From 7928a455e73bbef5deb4cc5e60cc5e6b40678c26 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 12 Feb 2025 19:56:27 +0000
Subject: [PATCH 1/2] deps: update dependency DeterminateSystems/nix-installer
 to v0.36.2

---
 .github/workflows/reproducible-builds.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/reproducible-builds.yml b/.github/workflows/reproducible-builds.yml
index bc02b37a5..779416986 100644
--- a/.github/workflows/reproducible-builds.yml
+++ b/.github/workflows/reproducible-builds.yml
@@ -57,7 +57,7 @@ jobs:
           chmod a+x "$HOME/.local/bin/bazel"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
-          curl -fsSL -o "$HOME/.local/bin/nix-installer" https://github.com/DeterminateSystems/nix-installer/releases/download/v0.34.0/nix-installer-x86_64-linux # renovate:github-release
+          curl -fsSL -o "$HOME/.local/bin/nix-installer" https://github.com/DeterminateSystems/nix-installer/releases/download/v0.36.2/nix-installer-x86_64-linux # renovate:github-release
           chmod a+x "$HOME/.local/bin/nix-installer"
           "$HOME/.local/bin/nix-installer" install --no-confirm
 

From eb500f2aecdb522cf7c2c1b2910c0f5841bf5f50 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Thu, 13 Feb 2025 10:50:09 +0100
Subject: [PATCH 2/2] ci: pin nix version

---
 .github/actions/setup_bazel_nix/action.yml | 3 ++-
 .github/workflows/reproducible-builds.yml  | 7 ++++---
 .nixversion                                | 1 +
 3 files changed, 7 insertions(+), 4 deletions(-)
 create mode 100644 .nixversion

diff --git a/.github/actions/setup_bazel_nix/action.yml b/.github/actions/setup_bazel_nix/action.yml
index 87a2d1802..7e6e6b5c0 100644
--- a/.github/actions/setup_bazel_nix/action.yml
+++ b/.github/actions/setup_bazel_nix/action.yml
@@ -75,6 +75,7 @@ runs:
             echo "$RUNNER_ARCH not supported"
             exit 1
         fi
+        echo "nixVersion=$(cat "${{ github.workspace }}/.nixversion")" | tee -a "$GITHUB_OUTPUT"
         echo "::endgroup::"
 
     - name: Install current Bash on macOS
@@ -115,7 +116,7 @@ runs:
       if: steps.check_inputs.outputs.nixPreinstalled == 'false'
       uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
       with:
-        install_url: "https://releases.nixos.org/nix/nix-2.25.2/install"
+        install_url: "https://releases.nixos.org/nix/nix-${{ steps.check_inputs.outputs.nixVersion }}/install"
 
     - name: Set $USER if not set
       shell: bash
diff --git a/.github/workflows/reproducible-builds.yml b/.github/workflows/reproducible-builds.yml
index 779416986..46df18aeb 100644
--- a/.github/workflows/reproducible-builds.yml
+++ b/.github/workflows/reproducible-builds.yml
@@ -51,15 +51,16 @@ jobs:
       - name: Setup dependencies (eccentric)
         if: matrix.deps == 'eccentric'
         run: |
-          version=$(cat .bazelversion)
+          bazelVersion=$(cat .bazelversion)
           mkdir -p "$HOME/.local/bin"
-          curl -fsSL -o "$HOME/.local/bin/bazel" "https://github.com/bazelbuild/bazel/releases/download/$version/bazel-$version-linux-x86_64"
+          curl -fsSL -o "$HOME/.local/bin/bazel" "https://github.com/bazelbuild/bazel/releases/download/$bazelVersion/bazel-$bazelVersion-linux-x86_64"
           chmod a+x "$HOME/.local/bin/bazel"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
+          nixVersion=$(cat .nixversion)
           curl -fsSL -o "$HOME/.local/bin/nix-installer" https://github.com/DeterminateSystems/nix-installer/releases/download/v0.36.2/nix-installer-x86_64-linux # renovate:github-release
           chmod a+x "$HOME/.local/bin/nix-installer"
-          "$HOME/.local/bin/nix-installer" install --no-confirm
+          "$HOME/.local/bin/nix-installer" install --no-confirm --nix-package-url https://releases.nixos.org/nix/nix-$nixVersion/nix-$nixVersion-x86_64-linux.tar.xz
 
       - name: Build
         shell: bash
diff --git a/.nixversion b/.nixversion
new file mode 100644
index 000000000..40a8d7f12
--- /dev/null
+++ b/.nixversion
@@ -0,0 +1 @@
+2.25.2