chore: update ci, use nix

.github/workflows/ci.yml

@@ -12,20 +12,25 @@ jobs:
     name: Test and lint (host)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo fmt --all -- --check
-      - run: cargo clippy --workspace --all-targets -- -D warnings
-      - run: cargo test --workspace
+      - uses: actions/checkout@v7
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v14
+
+      - name: Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@v8
+
+      - name: Check Nix health
+        run: nix doctor
+
+      - run: nix develop --command cargo fmt --all -- --check
+      - run: nix develop --command cargo clippy --workspace --all-targets -- -D warnings
+      - run: nix develop --command cargo test --workspace
 
   wasm:
     name: wasm32 check (browser bundle crates)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: wasm32-unknown-unknown
@@ -64,8 +69,8 @@ jobs:
     name: Knowledge base consistency
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v27
+      - uses: actions/checkout@v7
+      - uses: cachix/install-nix-action@v31
       # kb.pl is executable knowledge, so it gets checked like code: rules
       # must reject what they should, domains must close, and functional keys
       # must not carry conflicting values. See kb_report/0 in the file.
@@ -90,7 +95,7 @@ jobs:
     name: Browser harness (OPFS contract + shell)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: wasm32-unknown-unknown
@@ -136,7 +141,7 @@ jobs:
         working-directory: harness
         run: npx playwright test
       - if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: playwright-traces
           path: harness/test-results
@@ -163,7 +168,7 @@ jobs:
     name: Browser bundle + static site
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: wasm32-unknown-unknown
@@ -200,7 +205,7 @@ jobs:
       - run: find site -type f | sort
       - run: du -sh site
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
@@ -229,8 +234,8 @@ jobs:
       # (Settings → Pages → Source: GitHub Actions) before this job will
       # produce a live URL. Using `enablement: true` fails when the workflow
       # token lacks admin permission to create the site (improvise-3gy).
-      - uses: actions/configure-pages@v5
+      - uses: actions/configure-pages@v6
         with:
           enablement: false
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5