From 46836247043e2bc8e191265df199cab4b3f0681c Mon Sep 17 00:00:00 2001
From: Joshua Gilman <joshuagilman@gmail.com>
Date: Thu, 20 Aug 2026 14:44:51 -0700
Subject: [PATCH] feat(nix): add release-cli flake

---
 .github/workflows/ci.yml | 17 ++++++++
 flake.lock               | 27 ++++++++++++
 flake.nix                | 89 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 133 insertions(+)
 create mode 100644 flake.lock
 create mode 100644 flake.nix

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0594d33..e492b80 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,3 +19,20 @@ jobs:
     permissions:
       contents: read
     uses: ./.github/workflows/go-ci.yml
+
+  nix:
+    name: Nix flake
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@668647a33843b1f280cb2ef4c41736f86b29f826 # v3.22.1
+      - name: Check flake
+        run: |
+          nix flake check --all-systems --no-build
+          nix flake check
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..b55343b
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1787101114,
+        "narHash": "sha256-gwrPcFf/rDjHPaVflbDZ040ZDmBTRj/7+s8ZmE2SaIM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b18a4b905f8d028dc4476412e6d6891728695379",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..df388ca
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,89 @@
+{
+  description = "Meigma release-cli";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+
+  outputs =
+    { self, nixpkgs, ... }:
+    let
+      systems = [
+        "aarch64-darwin"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "x86_64-linux"
+      ];
+      forAllSystems = nixpkgs.lib.genAttrs systems;
+      version = (builtins.fromJSON (builtins.readFile ./.release-please-manifest.json)).".";
+      commit =
+        if self ? rev then
+          self.rev
+        else if self ? dirtyRev then
+          self.dirtyRev
+        else
+          "unknown";
+      packageFor =
+        system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+          go = pkgs.go_1_26.overrideAttrs {
+            version = "1.26.6";
+            src = pkgs.fetchurl {
+              url = "https://go.dev/dl/go1.26.6.src.tar.gz";
+              hash = "sha256-oHIcVMaIkBRI13rZs+x+p8R0cwdV/4kTgukuy5P/LLE=";
+            };
+          };
+          buildGoModule = pkgs.buildGoModule.override { inherit go; };
+        in
+        buildGoModule {
+          pname = "release-cli";
+          inherit version;
+          src = self;
+          vendorHash = "sha256-88+kLHZjuqsejfXj9RHTIbpCoBIa7i+6GhyMeWbVc2M=";
+          subPackages = [ "cmd/release-cli" ];
+          env.CGO_ENABLED = "0";
+          ldflags = [
+            "-s"
+            "-w"
+            "-X=main.version=${version}"
+            "-X=main.commit=${commit}"
+          ];
+          meta = {
+            description = "Validate and publish Meigma release artifacts";
+            homepage = "https://github.com/meigma/release";
+            mainProgram = "release-cli";
+            platforms = systems;
+          };
+        };
+    in
+    {
+      packages = forAllSystems (
+        system:
+        let
+          package = packageFor system;
+        in
+        {
+          release-cli = package;
+          default = package;
+        }
+      );
+
+      apps = forAllSystems (
+        system:
+        let
+          app = {
+            type = "app";
+            program = "${self.packages.${system}.release-cli}/bin/release-cli";
+            meta.description = "Run release-cli";
+          };
+        in
+        {
+          release-cli = app;
+          default = app;
+        }
+      );
+
+      checks = forAllSystems (system: {
+        release-cli = self.packages.${system}.release-cli;
+      });
+    };
+}