From 9b642aa5b78c2ef3f1ef6e937b56c3597ac9ebab Mon Sep 17 00:00:00 2001
From: Conrad Kramer <conrad@conradkramer.com>
Date: Wed, 18 Mar 2026 23:14:40 -0700
Subject: [PATCH] Skip Nix install in macOS runner bootstrap

---
 services/forgejo-nsc/internal/nsc/macos.go | 36 +++-------------------
 1 file changed, 4 insertions(+), 32 deletions(-)

diff --git a/services/forgejo-nsc/internal/nsc/macos.go b/services/forgejo-nsc/internal/nsc/macos.go
index 42bb798..11ac778 100644
--- a/services/forgejo-nsc/internal/nsc/macos.go
+++ b/services/forgejo-nsc/internal/nsc/macos.go
@@ -588,43 +588,15 @@ if ! command -v curl >/dev/null 2>&1; then
   exit 1
 fi
 
-if ! command -v nix >/dev/null 2>&1; then
-  echo "Installing nix (Determinate Systems installer)..."
-  installer="/tmp/nix-installer.$$"
-  curl -fsSL -o "${installer}" https://install.determinate.systems/nix
-  chmod +x "${installer}"
-
-  if command -v sudo >/dev/null 2>&1; then
-    if sudo -n true 2>/dev/null; then
-      sudo -n sh "${installer}" install --no-confirm
-    else
-      sudo sh "${installer}" install --no-confirm
-    fi
-  else
-    sh "${installer}" install --no-confirm
-  fi
-
-  rm -f "${installer}"
-fi
-
+# Apple build workflows do not require Nix just to bootstrap the Forgejo runner.
+# If Nix is already present on the base image, keep it on PATH; otherwise leave
+# installation to the job itself.
 if [[ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]]; then
   # shellcheck disable=SC1091
   . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+  export PATH="/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:${PATH}"
 fi
 
-export PATH="/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:${PATH}"
-
-# Flake builds need nix-command + flakes enabled. Workflows may layer additional
-# config, but ensure a sane default exists.
-mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/nix"
-cat > "${XDG_CONFIG_HOME:-$HOME/.config}/nix/nix.conf" <<'EOF'
-experimental-features = nix-command flakes
-sandbox = true
-fallback = true
-substituters = https://cache.nixos.org
-trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-EOF
-
 mkdir -p bin
 export PATH="${PWD}/bin:${PATH}"