From 0123edbaf712b9c08d8302d2b0cd1510041a4419 Mon Sep 17 00:00:00 2001
From: Dillen Meijboom <dillen@brainhive.nl>
Date: Wed, 28 Oct 2026 16:12:24 +0100
Subject: [PATCH] ci: use self-hosted Nix runners for Linux x86 jobs

---
 .github/workflows/build.yml   |  8 +++++---
 .github/workflows/flake.yml   |  6 +-----
 .github/workflows/release.yml | 14 +++++++++-----
 3 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9e8f464..a8cd86e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,7 +19,7 @@ jobs:
         include:
           - system: x86_64-linux
             package: default
-            runner: ubuntu-latest
+            runner: [self-hosted, nix]
             artifact: brainpod-amd64-linux
             archive: brainpod-amd64-linux.tar.gz
           - system: x86_64-darwin
@@ -39,7 +39,7 @@ jobs:
             archive: brainpod-arm64-macos.tar.gz
           - system: x86_64-linux
             package: windows
-            runner: ubuntu-latest
+            runner: [self-hosted, nix]
             artifact: brainpod-amd64-windows
             archive: brainpod-amd64-windows.zip
 
@@ -47,10 +47,12 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: cachix/install-nix-action@v31
+        if: matrix.system != 'x86_64-linux'
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Restore and save Nix store
+        if: matrix.system != 'x86_64-linux'
         uses: nix-community/cache-nix-action@v7
         with:
           primary-key: nix-v1-${{ matrix.system }}-${{ matrix.package }}-${{ hashFiles('flake.nix', 'flake.lock', 'Cargo.lock') }}
@@ -73,7 +75,7 @@ jobs:
           mkdir package
           cp -L result/bin/brainpod.exe package/brainpod.exe
           cd package
-          zip "../${{ matrix.archive }}" brainpod.exe
+          nix shell --inputs-from "$GITHUB_WORKSPACE" nixpkgs#zip --command zip "../${{ matrix.archive }}" brainpod.exe
 
       - name: Publish artifact
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/flake.yml b/.github/workflows/flake.yml
index 977bbe2..9d78196 100644
--- a/.github/workflows/flake.yml
+++ b/.github/workflows/flake.yml
@@ -9,14 +9,10 @@ permissions:
 jobs:
   check:
     name: Check
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, nix]
 
     steps:
       - uses: actions/checkout@v4
 
-      - uses: cachix/install-nix-action@v31
-        with:
-          github_access_token: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Check flake
         run: nix flake check --all-systems --no-build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 71f94ef..16a4d23 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
         include:
           - system: x86_64-linux
             package: default
-            runner: ubuntu-latest
+            runner: [self-hosted, nix]
             artifact: brainpod-amd64-linux
             archive: brainpod-amd64-linux.tar.gz
           - system: x86_64-darwin
@@ -38,7 +38,7 @@ jobs:
             archive: brainpod-arm64-macos.tar.gz
           - system: x86_64-linux
             package: windows
-            runner: ubuntu-latest
+            runner: [self-hosted, nix]
             artifact: brainpod-amd64-windows
             archive: brainpod-amd64-windows.zip
 
@@ -46,10 +46,12 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: cachix/install-nix-action@v31
+        if: matrix.system != 'x86_64-linux'
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Restore and save Nix store
+        if: matrix.system != 'x86_64-linux'
         uses: nix-community/cache-nix-action@v7
         with:
           primary-key: nix-v1-${{ matrix.system }}-${{ matrix.package }}-${{ hashFiles('flake.nix', 'flake.lock', 'Cargo.lock') }}
@@ -72,7 +74,7 @@ jobs:
           mkdir package
           cp -L result/bin/brainpod.exe package/brainpod.exe
           cd package
-          zip "../${{ matrix.archive }}" brainpod.exe
+          nix shell --inputs-from "$GITHUB_WORKSPACE" nixpkgs#zip --command zip "../${{ matrix.archive }}" brainpod.exe
 
       - name: Publish artifact
         uses: actions/upload-artifact@v4
@@ -84,11 +86,13 @@ jobs:
   publish:
     name: Attach binaries to release
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, nix]
     permissions:
       contents: write
 
     steps:
+      - uses: actions/checkout@v4
+
       - name: Download binaries
         uses: actions/download-artifact@v4
         with:
@@ -105,4 +109,4 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
           TAG: ${{ github.event.release.tag_name }}
-        run: gh release upload "$TAG" *.tar.gz *.zip SHA256SUMS --clobber
+        run: nix shell --inputs-from "$GITHUB_WORKSPACE" nixpkgs#gh --command gh release upload "$TAG" *.tar.gz *.zip SHA256SUMS --clobber