sdk%feat(nix): add Nix-based devshells (and Docker wrapped counterparts), cross-compilation for Linux, Windows and macOS, x86_64 emulation for CodeQL on arm64 Linux

.github/workflows/build_cross.yml

@@ -0,0 +1,100 @@
+name: Cross-compilation build
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  shell:
+    name: Initialize devshell
+    runs-on: ubuntu-24.04-arm
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          extra-conf: |
+            extra-substituters = https://dashpay-base-sdk.cachix.org
+            extra-trusted-public-keys = dashpay-base-sdk.cachix.org-1:TAoDyYL2e60lUEG8n10gvIZmujM5rJAhaG613fNfOWI=
+
+      - name: Cache Nix
+        uses: cachix/cachix-action@v17
+        with:
+          name: dashpay-base-sdk
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipAddingSubstituter: true
+
+      - name: Initialize devshell
+        run: nix develop ./contrib/nix#dev --command true
+
+      - name: Validate toolchains
+        run: nix develop ./contrib/nix#dev --command ./contrib/nix/smoke_test.sh
+
+  build:
+    name: ${{ matrix.target }}
+    runs-on: ubuntu-24.04-arm
+    needs: shell
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - x86_64-unknown-linux-gnu
+          - x86_64-pc-windows-gnu
+          - aarch64-apple-darwin
+
+    defaults:
+      run:
+        shell: nix develop ./contrib/nix#dev --command bash -eo pipefail {0}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          extra-conf: |
+            extra-substituters = https://dashpay-base-sdk.cachix.org
+            extra-trusted-public-keys = dashpay-base-sdk.cachix.org-1:TAoDyYL2e60lUEG8n10gvIZmujM5rJAhaG613fNfOWI=
+
+      - name: Cache Nix
+        uses: cachix/cachix-action@v17
+        with:
+          name: dashpay-base-sdk
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipAddingSubstituter: true
+
+      - name: Restore cargo registry
+        uses: actions/cache/restore@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: cargo-deps-${{ hashFiles('Cargo.lock', 'docs/samples/Cargo.lock') }}
+          restore-keys: cargo-deps-
+
+      - name: Manage build artifacts
+        uses: actions/cache@v5
+        with:
+          path: target
+          key: cargo-build-cross-${{ matrix.target }}-${{ github.sha }}
+          restore-keys: |
+            cargo-build-cross-${{ matrix.target }}-
+
+      - name: Build workspace
+        run: cargo build --workspace --all-targets --features full --target ${{ matrix.target }}

.github/workflows/build_msrv.yml

@@ -17,6 +17,10 @@ jobs:
     name: Lint
     runs-on: ubuntu-24.04
 
+    defaults:
+      run:
+        shell: nix develop ./contrib/nix#ci --command bash -eo pipefail {0}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -34,42 +38,19 @@ jobs:
             exit 1
           fi
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.85.0
-        with:
-          components: rustfmt
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v5
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
         with:
-          node-version: 24
+          extra-conf: |
+            extra-substituters = https://dashpay-base-sdk.cachix.org
+            extra-trusted-public-keys = dashpay-base-sdk.cachix.org-1:TAoDyYL2e60lUEG8n10gvIZmujM5rJAhaG613fNfOWI=
 
-      - name: Set up Python
-        id: python
-        uses: actions/setup-python@v6
+      - name: Cache Nix
+        uses: cachix/cachix-action@v17
         with:
-          python-version-file: pyproject.toml
-
-      - name: Set up uv
-        uses: astral-sh/setup-uv@v10.0.1
-        with:
-          version: 0.12.9
-          enable-cache: true
-          cache-dependency-glob: uv.lock
-
-      - name: Install Python dependencies
-        run: |
-          uv sync --locked --extra dev --python '${{ steps.python.outputs.python-path }}'
-          echo "${PWD}/.venv/bin" >> "${GITHUB_PATH}"
-
-      - name: Install CodeQL
-        id: setup-codeql
-        uses: github/codeql-action/setup-codeql@v4.37.1
-        with:
-          tools: linked
-
-      - name: Setup CodeQL
-        run: echo "$(dirname '${{ steps.setup-codeql.outputs.codeql-path }}')" >> "$GITHUB_PATH"
+          name: dashpay-base-sdk
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipAddingSubstituter: true
 
       - name: Restore cargo registry
         uses: actions/cache/restore@v5
@@ -80,14 +61,6 @@ jobs:
           key: cargo-deps-${{ hashFiles('Cargo.lock', 'docs/samples/Cargo.lock') }}
           restore-keys: cargo-deps-
 
-      - name: Restore build artifacts
-        uses: actions/cache/restore@v5
-        with:
-          path: target
-          key: cargo-build-msrv-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
-          restore-keys: |
-            cargo-build-msrv-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Manage CodeQL packs
         uses: actions/cache@v5
         with:
@@ -98,13 +71,9 @@ jobs:
         run: |
           python3 maint/lint_all.py --exclude lint_codeql
           python3 maint/lint/lint_codeql.py check
-        env:
-          RUSTUP_TOOLCHAIN: 1.85.0
 
       - name: Run CodeQL
         run: python3 maint/lint/lint_codeql.py run --lang=rust --with-suite=rust-security-and-quality
-        env:
-          RUSTUP_TOOLCHAIN: 1.85.0
 
       - name: Check PR commit messages
         if: github.event_name == 'pull_request'
@@ -116,6 +85,10 @@ jobs:
     name: Build and test
     runs-on: ubuntu-24.04-arm
 
+    defaults:
+      run:
+        shell: nix develop ./contrib/nix#ci --command bash -eo pipefail {0}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -133,8 +106,19 @@ jobs:
             exit 1
           fi
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.85.0
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          extra-conf: |
+            extra-substituters = https://dashpay-base-sdk.cachix.org
+            extra-trusted-public-keys = dashpay-base-sdk.cachix.org-1:TAoDyYL2e60lUEG8n10gvIZmujM5rJAhaG613fNfOWI=
+
+      - name: Cache Nix
+        uses: cachix/cachix-action@v17
+        with:
+          name: dashpay-base-sdk
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipAddingSubstituter: true
 
       - name: Restore cargo registry
         uses: actions/cache/restore@v5
@@ -155,14 +139,14 @@ jobs:
 
       - name: Build workspace
         run: |
-          cargo build --workspace --exclude dash-pow --features full
-          cargo build -p dash-pow --features std,aes_hw
-        env:
-          RUSTUP_TOOLCHAIN: 1.85.0
+          export RUSTC="$TOOLCHAIN_MSRV/bin/rustc"
+          export RUSTDOC="$TOOLCHAIN_MSRV/bin/rustdoc"
+          "$TOOLCHAIN_MSRV/bin/cargo" build --workspace --exclude dash-pow --features full
+          "$TOOLCHAIN_MSRV/bin/cargo" build -p dash-pow --features std,aes_hw
 
       - name: Test workspace
         run: |
-          cargo test --workspace --exclude dash-pow --features full
-          cargo test -p dash-pow --features std,aes_hw
-        env:
-          RUSTUP_TOOLCHAIN: 1.85.0
+          export RUSTC="$TOOLCHAIN_MSRV/bin/rustc"
+          export RUSTDOC="$TOOLCHAIN_MSRV/bin/rustdoc"
+          "$TOOLCHAIN_MSRV/bin/cargo" test --workspace --exclude dash-pow --features full
+          "$TOOLCHAIN_MSRV/bin/cargo" test -p dash-pow --features std,aes_hw

.github/workflows/build_nightly.yml

@@ -12,6 +12,8 @@ on:
         required: true
         type: string
     secrets:
+      CACHIX_AUTH_TOKEN:
+        required: false
       CODECOV_TOKEN:
         required: false
 
@@ -32,6 +34,10 @@ jobs:
           - { name: min, args: "--no-default-features" }
           - { name: std, args: "--features std" }
 
+    defaults:
+      run:
+        shell: nix develop ./contrib/nix#ci --command bash -eo pipefail {0}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -49,11 +55,19 @@ jobs:
             exit 1
           fi
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          extra-conf: |
+            extra-substituters = https://dashpay-base-sdk.cachix.org
+            extra-trusted-public-keys = dashpay-base-sdk.cachix.org-1:TAoDyYL2e60lUEG8n10gvIZmujM5rJAhaG613fNfOWI=
+
+      - name: Cache Nix
+        uses: cachix/cachix-action@v17
         with:
-          toolchain: nightly-2026-02-01
-          components: clippy, llvm-tools, rustfmt
+          name: dashpay-base-sdk
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipAddingSubstituter: true
 
       - name: Manage cargo registry
         uses: actions/cache@v5
@@ -82,13 +96,9 @@ jobs:
         if: matrix.config.name != 'full'
         run: cargo test -p ${{ inputs.package }} ${{ matrix.config.args }}
 
-      - name: Install cargo-llvm-cov
-        if: matrix.config.name == 'full'
-        uses: taiki-e/install-action@cargo-llvm-cov
-
       - name: Check formatting
         if: matrix.config.name == 'full'
-        run: python maint/lint/lint_rust.py
+        run: python3 maint/lint/lint_rust.py
 
       - name: Test package (with coverage)
         if: matrix.config.name == 'full'

.github/workflows/pages.yml

@@ -10,8 +10,10 @@ on:
       - .github/workflows/pages.yml
       - pyproject.toml
       - uv.lock
+      - contrib/nix/**
+      - rust-toolchain.toml
       - README.md
-      - '**/README.md'
+      - "**/README.md"
   workflow_dispatch:
 
 concurrency:
@@ -26,39 +28,30 @@ jobs:
     name: Build site
     runs-on: ubuntu-24.04-arm
 
+    defaults:
+      run:
+        shell: nix develop ./contrib/nix#ci --command bash -eo pipefail {0}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
         with:
-          toolchain: nightly-2026-02-01
-          targets: wasm32-unknown-unknown
-
-      - name: Install wasm-pack
-        run: cargo install wasm-pack@0.15.0
+          extra-conf: |
+            extra-substituters = https://dashpay-base-sdk.cachix.org
+            extra-trusted-public-keys = dashpay-base-sdk.cachix.org-1:TAoDyYL2e60lUEG8n10gvIZmujM5rJAhaG613fNfOWI=
 
-      - name: Set up Python
-        id: python
-        uses: actions/setup-python@v6
+      - name: Cache Nix
+        uses: cachix/cachix-action@v17
         with:
-          python-version-file: pyproject.toml
-
-      - name: Set up uv
-        uses: astral-sh/setup-uv@v10.0.1
-        with:
-          version: 0.12.9
-          enable-cache: true
-          cache-dependency-glob: uv.lock
-
-      - name: Install Python dependencies
-        run: |
-          uv sync --locked --extra dev --python '${{ steps.python.outputs.python-path }}'
-          echo "${PWD}/.venv/bin" >> "${GITHUB_PATH}"
+          name: dashpay-base-sdk
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipAddingSubstituter: true
 
       - name: Test documentation tooling
         run: pytest
@@ -73,7 +66,7 @@ jobs:
           restore-keys: cargo-deps-
 
       - name: Build documentation
-        run: python docs/build_docs.py build
+        run: python3 docs/build_docs.py build
 
       - name: Upload Pages artifact
         uses: actions/upload-pages-artifact@v5

.github/workflows/pkg_num.yml

@@ -10,6 +10,10 @@ on:
       - .github/workflows/pkg_num.yml
       - .github/workflows/build_stable.yml
       - .github/workflows/build_nightly.yml
+      - contrib/nix/**
+      - pyproject.toml
+      - rust-toolchain.toml
+      - uv.lock
   pull_request:
     paths: *paths