+          trap 'rm -f "$BUILD_LOG" "$TMP_JSON"' EXIT
+
+          # Set dummy hash to force nix to rebuild and reveal correct hash
+          jq --arg system "$SYSTEM" --arg value "$DUMMY" \
+            '.nodeModules = (.nodeModules // {}) | .nodeModules[$system] = $value' "$HASH_FILE" > "$TMP_JSON"
+          mv "$TMP_JSON" "$HASH_FILE"
+
+          MODULES_ATTR=".#packages.${SYSTEM}.default.node_modules"
+
+          echo "Building node_modules for ${SYSTEM} to discover correct hash..."
+          BUILD_PATH="$(nix build "$MODULES_ATTR" --print-out-paths -L 2>&1 | tee "$BUILD_LOG" | head -n1 || true)"
+
+          CORRECT_HASH=""
+
+          # Try to get hash from successful build
+          if [ -n "$BUILD_PATH" ] && [ -d "$BUILD_PATH" ]; then
+            echo "Realized node_modules output: $BUILD_PATH"
+            CORRECT_HASH=$(nix hash path --sri "$BUILD_PATH" 2>/dev/null || true)
+          fi
+
+          # Try to extract hash from build log
+          if [ -z "$CORRECT_HASH" ]; then
+            CORRECT_HASH="$(grep -E 'got:\s+sha256-[A-Za-z0-9+/=]+' "$BUILD_LOG" | awk '{print $2}' | head -n1 || true)"
+          fi
+
+          if [ -z "$CORRECT_HASH" ]; then
+            CORRECT_HASH="$(grep -A2 'hash mismatch' "$BUILD_LOG" | grep 'got:' | awk '{print $2}' | sed 's/sha256:/sha256-/' || true)"
+          fi
+
+          # Try to hash from kept failed build directory
+          if [ -z "$CORRECT_HASH" ]; then
+            KEPT_DIR=$(grep -oE "build directory.*'[^']+'" "$BUILD_LOG" | grep -oE "'/[^']+'" | tr -d "'" | head -n1 || true)
+            if [ -z "$KEPT_DIR" ]; then
+              KEPT_DIR=$(grep -oE '/nix/var/nix/builds/[^ ]+' "$BUILD_LOG" | head -n1 || true)
+            fi
+
+            if [ -n "$KEPT_DIR" ] && [ -d "$KEPT_DIR" ]; then
+              HASH_PATH="$KEPT_DIR"
+              [ -d "$KEPT_DIR/build" ] && HASH_PATH="$KEPT_DIR/build"
+
+              if [ -d "$HASH_PATH/node_modules" ]; then
+                CORRECT_HASH=$(nix hash path --sri "$HASH_PATH" 2>/dev/null || true)
+              fi
+            fi
+          fi
+
+          if [ -z "$CORRECT_HASH" ]; then
+            echo "Failed to determine correct node_modules hash for ${SYSTEM}."
+            cat "$BUILD_LOG"
+            exit 1
+          fi
+
+          echo "$CORRECT_HASH" > "$OUTPUT_FILE"
+          echo "Hash for ${SYSTEM}: $CORRECT_HASH"
+
+      - name: Upload hash artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: hash-${{ matrix.system }}
+          path: hash-${{ matrix.system }}.txt
+          retention-days: 1
+
+  commit-node-modules-hashes:
+    needs: compute-node-modules-hash
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      TITLE: node_modules hashes
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+          ref: ${{ github.head_ref || github.ref_name }}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+
       - name: Configure git
         run: |
           git config --global user.email "action@github.com"
@@ -135,14 +227,43 @@ jobs:
           TARGET_BRANCH: ${{ github.head_ref || github.ref_name }}
         run: |
           BRANCH="${TARGET_BRANCH:-${GITHUB_REF_NAME}}"
-          git pull origin "$BRANCH"
+          git pull --rebase --autostash origin "$BRANCH"
 
-      - name: Update ${{ env.TITLE }}
+      - name: Download all hash artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: hash-*
+          merge-multiple: true
+
+      - name: Merge hashes into hashes.json
         run: |
           set -euo pipefail
-          echo "🔄 Updating $TITLE..."
-          nix/scripts/update-hashes.sh
-          echo "✅ $TITLE updated successfully"
+
+          HASH_FILE="nix/hashes.json"
+          TMP_JSON=$(mktemp)
+          trap 'rm -f "$TMP_JSON"' EXIT
+
+          echo "Merging hashes into ${HASH_FILE}..."
+
+          shopt -s nullglob
+          files=(hash-*.txt)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "ERROR: No hash files found"
+            exit 1
+          fi
+
+          for f in "${files[@]}"; do
+            system="${f#hash-}"
+            system="${system%.txt}"
+            hash=$(cat "$f")
+            echo "  $system: $hash"
+            jq --arg sys "$system" --arg h "$hash" \
+              '.nodeModules = (.nodeModules // {}) | .nodeModules[$sys] = $h' "$HASH_FILE" > "$TMP_JSON"
+            mv "$TMP_JSON" "$HASH_FILE"
+          done
+
+          echo "All hashes merged:"
+          cat "$HASH_FILE"
 
       - name: Commit ${{ env.TITLE }} changes
         env:
@@ -150,7 +271,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          echo "🔍 Checking for changes in tracked files..."
+          HASH_FILE="nix/hashes.json"
+          echo "Checking for changes..."
 
           summarize() {
             local status="$1"
@@ -166,27 +288,22 @@ jobs:
             echo "" >> "$GITHUB_STEP_SUMMARY"
           }
 
-          FILES=(nix/hashes.json)
+          FILES=("$HASH_FILE")
           STATUS="$(git status --short -- "${FILES[@]}" || true)"
           if [ -z "$STATUS" ]; then
-            echo "✅ No changes detected."
+            echo "No changes detected."
             summarize "no changes"
             exit 0
           fi
 
-          echo "📝 Changes detected:"
+          echo "Changes detected:"
           echo "$STATUS"
-          echo "🔗 Staging files..."
           git add "${FILES[@]}"
-          echo "💾 Committing changes..."
           git commit -m "Update $TITLE"
-          echo "✅ Changes committed"
 
           BRANCH="${TARGET_BRANCH:-${GITHUB_REF_NAME}}"
-          echo "🌳 Pulling latest from branch: $BRANCH"
-          git pull --rebase origin "$BRANCH"
-          echo "🚀 Pushing changes to branch: $BRANCH"
+          git pull --rebase --autostash origin "$BRANCH"
           git push origin HEAD:"$BRANCH"
-          echo "✅ Changes pushed successfully"
+          echo "Changes pushed successfully"
 
           summarize "committed $(git rev-parse --short HEAD)"
diff --git a/nix/scripts/update-hashes.sh b/nix/scripts/update-hashes.sh
deleted file mode 100755
index 1e294fe4fb4..00000000000
--- a/nix/scripts/update-hashes.sh
+++ /dev/null
@@ -1,119 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-DUMMY="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
-SYSTEM=${SYSTEM:-x86_64-linux}
-DEFAULT_HASH_FILE=${MODULES_HASH_FILE:-nix/hashes.json}
-HASH_FILE=${HASH_FILE:-$DEFAULT_HASH_FILE}
-
-if [ ! -f "$HASH_FILE" ]; then
-  cat >"$HASH_FILE" <<EOF
-{
-  "nodeModules": {}
-}
-EOF
-fi
-
-if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-  if ! git ls-files --error-unmatch "$HASH_FILE" >/dev/null 2>&1; then
-    git add -N "$HASH_FILE" >/dev/null 2>&1 || true
-  fi
-fi
-
-export DUMMY
-export NIX_KEEP_OUTPUTS=1
-export NIX_KEEP_DERIVATIONS=1
-
-cleanup() {
-  rm -f "${JSON_OUTPUT:-}" "${BUILD_LOG:-}" "${TMP_EXPR:-}"
-}
-
-trap cleanup EXIT
-
-write_node_modules_hash() {
-  local value="$1"
-  local system="${2:-$SYSTEM}"
-  local temp
-  temp=$(mktemp)
-  
-  if jq -e '.nodeModules | type == "object"' "$HASH_FILE" >/dev/null 2>&1; then
-    jq --arg system "$system" --arg value "$value" '.nodeModules[$system] = $value' "$HASH_FILE" >"$temp"
-  else
-    jq --arg system "$system" --arg value "$value" '.nodeModules = {($system): $value}' "$HASH_FILE" >"$temp"
-  fi
-  
-  mv "$temp" "$HASH_FILE"
-}
-
-TARGET="packages.${SYSTEM}.default"
-MODULES_ATTR=".#packages.${SYSTEM}.default.node_modules"
-CORRECT_HASH=""
-
-DRV_PATH="$(nix eval --raw "${MODULES_ATTR}.drvPath")"
-
-echo "Setting dummy node_modules outputHash for ${SYSTEM}..."
-write_node_modules_hash "$DUMMY"
-
-BUILD_LOG=$(mktemp)
-JSON_OUTPUT=$(mktemp)
-
-echo "Building node_modules for ${SYSTEM} to discover correct outputHash..."
-echo "Attempting to realize derivation: ${DRV_PATH}"
-REALISE_OUT=$(nix-store --realise "$DRV_PATH" --keep-failed 2>&1 | tee "$BUILD_LOG" || true)
-
-BUILD_PATH=$(echo "$REALISE_OUT" | grep "^/nix/store/" | head -n1 || true)
-if [ -n "$BUILD_PATH" ] && [ -d "$BUILD_PATH" ]; then
-  echo "Realized node_modules output: $BUILD_PATH"
-  CORRECT_HASH=$(nix hash path --sri "$BUILD_PATH" 2>/dev/null || true)
-fi
-
-if [ -z "$CORRECT_HASH" ]; then
-  CORRECT_HASH="$(grep -E 'got:\s+sha256-[A-Za-z0-9+/=]+' "$BUILD_LOG" | awk '{print $2}' | head -n1 || true)"
-
-  if [ -z "$CORRECT_HASH" ]; then
-    CORRECT_HASH="$(grep -A2 'hash mismatch' "$BUILD_LOG" | grep 'got:' | awk '{print $2}' | sed 's/sha256:/sha256-/' || true)"
-  fi
-
-  if [ -z "$CORRECT_HASH" ]; then
-    echo "Searching for kept failed build directory..."
-    KEPT_DIR=$(grep -oE "build directory.*'[^']+'" "$BUILD_LOG" | grep -oE "'/[^']+'" | tr -d "'" | head -n1)
-
-    if [ -z "$KEPT_DIR" ]; then
-      KEPT_DIR=$(grep -oE '/nix/var/nix/builds/[^ ]+' "$BUILD_LOG" | head -n1)
-    fi
-
-    if [ -n "$KEPT_DIR" ] && [ -d "$KEPT_DIR" ]; then
-      echo "Found kept build directory: $KEPT_DIR"
-      if [ -d "$KEPT_DIR/build" ]; then
-        HASH_PATH="$KEPT_DIR/build"
-      else
-        HASH_PATH="$KEPT_DIR"
-      fi
-
-      echo "Attempting to hash: $HASH_PATH"
-      ls -la "$HASH_PATH" || true
-
-      if [ -d "$HASH_PATH/node_modules" ]; then
-        CORRECT_HASH=$(nix hash path --sri "$HASH_PATH" 2>/dev/null || true)
-        echo "Computed hash from kept build: $CORRECT_HASH"
-      fi
-    fi
-  fi
-fi
-
-if [ -z "$CORRECT_HASH" ]; then
-  echo "Failed to determine correct node_modules hash for ${SYSTEM}."
-  echo "Build log:"
-  cat "$BUILD_LOG"
-  exit 1
-fi
-
-write_node_modules_hash "$CORRECT_HASH"
-
-jq -e --arg system "$SYSTEM" --arg hash "$CORRECT_HASH" '.nodeModules[$system] == $hash' "$HASH_FILE" >/dev/null
-
-echo "node_modules hash updated for ${SYSTEM}: $CORRECT_HASH"
-
-rm -f "$BUILD_LOG"
-unset BUILD_LOG

From 703e89a942e67b345afc0b60483c55140947fcf0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Benoit?= <jerome.benoit@piment-noir.org>
Date: Sat, 17 Jan 2026 01:32:10 +0100
Subject: [PATCH 2/6] fix(nix): add defensive check for missing hashes.json

---
 .github/workflows/update-nix-hashes.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/update-nix-hashes.yml b/.github/workflows/update-nix-hashes.yml
index 32224bade7c..e923896692a 100644
--- a/.github/workflows/update-nix-hashes.yml
+++ b/.github/workflows/update-nix-hashes.yml
@@ -141,6 +141,11 @@ jobs:
           TMP_JSON=$(mktemp)
           trap 'rm -f "$BUILD_LOG" "$TMP_JSON"' EXIT
 
+          if [ ! -f "$HASH_FILE" ]; then
+            mkdir -p "$(dirname "$HASH_FILE")"
+            echo '{"nodeModules":{}}' > "$HASH_FILE"
+          fi
+
           # Set dummy hash to force nix to rebuild and reveal correct hash
           jq --arg system "$SYSTEM" --arg value "$DUMMY" \
             '.nodeModules = (.nodeModules // {}) | .nodeModules[$system] = $value' "$HASH_FILE" > "$TMP_JSON"
@@ -243,6 +248,11 @@ jobs:
           TMP_JSON=$(mktemp)
           trap 'rm -f "$TMP_JSON"' EXIT
 
+          if [ ! -f "$HASH_FILE" ]; then
+            mkdir -p "$(dirname "$HASH_FILE")"
+            echo '{"nodeModules":{}}' > "$HASH_FILE"
+          fi
+
           echo "Merging hashes into ${HASH_FILE}..."
 
           shopt -s nullglob

From c2d644522d403733663fd552e59e957f301261ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Benoit?= <jerome.benoit@piment-noir.org>
Date: Sat, 17 Jan 2026 01:35:50 +0100
Subject: [PATCH 3/6] chore(ci): update actions to latest versions

---
 .github/workflows/update-nix-hashes.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/update-nix-hashes.yml b/.github/workflows/update-nix-hashes.yml
index e923896692a..e525fcc7c72 100644
--- a/.github/workflows/update-nix-hashes.yml
+++ b/.github/workflows/update-nix-hashes.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
@@ -116,7 +116,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
@@ -200,7 +200,7 @@ jobs:
           echo "Hash for ${SYSTEM}: $CORRECT_HASH"
 
       - name: Upload hash artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: hash-${{ matrix.system }}
           path: hash-${{ matrix.system }}.txt
@@ -215,7 +215,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
@@ -235,7 +235,7 @@ jobs:
           git pull --rebase --autostash origin "$BRANCH"
 
       - name: Download all hash artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: hash-*
           merge-multiple: true

From 8342543f7e7111d85f5dfb30e842495be97dff08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Benoit?= <jerome.benoit@piment-noir.org>
Date: Sat, 17 Jan 2026 02:22:43 +0100
Subject: [PATCH 4/6] fix(nix): use inline temp file instead of mktemp in loop

---
 .github/workflows/update-nix-hashes.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/update-nix-hashes.yml b/.github/workflows/update-nix-hashes.yml
index e525fcc7c72..de6caa8d6b9 100644
--- a/.github/workflows/update-nix-hashes.yml
+++ b/.github/workflows/update-nix-hashes.yml
@@ -245,8 +245,6 @@ jobs:
           set -euo pipefail
 
           HASH_FILE="nix/hashes.json"
-          TMP_JSON=$(mktemp)
-          trap 'rm -f "$TMP_JSON"' EXIT
 
           if [ ! -f "$HASH_FILE" ]; then
             mkdir -p "$(dirname "$HASH_FILE")"
@@ -268,8 +266,8 @@ jobs:
             hash=$(cat "$f")
             echo "  $system: $hash"
             jq --arg sys "$system" --arg h "$hash" \
-              '.nodeModules = (.nodeModules // {}) | .nodeModules[$sys] = $h' "$HASH_FILE" > "$TMP_JSON"
-            mv "$TMP_JSON" "$HASH_FILE"
+              '.nodeModules = (.nodeModules // {}) | .nodeModules[$sys] = $h' "$HASH_FILE" > "${HASH_FILE}.tmp"
+            mv "${HASH_FILE}.tmp" "$HASH_FILE"
           done
 
           echo "All hashes merged:"

From 7cc4630dbfeae920df43e1a22f2aa17255cc29b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Benoit?= <jerome.benoit@piment-noir.org>
Date: Sat, 17 Jan 2026 02:29:20 +0100
Subject: [PATCH 5/6] fix(nix): use nix eval + nix-store --realise for hash
 computation

---
 .github/workflows/update-nix-hashes.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-nix-hashes.yml b/.github/workflows/update-nix-hashes.yml
index de6caa8d6b9..b0e6c99739e 100644
--- a/.github/workflows/update-nix-hashes.yml
+++ b/.github/workflows/update-nix-hashes.yml
@@ -152,13 +152,15 @@ jobs:
           mv "$TMP_JSON" "$HASH_FILE"
 
           MODULES_ATTR=".#packages.${SYSTEM}.default.node_modules"
+          DRV_PATH="$(nix eval --raw "${MODULES_ATTR}.drvPath")"
 
           echo "Building node_modules for ${SYSTEM} to discover correct hash..."
-          BUILD_PATH="$(nix build "$MODULES_ATTR" --print-out-paths -L 2>&1 | tee "$BUILD_LOG" | head -n1 || true)"
+          echo "Attempting to realize derivation: ${DRV_PATH}"
+          REALISE_OUT=$(nix-store --realise "$DRV_PATH" --keep-failed 2>&1 | tee "$BUILD_LOG" || true)
 
+          BUILD_PATH=$(echo "$REALISE_OUT" | grep "^/nix/store/" | head -n1 || true)
           CORRECT_HASH=""
 
-          # Try to get hash from successful build
           if [ -n "$BUILD_PATH" ] && [ -d "$BUILD_PATH" ]; then
             echo "Realized node_modules output: $BUILD_PATH"
             CORRECT_HASH=$(nix hash path --sri "$BUILD_PATH" 2>/dev/null || true)

From 1492824c06ee6e1d689a3362590ea8913c66a0d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Benoit?= <jerome.benoit@piment-noir.org>
Date: Sat, 17 Jan 2026 02:50:51 +0100
Subject: [PATCH 6/6] Add validation and graceful handling for missing/empty
 hashes

---
 .github/workflows/update-nix-hashes.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-nix-hashes.yml b/.github/workflows/update-nix-hashes.yml
index b0e6c99739e..f80a57d25d8 100644
--- a/.github/workflows/update-nix-hashes.yml
+++ b/.github/workflows/update-nix-hashes.yml
@@ -258,14 +258,25 @@ jobs:
           shopt -s nullglob
           files=(hash-*.txt)
           if [ ${#files[@]} -eq 0 ]; then
-            echo "ERROR: No hash files found"
-            exit 1
+            echo "No hash files found, nothing to update"
+            exit 0
           fi
 
+          EXPECTED_SYSTEMS="x86_64-linux aarch64-linux x86_64-darwin aarch64-darwin"
+          for sys in $EXPECTED_SYSTEMS; do
+            if [ ! -f "hash-${sys}.txt" ]; then
+              echo "WARNING: Missing hash file for $sys"
+            fi
+          done
+
           for f in "${files[@]}"; do
             system="${f#hash-}"
             system="${system%.txt}"
             hash=$(cat "$f")
+            if [ -z "$hash" ]; then
+              echo "WARNING: Empty hash for $system, skipping"
+              continue
+            fi
             echo "  $system: $hash"
             jq --arg sys "$system" --arg h "$hash" \
               '.nodeModules = (.nodeModules // {}) | .nodeModules[$sys] = $h' "$HASH_FILE" > "${HASH_FILE}.tmp"