From 83da429854f83602ba36c4767bc37aaf3579310e Mon Sep 17 00:00:00 2001
From: Conrad Kramer <conrad@conradkramer.com>
Date: Sun, 7 Jun 2026 11:35:37 -0700
Subject: [PATCH] Make release secret decrypt find Nix tools

---
 .../decrypt-release-secrets/action.yml        | 27 +++++++++++++++++--
 Scripts/ci/ensure-nix.sh                      |  8 ++++++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/.forgejo/actions/decrypt-release-secrets/action.yml b/.forgejo/actions/decrypt-release-secrets/action.yml
index ade7288..9215130 100644
--- a/.forgejo/actions/decrypt-release-secrets/action.yml
+++ b/.forgejo/actions/decrypt-release-secrets/action.yml
@@ -15,6 +15,27 @@ runs:
         ROOT_INPUT='${{ inputs.root }}'
         ROOT="$(cd "$ROOT_INPUT" && pwd)"
 
+        resolve_nix_bin() {
+          local candidate
+          for candidate in \
+            "${NIX_BIN:-}" \
+            "$(command -v nix 2>/dev/null || true)" \
+            /nix/var/nix/profiles/default/bin/nix \
+            "${HOME:-}/.nix-profile/bin/nix" \
+            "${HOME:-}/.local/state/nix/profile/bin/nix" \
+            /Users/runner/.nix-profile/bin/nix \
+            /Users/runner/.local/state/nix/profile/bin/nix \
+            /home/runner/.nix-profile/bin/nix \
+            /home/runner/.local/state/nix/profile/bin/nix \
+            ; do
+            if [[ -n "$candidate" && -x "$candidate" ]]; then
+              printf '%s\n' "$candidate"
+              return 0
+            fi
+          done
+          return 1
+        }
+
         resolve_decrypt_tool() {
           local candidate
           for candidate in \
@@ -46,9 +67,11 @@ runs:
               return 0
             fi
           done
-          if command -v nix >/dev/null 2>&1; then
+          local nix_bin
+          nix_bin="$(resolve_nix_bin || true)"
+          if [[ -n "$nix_bin" ]]; then
             local built
-            built="$(nix build --no-link "$ROOT#agenix" --print-out-paths 2>/dev/null | tail -n 1 || true)"
+            built="$("$nix_bin" --extra-experimental-features 'nix-command flakes' build --no-link "$ROOT#agenix" --print-out-paths 2>/dev/null | tail -n 1 || true)"
             if [[ -n "$built" && -x "$built/bin/agenix" ]]; then
               printf 'agenix:%s\n' "$built/bin/agenix"
               return 0
diff --git a/Scripts/ci/ensure-nix.sh b/Scripts/ci/ensure-nix.sh
index 7addfce..05a56af 100755
--- a/Scripts/ci/ensure-nix.sh
+++ b/Scripts/ci/ensure-nix.sh
@@ -134,6 +134,14 @@ fi
 source_nix_profile || true
 export PATH="${HOME}/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:${PATH}"
 
+if [[ -n "${GITHUB_PATH:-}" ]]; then
+  {
+    echo "${HOME}/.nix-profile/bin"
+    echo "/nix/var/nix/profiles/default/bin"
+    echo "/nix/var/nix/profiles/default/sbin"
+  } >> "${GITHUB_PATH}"
+fi
+
 config_root="${XDG_CONFIG_HOME:-$HOME/.config}"
 config_file="${config_root}/nix/nix.conf"
 if [[ -e "${config_file}" && ! -w "${config_file}" ]]; then