ci: add nix CI

.github/actions/build-nix/action.yml

@@ -0,0 +1,20 @@
+name: build via Nix
+
+inputs:
+  package:
+    description: package specification to build
+    required: true
+  install-path:
+    description: path within resulting output, from which to install (e.g. `/bin/wash`)
+
+runs:
+  using: composite
+  steps:
+  - run: nix build -L '.#${{ inputs.package }}'
+    shell: bash
+  - run: nix run -L --inputs-from . 'nixpkgs#coreutils' -- --coreutils-prog=ginstall -p "./result${{ inputs.install-path }}" '${{ inputs.package }}'
+    shell: bash
+  - uses: actions/upload-artifact@v3
+    with:
+      name: ${{ inputs.package }}
+      path: ${{ inputs.package }}

.github/actions/install-nix/action.yml

@@ -0,0 +1,21 @@
+name: install Nix
+
+inputs:
+  cachixAuthToken:
+    description: auth token for https://app.cachix.org/organization/wasmcloud/cache/wasmcloud
+
+runs:
+  using: composite
+  steps:
+  # Install Nix
+  - uses: DeterminateSystems/nix-installer-action@v2
+    with:
+      extra-conf: |
+        accept-flake-config = true
+
+  # Setup Cachix cache
+  - uses: cachix/cachix-action@v12
+    continue-on-error: true
+    with:
+      name: wasmcloud
+      authToken: '${{ inputs.cachixAuthToken }}'

.github/workflows/nix.yml

@@ -0,0 +1,157 @@
+name: nix
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+    - main
+  push:
+    branches:
+    - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-linux:
+    strategy:
+      matrix:
+        config:
+        - target: aarch64-unknown-linux-musl
+          install-path: /bin/wash
+          test-bin: nix shell --inputs-from . 'nixpkgs#qemu' -c qemu-aarch64 ./result/bin/wash --version
+          test-oci: docker load < ./result
+          # TODO: Run aarch64 binary within OCI
+
+        - target: x86_64-pc-windows-gnu
+          install-path: /bin/wash.exe
+          test-bin: nix shell --inputs-from . 'nixpkgs#wine64' -c wine64 ./result/bin/wash.exe --version
+          test-oci: docker load < ./result
+          # TODO: Run win64 binary within OCI
+
+        - target: x86_64-unknown-linux-musl
+          install-path: /bin/wash
+          test-bin: ./result/bin/wash --version
+          test-oci: |
+            docker load < ./result
+            docker run --rm wash:$(nix eval --raw .#wash-x86_64-unknown-linux-musl-oci.imageTag) wash --version
+
+    name: wash-${{ matrix.config.target }}
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v3
+    - uses: ./.github/actions/install-nix
+      with: 
+        cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+    - uses: ./.github/actions/build-nix
+      with:
+        package: wash-${{ matrix.config.target }}
+        install-path: ${{ matrix.config.install-path }}
+    - run: ${{ matrix.config.test-bin }}
+    - uses: ./.github/actions/build-nix
+      with:
+        package: wash-${{ matrix.config.target }}-oci
+    - run: ${{ matrix.config.test-oci }}
+
+  build-mac:
+    strategy:
+      matrix:
+        config:
+        - target: aarch64-apple-darwin
+          test: file ./result/bin/wash
+          # TODO: Run aarch64 binary on host system and via OCI
+
+        - target: x86_64-apple-darwin
+          test: ./result/bin/wash --version
+
+    name: wash-${{ matrix.config.target }}
+    runs-on: macos-12
+    steps:
+    - uses: actions/checkout@v3
+    - uses: ./.github/actions/install-nix
+      with: 
+        cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+    - uses: ./.github/actions/build-nix
+      with:
+        package: wash-${{ matrix.config.target }}
+        install-path: /bin/wash
+    - run: ${{ matrix.config.test-bin }}
+    - uses: ./.github/actions/build-nix
+      with:
+        package: wash-${{ matrix.config.target }}-oci
+    - run: ${{ matrix.platform.test-oci }}
+    # TODO: Test OCI on Mac
+
+  build-lipo:
+    name: wash-universal-darwin
+    needs: build-mac
+    runs-on: macos-12
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: wash-aarch64-apple-darwin
+    - uses: actions/download-artifact@v3
+      with:
+        name: wash-x86_64-apple-darwin
+    - run: lipo -create ./wash-aarch64-apple-darwin ./wash-x86_64-apple-darwin -output ./wash-universal-darwin
+    - run: chmod +x ./wash-universal-darwin
+    - run: ./wash-universal-darwin --version
+    - uses: actions/upload-artifact@v3
+      with:
+        name: wash-universal-darwin
+        path: wash-universal-darwin
+
+  test-windows:
+    runs-on: windows-2022
+    needs: build-linux
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: wash-x86_64-pc-windows-gnu
+    # TODO: Verify that this actually starts the binary
+    - run: .\wash-x86_64-pc-windows-gnu --version
+
+  cargo:
+    strategy:
+      matrix:
+        check:
+        - fmt
+        - clippy
+        - nextest
+
+    name: cargo ${{ matrix.check }}
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v3
+    - uses: ./.github/actions/install-nix
+      with: 
+        cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+    - run: nix build -L .#checks.x86_64-linux.${{ matrix.check }}
+
+  fmt:
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v3
+    - uses: ./.github/actions/install-nix
+      with: 
+        cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+    - run: nix fmt
+
+  run:
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v3
+    - uses: ./.github/actions/install-nix
+      with: 
+        cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+    - run: nix run -L . -- --version
+
+  develop:
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v3
+    - uses: ./.github/actions/install-nix
+      with: 
+        cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+    - run: nix develop -L --ignore-environment -c cargo pkgid