Update Nix to 2.24.5, run release checks in release branch CI (#1136)

* ci: larger runners in more places, run the release checks

* Update Nix to 2.24.5

Flake lock file updates:

• Updated input 'nix':
    'https://api.flakehub.com/f/pinned/DeterminateSystems/nix/2.23.3/019097ec-5f84-7a24-9af5-79a2dfa6fe73/source.tar.gz?narHash=sha256-l8Q5/8DwzkW2FgT9Iicxtzxj/MMNE2YlTKWlCV5ybko%3D' (2024-07-09)
  → 'https://api.flakehub.com/f/pinned/DeterminateSystems/nix/2.24.5/0191b8c2-4026-72e8-90b6-e563d642256c/source.tar.gz?narHash=sha256-riLswssknfVx9FOj54JOCYJznSiNuuQoa/H2UvJQrJc%3D' (2024-09-03)
• Updated input 'nix/nix':
    'https://api.flakehub.com/f/pinned/NixOS/nix/2.23.3/0190936a-a531-7743-88ed-025ecd4d0835/source.tar.gz?narHash=sha256-lAoLGVIhRFrfgv7wcyduEkyc83QKrtsfsq4of%2BWrBeg%3D' (2024-07-05)
  → 'https://api.flakehub.com/f/pinned/NixOS/nix/2.24.5/0191b85d-f080-7376-9389-09ec6fee7649/source.tar.gz?narHash=sha256-mYvdPwl4gcc17UAomkbbOJEgxBQpowmJDrRMWtlYzFY%3D' (2024-09-03)
• Added input 'nix/nix/git-hooks-nix':
    'github:cachix/git-hooks.nix/4509ca64f1084e73bc7a721b20c669a8d4c5ebe6?narHash=sha256-Qyl9Q4QMTLZnnBb/8OuQ9LSkzWjBU1T5l5zIzTxkkhk%3D' (2024-08-28)
• Added input 'nix/nix/git-hooks-nix/flake-compat':
    follows 'nix/nix'
• Added input 'nix/nix/git-hooks-nix/gitignore':
    follows 'nix/nix'
• Added input 'nix/nix/git-hooks-nix/nixpkgs':
    follows 'nix/nix/nixpkgs'
• Added input 'nix/nix/git-hooks-nix/nixpkgs-stable':
    follows 'nix/nix/nixpkgs'
• Updated input 'nix/nix/libgit2':
    'github:libgit2/libgit2/45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5?narHash=sha256-oX4Z3S9WtJlwvj0uH9HlYcWv%2Bx1hqp8mhXl7HsLu2f0%3D' (2023-10-18)
  → 'github:libgit2/libgit2/36f7e21ad757a3dacc58cf7944329da6bc1d6e96?narHash=sha256-J2rCxTecyLbbDdsyBWn9w7r3pbKRMkI9E7RvRgAqBdY%3D' (2024-05-16)
• Updated input 'nix/nix/nixpkgs':
    'github:NixOS/nixpkgs/b550fe4b4776908ac2a861124307045f8e717c8e?narHash=sha256-7kkJQd4rZ%2BvFrzWu8sTRtta5D1kBG0LSRYAfhtmMlSo%3D' (2024-02-28)
  → 'github:NixOS/nixpkgs/6e99f2a27d600612004fbd2c3282d614bfee6421?narHash=sha256-eV%2B63gK0Mp7ygCR0Oy4yIYSNcum2VQwnZamHxYTNi%2BM%3D' (2024-08-30)
• Added input 'nix/nix/nixpkgs-23-11':
    'github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446?narHash=sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw%3D' (2024-05-31)
• Removed input 'nix/nix/pre-commit-hooks'
• Removed input 'nix/nix/pre-commit-hooks/flake-compat'
• Removed input 'nix/nix/pre-commit-hooks/flake-utils'
• Removed input 'nix/nix/pre-commit-hooks/gitignore'
• Removed input 'nix/nix/pre-commit-hooks/nixpkgs'
• Removed input 'nix/nix/pre-commit-hooks/nixpkgs-stable'

* ci: only run release checks on release- PRs

---------

Co-authored-by: Graham Christensen <[email protected]>

.github/workflows/build-aarch64-linux.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   build-aarch64-linux:
     name: Build aarch64 Linux (static)
-    runs-on: namespace-profile-default-arm64
+    runs-on: UbuntuLatest32Cores128GArm
     concurrency: ${{ inputs.cache-key }}
     permissions:
       id-token: "write"

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  workflow_dispatch:
   pull_request:
   push:
     branches: [main]
@@ -24,7 +25,7 @@ jobs:
 
   lints:
     name: Lints
-    runs-on: ubuntu-latest
+    runs-on: UbuntuLatest32Cores128G
     permissions:
       id-token: "write"
       contents: "read"
@@ -57,7 +58,7 @@ jobs:
 
   run-x86_64-linux:
     name: Run x86_64 Linux
-    runs-on: ubuntu-latest
+    runs-on: UbuntuLatest32Cores128G
     needs: [lints, build-x86_64-linux]
     strategy:
       matrix:
@@ -170,7 +171,7 @@ jobs:
 
   run-x86_64-linux-no-init:
     name: Run x86_64 Linux (No init)
-    runs-on: ubuntu-latest
+    runs-on: UbuntuLatest32Cores128G
     needs: [lints, build-x86_64-linux]
     strategy:
       matrix:
@@ -575,3 +576,43 @@ jobs:
           NIX_INSTALLER_LOGGER: pretty
           NIX_INSTALLER_LOG_DIRECTIVES: nix_installer=debug
           RUST_BACKTRACE: full
+
+  run-x86_64-linux-release-checks:
+    name: Run x86_64 Linux release checks
+    runs-on: UbuntuLatest64Cores256GX86
+    needs: [lints, build-x86_64-linux]
+    if: contains(github.ref, 'release-')
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: actions/checkout@v3
+      - name: Restore Github cache artifacts
+        uses: actions/cache/restore@v3
+        with:
+          path: nix-installer
+          key: x86_64-linux-artifacts-${{ github.sha }}
+      - name: Move & set executable
+        run: |
+          mkdir install-root
+          cp nix-installer.sh install-root/nix-installer.sh
+          mv ./nix-installer install-root/nix-installer-x86_64-linux
+          chmod +x install-root/nix-installer-x86_64-linux install-root/nix-installer.sh
+      - name: Initial install
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          flakehub: true
+          local-root: install-root/
+          logger: pretty
+          log-directives: nix_installer=debug
+          backtrace: full
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-gha-cache: false
+
+      - run: nix flake check -L
+      - run: |
+          nix build \
+            -L --tarball-ttl 0 --keep-going \
+            .#hydraJobs.container-test.all.x86_64-linux.all \
+            .#hydraJobs.vm-test.all.x86_64-linux.all

flake.nix

@@ -15,7 +15,7 @@
     };
 
     nix = {
-      url = "https://flakehub.com/f/DeterminateSystems/nix/=2.23.3.tar.gz";
+      url = "https://flakehub.com/f/DeterminateSystems/nix/=2.24.5.tar.gz";
       # Omitting `inputs.nixpkgs.follows = "nixpkgs";` on purpose
     };