refactor: flake-parts

.github/dependabot.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2025 Ryan Cao <hello@ryanccn.dev>
+#
+# SPDX-License-Identifier: Apache-2.0
+
 version: 2
 
 updates:

.github/workflows/build.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2025 Ryan Cao <hello@ryanccn.dev>
+#
+# SPDX-License-Identifier: Apache-2.0
+
 name: Build
 
 on:
@@ -6,24 +10,30 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
       matrix:
         label:
-          - Ryans-MacBook-Pro
+          - caladan
         include:
-          - label: Ryans-MacBook-Pro
-            path: darwinConfigurations.Ryans-MacBook-Pro.config.system.build.toplevel
+          - label: caladan
+            attr: darwinConfigurations.caladan.config.system.build.toplevel
             runner: macos-14
 
     runs-on: ${{ matrix.runner }}
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v15
+        uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # ratchet:cachix/install-nix-action@v31
 
       - name: Build
-        run: nix build -L --show-trace .#${{ matrix.path }}
+        run: nix build -L --show-trace .#${{ matrix.attr }}

.github/workflows/check-inputs.yml

@@ -1,21 +0,0 @@
-name: "Check flake inputs"
-
-on:
-  push:
-    branches: ["main"]
-  pull_request:
-    branches: ["main"]
-
-jobs:
-  check-inputs:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v15
-
-      - name: Check Nix flake Nixpkgs inputs
-        uses: DeterminateSystems/flake-checker-action@v9
-        with:
-          send-statistics: false

.github/workflows/check.yml

@@ -0,0 +1,45 @@
+# SPDX-FileCopyrightText: 2025 Ryan Cao <hello@ryanccn.dev>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Check
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+jobs:
+  nixfmt:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # ratchet:cachix/install-nix-action@v31
+
+      - name: Check
+        run: nix build --print-build-logs '.#checks.x86_64-linux.nixfmt'
+
+  reuse:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # ratchet:cachix/install-nix-action@v31
+
+      - name: Check
+        run: nix build --print-build-logs '.#checks.x86_64-linux.reuse'