From 9dc9b679e102e39ef852c12890ec9a3ddc44a976 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Fri, 10 Jul 2026 12:31:00 +0000
Subject: [PATCH] [skip ci] Ensure that Docker builds reuse the cached binaries

---
 .github/workflows/docker.yml | 5 ++++-
 .github/workflows/nix.yml | 13 ++++++++++++-
 .github/workflows/release.yml | 14 ++------------
 .github/workflows/validate.yml | 21 ++-------------------
 4 file(s) changed, 20 insertion(s)(+), 33 deletion(s)(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -10,7 +10,7 @@
 
 jobs:
   build-docker-image:
-    name: Build Docker image (${{ matrix.runner }})
+    name: Build Docker image (linux-${{ matrix.key }})
     strategy:
       fail-fast: false
       matrix:
@@ -31,6 +31,9 @@
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          extra_nix_config: |
+            extra-substituters = ${{ vars.NIKS3_SERVER_URL }}
+            extra-trusted-public-keys = ${{ vars.NIKS3_PUBLIC_KEY }}
       - name: Build Docker image
         run: |
           DOCKER_PATH=$(nix build .#docker --no-link --print-out-paths)
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -1,6 +1,7 @@
 on:
   push:
     branches: ["main"]
+    tags: ["v*.*.*"]
 
 permissions:
   contents: read
@@ -31,7 +32,6 @@
           nix_path: nixpkgs=channel:nixpkgs-unstable
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
           extra_nix_config: |
-            system = ${{ matrix.system }}
             extra-substituters = ${{ vars.NIKS3_SERVER_URL }}
             extra-trusted-public-keys = ${{ vars.NIKS3_PUBLIC_KEY }}
       - id: build
@@ -62,3 +62,14 @@
           UDP_OVER_TCP_PATH: ${{ steps.build.outputs.udp_over_tcp }}
         run: |
           cachix push ${CACHIX_NAME} ${SANDHOLE_PATH} ${UDP_OVER_TCP_PATH}
+  build-docker:
+    name: Build Docker
+    permissions:
+      contents: read
+      packages: write
+    needs:
+      - build-nix-packages
+    uses: ./.github/workflows/docker.yml
+    secrets:
+      dockerhub-push-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN  }}
+      ghcr-push-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,16 +29,6 @@
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
 
-  build-docker:
-    name: Build for Docker
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/docker.yml
-    secrets:
-      dockerhub-push-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN  }}
-      ghcr-push-token: ${{ secrets.GITHUB_TOKEN }}
-
   build-linux:
     strategy:
       fail-fast: false
@@ -78,10 +68,10 @@
       fail-fast: false
       matrix:
         include:
-          - runner: macos-15-intel
+          - runner: macos-26-intel
             target: x86_64-apple-darwin
             key: macos-amd64
-          - runner: macos-15
+          - runner: macos-26
             target: aarch64-apple-darwin
             key: macos-arm64
     name: Build for ${{ matrix.key }}
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -83,9 +83,9 @@
         include:
           - runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
-          - runner: macos-15-intel
+          - runner: macos-26-intel
             target: x86_64-apple-darwin
-          - runner: macos-15
+          - runner: macos-26
             target: aarch64-apple-darwin
           - runner: windows-latest
             target: x86_64-pc-windows-msvc
@@ -136,20 +136,3 @@
         with:
           files: ./codecov.json
           token: ${{ secrets.CODECOV_TOKEN }}
-  build-docker:
-    name: Build Docker
-    if: github.ref == 'refs/heads/main'
-    permissions:
-      contents: read
-      packages: write
-    needs:
-      - rustfmt-msrv
-      - clippy-msrv
-      - build-msrv-default-features
-      - build-msrv-no-default-features
-      - tests-nightly
-      - coverage-nightly
-    uses: ./.github/workflows/docker.yml
-    secrets:
-      dockerhub-push-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN  }}
-      ghcr-push-token: ${{ secrets.GITHUB_TOKEN }}

--
tangled.sh