fix: configure runner according to the matrix job

The matrix job returns the type of runner, so we can configure the nix
installation step accordingly.

Author: jfroche

.github/actions/nix-install-ephemeral/action.yml

@@ -42,5 +42,5 @@ runs:
         install_url: https://releases.nixos.org/nix/nix-2.31.2/install
         extra_nix_config: |
           substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
-          trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+          trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
           ${{ inputs.push-to-cache == 'true' && 'post-build-hook = /etc/nix/upload-to-cache.sh' || '' }}

.github/workflows/nix-build.yml

@@ -35,7 +35,14 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
-      - name: Build Nix Package
+      - name: Install nix (ephemeral)
+        if: ${{ matrix.runs_on.group != 'self-hosted-runners-nix' }}
+        uses: ./.github/actions/nix-install-ephemeral
+        env:
+          DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
+          NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
+      - name: Install nix (self-hosted)
+        if: ${{ matrix.runs_on.group == 'self-hosted-runners-nix' }}
         uses: ./.github/actions/nix-install-self-hosted
       - name: nix build
         shell: bash
@@ -55,7 +62,7 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
-      - name: Build Nix Package
+      - name: Install nix
         uses: ./.github/actions/nix-install-self-hosted
       - name: nix build
         shell: bash

.github/workflows/nix-eval.yml

@@ -29,4 +29,4 @@ jobs:
         name: Generate Nix Matrix
         run: |
           set -Eeu
-          echo matrix="$(nix run .\#github-matrix checks legacyPackages)" >> "$GITHUB_OUTPUT"
+          echo matrix="$(nix run --accept-flake-config .\#github-matrix checks legacyPackages)" >> "$GITHUB_OUTPUT"

flake.nix

@@ -3,7 +3,7 @@
   nixConfig = {
     extra-substituters = [ "https://nix-postgres-artifacts.s3.amazonaws.com" ];
     extra-trusted-public-keys = [
-      "nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=%"
+      "nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI="
     ];
   };
   inputs = {