chore: misc cleanups for flake and ci (#12)

.github/workflows/release.yml

@@ -4,12 +4,13 @@ on:
   release:
     types: [published, edited]
 
-permissions:
-  contents: write
-
 jobs:
   release:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/test.yml

@@ -38,4 +38,4 @@ jobs:
           token: ${{ secrets.ATTIC_TOKEN }}
 
       - name: Build Nix Package
-        run: nix build --impure --show-trace -L .#test
+        run: nix-build test.nix

flake.nix

@@ -6,36 +6,25 @@
   };
 
   outputs = {nixpkgs, ...}: let
-    mkSystems = sys: builtins.map (arch: "${arch}-${sys}") ["x86_64" "aarch64"];
-    systems =
-      mkSystems "linux"
-      ++ mkSystems "darwin";
+    systems = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
 
-    forAllSystems = nixpkgs.lib.genAttrs systems;
-    nixpkgsFor = forAllSystems (system: import nixpkgs {inherit system;});
-
-    forEachSystem = fn:
-      forAllSystems (s: fn nixpkgsFor.${s});
+    forAllSystems = fn: nixpkgs.lib.genAttrs systems (system: fn nixpkgs.legacyPackages.${system});
   in {
-    devShells = forEachSystem (pkgs: {
+    devShells = forAllSystems (pkgs: {
       default = pkgs.mkShell {
         packages = with pkgs; [
           actionlint
-          nodePackages.pnpm
+          nodejs_20
+          (nodePackages_latest.pnpm.override {nodejs = nodejs_20;})
         ];
       };
     });
 
-    formatter = forEachSystem (p: p.alejandra);
-
-    packages = forEachSystem (p: let
-      time = toString builtins.currentTime;
-      test = p.runCommand "test-${time}" {} ''
-        echo ${time} > $out
-      '';
-    in {
-      inherit test;
-      default = test;
-    });
+    formatter = forAllSystems (p: p.alejandra);
   };
 }

test.nix

@@ -0,0 +1,14 @@
+let
+  lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+  pkgs = import (
+    fetchTarball {
+      url =
+        lock.nodes.nixpkgs.locked.url
+        or "https://github.com/NixOS/nixpkgs/archive/${lock.nodes.nixpkgs.locked.rev}.tar.gz";
+      sha256 = lock.nodes.nixpkgs.locked.narHash;
+    }
+  ) {};
+in
+  pkgs.runCommand "non-reproducible-test" {} ''
+    echo ${toString builtins.currentTime} > $out
+  ''