Fix devshell for develop

.envrc

@@ -1,5 +1 @@
-#!/usr/bin/env bash
-
-export GIT_LFS_SKIP_SMUDGE=1
-./pin.sh
-use flake o1js#default
+use flake . --refresh --no-eval-cache

.github/actions/build/action.yml

@@ -9,17 +9,57 @@ inputs:
     description: 'proof_systems commit to use'
     required: false
     default: ''
+  cache_id:
+    description: 'AWS access key ID for nix cache'
+    required: false
+    default: ''
+  nar_secret:
+    description: 'NAR signing secret key'
+    required: false
+    default: ''
+  gcp_secret:
+    description: 'GCP secret access key'
+    required: false
+    default: ''
 
 runs:
   using: "composite"
   steps:
-    - uses: nixbuild/nix-quick-install-action@v30
+    - name: Create post-build hook for continuous cache upload
+      shell: bash
+      run: |
+        # Create script with embedded credentials (no echoing)
+        cat > /tmp/upload-to-cache.sh << EOF
+        #!/bin/bash
+        set -eu
+        echo "=== Post-build hook triggered ==="
+        if [ -n "\${OUT_PATHS:-}" ] && [ -n "${{ inputs.cache_id }}" ] && [ -n "${{ inputs.nar_secret }}" ]; then
+          echo "Signing and uploading \$(echo \$OUT_PATHS | wc -w) derivations"
+          export AWS_ACCESS_KEY_ID="${{ inputs.cache_id }}"
+          export AWS_SECRET_ACCESS_KEY="${{ inputs.gcp_secret }}"
+          # Create temporary key file
+          temp_key=\$(mktemp)
+          echo "${{ inputs.nar_secret }}" > "\$temp_key"
+          # Sign the outputs
+          nix store sign --key-file "\$temp_key" --recursive \$OUT_PATHS 2>/dev/null || true
+          # Upload to cache
+          nix copy --to "s3://mina-nix-cache?endpoint=https://storage.googleapis.com" \$OUT_PATHS 2>/dev/null || true
+          # Clean up
+          rm "\$temp_key"
+          echo "Upload completed"
+        else
+          echo "Skipping upload - missing credentials or no outputs"
+        fi
+        EOF
+        chmod +x /tmp/upload-to-cache.sh
+    - uses: nixbuild/nix-quick-install-action@v32
       continue-on-error: true
       with:
         nix_conf: |
           keep-env-derivations = true
           keep-outputs = true
           require-sigs = false
+          post-build-hook = /tmp/upload-to-cache.sh
     - name: Disable smudging
       shell: bash
       run: echo "GIT_LFS_SKIP_SMUDGE=1" >> $GITHUB_ENV
@@ -51,8 +91,7 @@ runs:
       shell: bash
       run: |
         set -Eeu
-        ./pin.sh
-        nix run o1js#generate-bindings --max-jobs auto
+        nix run .#generate-bindings --max-jobs auto
     - name: Cache dependencies and build
       uses: actions/cache@v4
       id: cache
@@ -81,4 +120,3 @@ runs:
       with:
         path: .
         key: repo-${{ github.sha }}
-

.github/workflows/checks.yml

@@ -50,6 +50,82 @@ jobs:
           repository: ${{ inputs.target_repo || github.repository }}
           ref: ${{ inputs.target_ref || github.ref }}
           proof_systems_commit: ${{ inputs.proof_systems_commit }}
+          cache_id: ${{ secrets.NIX_CACHE_GCP_ID }}
+          nar_secret: ${{ secrets.NIX_CACHE_NAR_SECRET }}
+          gcp_secret: ${{ secrets.NIX_CACHE_GCP_SECRET }}
+
+  # TODO move to nightly maybe? it's a lot of builds to run
+  BuildMatrix:
+    strategy:
+      fail-fast: false
+      matrix:
+        method: ["default"] # ,"devshell"
+        #TODO enable devshell
+        #Currently disabled because the free runners don't have enough disk space
+        system: [ "ubuntu-latest"] # TODO macos here
+        nix_version: ["2.29.1","2.28.4"] # We require nix 2.28+
+    runs-on: ${{ matrix.system }}
+    steps:
+      - name: Checkout repository with submodules
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          repository: ${{ inputs.target_repo || github.repository }}
+          ref: ${{ inputs.target_ref || github.ref }}
+      - name: Disable smudging
+        run: echo "GIT_LFS_SKIP_SMUDGE=1" >> $GITHUB_ENV
+      - name: Create post-build hook for continuous cache upload
+        run: |
+          # Create script with embedded credentials (no echoing)
+          cat > /tmp/upload-to-cache.sh << EOF
+          #!/bin/bash
+          set -eu
+          echo "=== Post-build hook triggered ==="
+          if [ -n "\${OUT_PATHS:-}" ] && [ -n "${{ secrets.NIX_CACHE_GCP_ID }}" ] && [ -n "${{ secrets.NIX_CACHE_NAR_SECRET }}" ]; then
+            echo "Signing and uploading \$(echo \$OUT_PATHS | wc -w) derivations"
+            export AWS_ACCESS_KEY_ID="${{ secrets.NIX_CACHE_GCP_ID }}"
+            export AWS_SECRET_ACCESS_KEY="${{ secrets.NIX_CACHE_GCP_SECRET }}"
+            # Create temporary key file
+            temp_key=\$(mktemp)
+            echo "${{ secrets.NIX_CACHE_NAR_SECRET }}" > "\$temp_key"
+            # Sign the outputs
+            nix store sign --key-file "\$temp_key" --recursive \$OUT_PATHS 2>/dev/null || true
+            # Upload to cache
+            nix copy --to "s3://mina-nix-cache?endpoint=https://storage.googleapis.com" \$OUT_PATHS 2>/dev/null || true
+            # Clean up
+            rm "\$temp_key"
+            echo "Upload completed"
+          else
+            echo "Skipping upload - missing credentials or no outputs"
+          fi
+          EOF
+          chmod +x /tmp/upload-to-cache.sh
+      - name: Install nix
+        uses: nixbuild/nix-quick-install-action@v32
+        with:
+          nix_version: ${{ matrix.nix_version }}
+          nix_conf: |
+            keep-env-derivations = true
+            keep-outputs = true
+            require-sigs = false
+            post-build-hook = /tmp/upload-to-cache.sh
+      - name: Build the o1js bindings (default)
+        if: ${{ matrix.method == 'default' }}
+        run: |
+          set -Eeu
+          nix run .#generate-bindings --max-jobs auto
+      - name: Build the o1js bindings (devshell)
+        if: ${{ matrix.method == 'devshell' }}
+        run: |
+          set -Eeu
+          nix develop . --command npm run build:update-bindings
+      - name: Build o1js
+        run: |
+          nix develop --command npm ci
+          nix develop --command npm run build
+      - name: Run some tests
+        run: |
+          nix develop --command npm run test
 
   Lint-Format-and-TypoCheck:
     strategy:
@@ -109,23 +185,6 @@ jobs:
           check_hidden: false
           ignore_words_list: "tHi,modul,optin,deriver,PRing,toWords,iSelf"
 
-  Upload-bindings:
-    name: upload bindings artifact
-    if: ${{ inputs.proof_systems_commit == '' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          repository: ${{ inputs.target_repo || github.repository }}
-          ref: ${{ inputs.target_ref || github.ref }}
-      - name: upload
-        uses: ./.github/actions/upload
-        with:
-          cache_id: ${{ secrets.NIX_CACHE_GCP_ID }}
-          nar_secret: ${{ secrets.NIX_CACHE_NAR_SECRET }}
-          gcp_secret: ${{ secrets.NIX_CACHE_GCP_SECRET }}
-
   Build-And-Test-Server:
     needs: [Prepare]
     timeout-minutes: 210
@@ -158,6 +217,9 @@ jobs:
           repository: ${{ inputs.target_repo || github.repository }}
           ref: ${{ inputs.target_ref || github.ref }}
           proof_systems_commit: ${{ inputs.proof_systems_commit }}
+          cache_id: ${{ secrets.NIX_CACHE_GCP_ID }}
+          nar_secret: ${{ secrets.NIX_CACHE_NAR_SECRET }}
+          gcp_secret: ${{ secrets.NIX_CACHE_GCP_SECRET }}
       - name: Prepare for tests
         run: touch profiling.md
       - name: Execute tests
@@ -192,6 +254,9 @@ jobs:
           repository: ${{ inputs.target_repo || github.repository }}
           ref: ${{ inputs.target_ref || github.ref }}
           proof_systems_commit: ${{ inputs.proof_systems_commit }}
+          cache_id: ${{ secrets.NIX_CACHE_GCP_ID }}
+          nar_secret: ${{ secrets.NIX_CACHE_NAR_SECRET }}
+          gcp_secret: ${{ secrets.NIX_CACHE_GCP_SECRET }}
       - name: Count tests
         id: count_tests
         run: |
@@ -306,7 +371,7 @@ jobs:
     needs: [Prepare]
     timeout-minutes: 45
     runs-on: ubuntu-latest
-    if: github.event.pull_request.base.ref != 'develop' 
+    if: github.event.pull_request.base.ref != 'develop'
     services:
       mina-local-network:
         image: o1labs/mina-local-network:master-latest-lightnet
@@ -333,6 +398,9 @@ jobs:
           repository: ${{ inputs.target_repo || github.repository }}
           ref: ${{ inputs.target_ref || github.ref }}
           proof_systems_commit: ${{ inputs.proof_systems_commit }}
+          cache_id: ${{ secrets.NIX_CACHE_GCP_ID }}
+          nar_secret: ${{ secrets.NIX_CACHE_NAR_SECRET }}
+          gcp_secret: ${{ secrets.NIX_CACHE_GCP_SECRET }}
       - name: Use shared steps for live testing jobs
         uses: ./.github/actions/live-tests-shared
         with:
@@ -342,7 +410,7 @@ jobs:
     needs: [Prepare]
     timeout-minutes: 45
     runs-on: ubuntu-latest
-    if: github.event.pull_request.base.ref != 'develop' 
+    if: github.event.pull_request.base.ref != 'develop'
     services:
       mina-local-network:
         image: o1labs/mina-local-network:compatible-latest-lightnet
@@ -369,6 +437,9 @@ jobs:
           repository: ${{ inputs.target_repo || github.repository }}
           ref: ${{ inputs.target_ref || github.ref }}
           proof_systems_commit: ${{ inputs.proof_systems_commit }}
+          cache_id: ${{ secrets.NIX_CACHE_GCP_ID }}
+          nar_secret: ${{ secrets.NIX_CACHE_NAR_SECRET }}
+          gcp_secret: ${{ secrets.NIX_CACHE_GCP_SECRET }}
       - name: Use shared steps for live testing jobs
         uses: ./.github/actions/live-tests-shared
         with:
@@ -405,7 +476,10 @@ jobs:
           repository: ${{ inputs.target_repo || github.repository }}
           ref: ${{ inputs.target_ref || github.ref }}
           proof_systems_commit: ${{ inputs.proof_systems_commit }}
+          cache_id: ${{ secrets.NIX_CACHE_GCP_ID }}
+          nar_secret: ${{ secrets.NIX_CACHE_NAR_SECRET }}
+          gcp_secret: ${{ secrets.NIX_CACHE_GCP_SECRET }}
       - name: Use shared steps for live testing jobs
         uses: ./.github/actions/live-tests-shared
         with:
-          mina-branch-name: develop
+          mina-branch-name: develop

.github/workflows/pull_requests.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: nixbuild/nix-quick-install-action@v30
+      - uses: nixbuild/nix-quick-install-action@v32
         continue-on-error: true
         with:
           nix_conf: |
@@ -32,8 +32,7 @@ jobs:
       - name: fix npmDepsHash
         run: |
           set -Eeu
-          ./pin.sh
-          nix run o1js#update-npm-deps
+          nix run .#update-npm-deps
       # if the npmDepsHash is out of date auto commit the new one
       - uses: stefanzweifel/git-auto-commit-action@v5
         with:

.github/workflows/remote_bindings.yml

@@ -12,7 +12,7 @@ jobs:
         with:
           submodules: recursive
       - name: upload
-        uses: ./.github/actions/upload
+        uses: ./.github/actions/build
         with:
           cache_id: ${{ secrets.NIX_CACHE_ID }}
           nar_secret: ${{ secrets.NIX_CACHE_NAR_SECRET }}

README-dev.md

@@ -79,11 +79,9 @@ build the bindings for your commit and download them once it finishes.
 
 ## Building with nix
 
-Much like the mina repo, we use the nix registry to conveniently handle git
-submodules. You can enter the devshell with `./pin.sh` and
-`nix develop o1js#default` or by using direnv with the `.envrc` provided. This
-devshell provides all the dependencies required for npm scripts including
-`npm run build:update-bindings`.
+You can build with nix in two ways: Using a flake app
+`nix run .#generate-bindings` or using a devshell `nix develop`, and inside that
+devshell `npm run build:update-bindings`.
 
 ## Building Bindings