From caaccfc3a49d4b86d45aba90838f7fcccc24ac7d Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Sun, 18 Oct 2026 09:34:38 +0400
Subject: [PATCH] Set nix options through NIX_CONFIG in CI

The runner mounts a persistent nix-store volume over /nix. The current
nixos/nix image makes /etc/nix/nix.conf a symlink into /nix/store, and
the volume does not hold that path, so the link dangles and appending
to it fails before checkout: "/etc/nix/nix.conf: No such file or
directory".

Pass the settings in NIX_CONFIG instead. Without a config file Nix also
falls back to build-users-group = nixbld, which the container lacks, so
set it empty and turn the sandbox off, as the image config does.

Assisted-by: Claude:opus-5-5
---
 .forgejo/workflows/deploy.yaml | 9 ++++++++-
 .forgejo/workflows/test.yaml   | 9 ++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml
index d28722e..ad33da5 100644
--- a/.forgejo/workflows/deploy.yaml
+++ b/.forgejo/workflows/deploy.yaml
@@ -10,6 +10,14 @@ jobs:
   # so a red suite blocks the build+deploy — Forgejo has no cross-workflow needs.
   test:
     runs-on: nix-latest
+    # Settings via env, not /etc/nix/nix.conf: in the image that is a
+    # symlink into /nix/store, which the runner's nix-store volume
+    # shadows, so it dangles once the image moves on.
+    env:
+      NIX_CONFIG: |
+        experimental-features = nix-command flakes
+        build-users-group =
+        sandbox = false
     services:
       postgres:
         image: postgres:17-alpine
@@ -20,7 +28,6 @@ jobs:
     steps:
       - name: Prepare container for actions
         run: |
-          echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
           # node for JS actions (checkout); git-minimal is already in the image
           nix-env -iA nixpkgs.nodejs_22
 
diff --git a/.forgejo/workflows/test.yaml b/.forgejo/workflows/test.yaml
index e824167..725c1a0 100644
--- a/.forgejo/workflows/test.yaml
+++ b/.forgejo/workflows/test.yaml
@@ -10,6 +10,14 @@ on:
 jobs:
   test:
     runs-on: nix-latest
+    # Settings via env, not /etc/nix/nix.conf: in the image that is a
+    # symlink into /nix/store, which the runner's nix-store volume
+    # shadows, so it dangles once the image moves on.
+    env:
+      NIX_CONFIG: |
+        experimental-features = nix-command flakes
+        build-users-group =
+        sandbox = false
     services:
       # CI stand-in for bin/test's ephemeral Postgres: the nix container runs
       # as root and initdb refuses to run as root, so the DB lives in a
@@ -26,7 +34,6 @@ jobs:
     steps:
       - name: Prepare container for actions
         run: |
-          echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
           # node for JS actions (checkout); git-minimal is already in the image
           nix-env -iA nixpkgs.nodejs_22