From 7eead836d876f2d728462e6c28daa2dbf0496037 Mon Sep 17 00:00:00 2001
From: brunoproduit <bruno.produit@trailofbits.com>
Date: Thu, 19 Feb 2026 16:31:26 +0100
Subject: [PATCH] Add nix github builder

---
 .github/workflows/build.yml | 191 +++++++++++++++++++-----------------
 1 file changed, 102 insertions(+), 89 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 991558f6..31f35cac 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,67 +26,80 @@ jobs:
           - "20"
           - "21"
     steps:
-        - name: Install LLVM and build tools
-          run: |
-            apt update
-            apt install --no-install-recommends -y \
-              lsb-release \
-              wget \
-              software-properties-common \
-              gnupg \
-              cmake \
-              ninja-build \
-              python-is-python3 \
-              python3-pip \
-              python3-setuptools \
-              python3-venv \
-              git
-            wget https://apt.llvm.org/llvm.sh
-            chmod +x llvm.sh
-            ./llvm.sh ${{ matrix.llvm }}
-            apt update
-            apt install --no-install-recommends -y \
-              llvm-${{ matrix.llvm }}-dev
-            echo "LLVM_PREFIX=$$(llvm-config-${{ matrix.llvm }} --prefix)" >> $GITHUB_ENV
-            echo "CC=clang-${{ matrix.llvm }}" >> $GITHUB_ENV
-            echo "CXX=clang++-${{ matrix.llvm }}" >> $GITHUB_ENV
+      - name: Install LLVM and build tools
+        run: |
+          apt update
+          apt install --no-install-recommends -y \
+            lsb-release \
+            wget \
+            software-properties-common \
+            gnupg \
+            cmake \
+            ninja-build \
+            python-is-python3 \
+            python3-pip \
+            python3-setuptools \
+            python3-venv \
+            git
+          wget https://apt.llvm.org/llvm.sh
+          chmod +x llvm.sh
+          ./llvm.sh ${{ matrix.llvm }}
+          apt update
+          apt install --no-install-recommends -y \
+            llvm-${{ matrix.llvm }}-dev
+          echo "LLVM_PREFIX=$$(llvm-config-${{ matrix.llvm }} --prefix)" >> $GITHUB_ENV
+          echo "CC=clang-${{ matrix.llvm }}" >> $GITHUB_ENV
+          echo "CXX=clang++-${{ matrix.llvm }}" >> $GITHUB_ENV
 
-        - name: Checkout
-          uses: actions/checkout@v5
+      - name: Checkout
+        uses: actions/checkout@v5
 
-        - name: Add workspace as safe directory (necessary for docker)
-          run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Add workspace as safe directory (necessary for docker)
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-        - name: Build dependencies
-          run: |
-            cmake -G Ninja -S dependencies -B dependencies/build -DUSE_EXTERNAL_LLVM=ON "-DCMAKE_PREFIX_PATH:PATH=$LLVM_PREFIX"
-            cmake --build dependencies/build
+      - name: Build dependencies
+        run: |
+          cmake -G Ninja -S dependencies -B dependencies/build -DUSE_EXTERNAL_LLVM=ON "-DCMAKE_PREFIX_PATH:PATH=$LLVM_PREFIX"
+          cmake --build dependencies/build
 
-        - name: Python venv for tests
-          run: |
-            python3 -m venv .venv
-            .venv/bin/pip install scripts/diff_tester_export_insns
-        
-        - name: Build remill
-          run: |
-            . .venv/bin/activate
-            cmake -G Ninja -B build "-DCMAKE_PREFIX_PATH:PATH=$PWD/dependencies/install" "-DCMAKE_INSTALL_PREFIX=$PWD/install"
-            cmake --build build
+      - name: Python venv for tests
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install scripts/diff_tester_export_insns
 
-        - name: Install remill
-          run: |
-            cmake --install build
+      - name: Build remill
+        run: |
+          . .venv/bin/activate
+          cmake -G Ninja -B build "-DCMAKE_PREFIX_PATH:PATH=$PWD/dependencies/install" "-DCMAKE_INSTALL_PREFIX=$PWD/install"
+          cmake --build build
 
-        - name: Smoketests with installed executable
-          run: |
-            install/bin/remill-lift-${{ matrix.llvm }} --arch amd64 --ir_out /dev/stdout --bytes c704ba01000000
-            install/bin/remill-lift-${{ matrix.llvm }} --arch aarch64 --ir_out /dev/stdout --address 0x400544 --bytes FD7BBFA90000009000601891FD030091B7FFFF97E0031F2AFD7BC1A8C0035FD6
-            install/bin/remill-lift-${{ matrix.llvm }} --arch aarch32 -ir_out /dev/stderr --bytes 0cd04de208008de504108de500208de508309de504009de500109de5903122e0c20fa0e110109fe5001091e5002081e5040081e50cd08de21eff2fe14000000000000000
+      - name: Install remill
+        run: |
+          cmake --install build
 
-        - name: Test remill
-          run: |
-            cmake --build build --target test_dependencies
-            env CTEST_OUTPUT_ON_FAILURE=1 cmake --build build --target test
+      - name: Smoketests with installed executable
+        run: |
+          install/bin/remill-lift-${{ matrix.llvm }} --arch amd64 --ir_out /dev/stdout --bytes c704ba01000000
+          install/bin/remill-lift-${{ matrix.llvm }} --arch aarch64 --ir_out /dev/stdout --address 0x400544 --bytes FD7BBFA90000009000601891FD030091B7FFFF97E0031F2AFD7BC1A8C0035FD6
+          install/bin/remill-lift-${{ matrix.llvm }} --arch aarch32 -ir_out /dev/stderr --bytes 0cd04de208008de504108de500208de508309de504009de500109de5903122e0c20fa0e110109fe5001091e5002081e5040081e50cd08de21eff2fe14000000000000000
+
+      - name: Test remill
+        run: |
+          cmake --build build --target test_dependencies
+          env CTEST_OUTPUT_ON_FAILURE=1 cmake --build build --target test
+
+  nix:
+    if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+
+      - name: Build remill
+        run: nix build .#remill
 
   macos:
     # Skip building pull requests from the same repository
@@ -104,44 +117,44 @@ jobs:
           - "20"
           - "21"
     steps:
-        - name: Install LLVM
-          run: |
-            brew install llvm@${{ matrix.llvm }}
-            LLVM_PREFIX=$(brew --prefix llvm@${{ matrix.llvm }})
-            echo "LLVM_PREFIX=$LLVM_PREFIX" >> $GITHUB_ENV
-            echo "CC=clang" >> $GITHUB_ENV
-            echo "CXX=clang++" >> $GITHUB_ENV
+      - name: Install LLVM
+        run: |
+          brew install llvm@${{ matrix.llvm }}
+          LLVM_PREFIX=$(brew --prefix llvm@${{ matrix.llvm }})
+          echo "LLVM_PREFIX=$LLVM_PREFIX" >> $GITHUB_ENV
+          echo "CC=clang" >> $GITHUB_ENV
+          echo "CXX=clang++" >> $GITHUB_ENV
 
-        - name: Checkout
-          uses: actions/checkout@v5
+      - name: Checkout
+        uses: actions/checkout@v5
 
-        - name: Build dependencies
-          run: |
-            cmake -G Ninja -S dependencies -B dependencies/build -DUSE_EXTERNAL_LLVM=ON "-DCMAKE_PREFIX_PATH:PATH=$LLVM_PREFIX"
-            cmake --build dependencies/build
+      - name: Build dependencies
+        run: |
+          cmake -G Ninja -S dependencies -B dependencies/build -DUSE_EXTERNAL_LLVM=ON "-DCMAKE_PREFIX_PATH:PATH=$LLVM_PREFIX"
+          cmake --build dependencies/build
 
-        - name: Python venv for tests
-          run: |
-            python3 -m venv .venv
-            .venv/bin/pip install scripts/diff_tester_export_insns
-        
-        - name: Build remill
-          run: |
-            . .venv/bin/activate
-            cmake -G Ninja -B build "-DCMAKE_PREFIX_PATH:PATH=$PWD/dependencies/install" "-DCMAKE_INSTALL_PREFIX=$PWD/install"
-            cmake --build build
+      - name: Python venv for tests
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install scripts/diff_tester_export_insns
 
-        - name: Install remill
-          run: |
-            cmake --install build
+      - name: Build remill
+        run: |
+          . .venv/bin/activate
+          cmake -G Ninja -B build "-DCMAKE_PREFIX_PATH:PATH=$PWD/dependencies/install" "-DCMAKE_INSTALL_PREFIX=$PWD/install"
+          cmake --build build
 
-        - name: Smoketests with installed executable
-          run: |
-            install/bin/remill-lift-${{ matrix.llvm }} --arch amd64 --ir_out /dev/stdout --bytes c704ba01000000
-            install/bin/remill-lift-${{ matrix.llvm }} --arch aarch64 --ir_out /dev/stdout --address 0x400544 --bytes FD7BBFA90000009000601891FD030091B7FFFF97E0031F2AFD7BC1A8C0035FD6
-            install/bin/remill-lift-${{ matrix.llvm }} --arch aarch32 -ir_out /dev/stderr --bytes 0cd04de208008de504108de500208de508309de504009de500109de5903122e0c20fa0e110109fe5001091e5002081e5040081e50cd08de21eff2fe14000000000000000
+      - name: Install remill
+        run: |
+          cmake --install build
 
-        - name: Test remill
-          run: |
-            cmake --build build --target test_dependencies
-            env CTEST_OUTPUT_ON_FAILURE=1 cmake --build build --target test
+      - name: Smoketests with installed executable
+        run: |
+          install/bin/remill-lift-${{ matrix.llvm }} --arch amd64 --ir_out /dev/stdout --bytes c704ba01000000
+          install/bin/remill-lift-${{ matrix.llvm }} --arch aarch64 --ir_out /dev/stdout --address 0x400544 --bytes FD7BBFA90000009000601891FD030091B7FFFF97E0031F2AFD7BC1A8C0035FD6
+          install/bin/remill-lift-${{ matrix.llvm }} --arch aarch32 -ir_out /dev/stderr --bytes 0cd04de208008de504108de500208de508309de504009de500109de5903122e0c20fa0e110109fe5001091e5002081e5040081e50cd08de21eff2fe14000000000000000
+
+      - name: Test remill
+        run: |
+          cmake --build build --target test_dependencies
+          env CTEST_OUTPUT_ON_FAILURE=1 cmake --build build --target test