From 697b7a4b804e72e8fc7488322af4f7c599488594 Mon Sep 17 00:00:00 2001
From: t8y2 <1156263951@qq.com>
Date: Wed, 22 Jul 2026 17:20:16 +0800
Subject: [PATCH] fix(ci): defer full Nix build until release

---
 .github/workflows/ci.yml                   | 10 +++-------
 .github/workflows/release.yml              | 14 +++++++++++++-
 .github/workflows/update-nix-pnpm-hash.yml |  6 +++---
 flake.nix                                  |  6 +++++-
 4 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3755b62f9c..6643a72b24 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -286,8 +286,8 @@ jobs:
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
 
-      - name: Build Nix package
-        run: nix build .#dbx-desktop --no-link --print-build-logs
+      - name: Validate pnpm dependency hash
+        run: nix build .#dbx-pnpm-deps --no-link --print-build-logs
 
   changes:
     runs-on: ubuntu-22.04
@@ -340,17 +340,13 @@ jobs:
             agents:
               - 'agents/**'
             nix:
-              # The fixed-output pnpm hash must change whenever the workspace dependency graph changes.
+              # This fast check validates only the fixed-output pnpm dependency closure.
               - 'package.json'
               - 'packages/**/package.json'
               - 'pnpm-lock.yaml'
               - 'pnpm-workspace.yaml'
               - 'flake.nix'
               - 'flake.lock'
-              - 'Cargo.toml'
-              - 'Cargo.lock'
-              - 'crates/**/Cargo.toml'
-              - 'src-tauri/Cargo.toml'
               - '.github/workflows/ci.yml'
               - '.github/workflows/update-nix-pnpm-hash.yml'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b0a23ed1ce..1462c5e09e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,17 @@ env:
   CNB_REGISTRY: "docker.cnb.cool"
 
 jobs:
+  nix-packaging:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+
+      - name: Build Nix desktop package
+        run: nix build .#dbx-desktop --no-link --print-build-logs
+
   bump-jdbc-plugin-version:
     runs-on: ubuntu-latest
     outputs:
@@ -381,7 +392,8 @@ jobs:
             --clobber
 
   publish:
-    needs: [cleanup-release-signatures, docker-manifest, jdbc-plugin]
+    # Keep the release as a draft until every platform and the Nix package pass.
+    needs: [cleanup-release-signatures, docker-manifest, jdbc-plugin, nix-packaging]
     runs-on: ubuntu-latest
     steps:
       - name: Publish draft release
diff --git a/.github/workflows/update-nix-pnpm-hash.yml b/.github/workflows/update-nix-pnpm-hash.yml
index 35e9a248d9..3e2a9d0a75 100644
--- a/.github/workflows/update-nix-pnpm-hash.yml
+++ b/.github/workflows/update-nix-pnpm-hash.yml
@@ -35,8 +35,8 @@ jobs:
           set -euo pipefail
 
           build_log=$(mktemp)
-          if nix build .#dbx-desktop --no-link --print-build-logs >"$build_log" 2>&1; then
-            echo "Nix package already has the correct pnpm hash."
+          if nix build .#dbx-pnpm-deps --no-link --print-build-logs >"$build_log" 2>&1; then
+            echo "Nix pnpm dependencies already have the correct hash."
             exit 0
           fi
 
@@ -50,7 +50,7 @@ jobs:
           EXPECTED_HASH="$expected_hash" perl -0pi -e \
             's/(hash = ")sha256-[^"]+(")/$1 . $ENV{EXPECTED_HASH} . $2/e' flake.nix
 
-          nix build .#dbx-desktop --no-link --print-build-logs
+          nix build .#dbx-pnpm-deps --no-link --print-build-logs
 
           if git diff --quiet -- flake.nix; then
             echo "The Nix build passed without changing flake.nix."
diff --git a/flake.nix b/flake.nix
index 7222a04a4f..e614b0bf22 100644
--- a/flake.nix
+++ b/flake.nix
@@ -150,6 +150,10 @@
         # Convenience alias
         packages.default = self.packages.${system}.dbx-desktop;
 
+        # Fast fixed-output target used by CI to validate pnpm dependency hashes
+        # without compiling the frontend and Rust desktop application.
+        packages.dbx-pnpm-deps = self.packages.${system}.dbx-desktop.pnpmDeps;
+
         # ------------------------------------------------------------------ #
         # packages.dbx-desktop — Tauri desktop application                    #
         # Build with: nix build .#dbx-desktop                                 #
@@ -178,7 +182,7 @@
             # `fetcherVersion = 4` is supported for `pnpm_11`
             fetcherVersion = 4;
             # Update with the hash reported by a failed fixed-output build:
-            #   nix build .#dbx-desktop 2>&1 | grep 'got:'
+            #   nix build .#dbx-pnpm-deps 2>&1 | grep 'got:'
             hash = "sha256-Bt3AwBVAdA96B4UWBVDvwNBy/JX2eNn8adPpWueAjcs=";
           };