[AlexHardAtWork]

What

Replace the inline nix + Cachix preamble in six workflows with dev-kit's setup-nix
composite action, and put all dev-kit references on v2.2.0.

Why

The installer + Cachix pair was copy-pasted at 8 call sites. Extracting it to dev-kit
(#30, released in v2.2.0) means the installer
choice is changed in one place instead of fourteen once artifact-conduit adopts the same action.

Solar also carried three dev-kit pins at two different versions. Now one.

Testing

• Solar's own update-action-pins check passes — every uses: is SHA-pinned.
• actionlint clean before the pin swap; the only findings are two pre-existing SC2086
  infos in docker.yaml / release-please.yaml, both untouched here.
• Real verification is this PR's own CI run: golang, codegen, helm-lint,
  helm-publish, test-e2e and test-demo all go through the new action.

Notes for reviewers

No behaviour change intended — same installer, same pins, same Cachix cache.

• determinate: false and the empty diagnostic-endpoint moved into the action, along
  with the comments explaining them. Same values as before.
• Secrets are still passed by the caller. Composite actions have no secrets context,
  so cachix-auth-token / cachix-signing-key are inputs. Both default to '', which is
  the existing fork-PR read-only fallback.
• diff-check and renovate-auto-approve moved v1.0.15 → v2.2.0. Both files are
  byte-identical between those tags — a pin refresh, not an upgrade.
• Go cache steps and their trust-scoping comments (Improve docker build process #237) are untouched.
• release-please.yaml and docker.yaml keep their own setup; out of scope.

Prepares artifact-conduit#441, which will use the same action.

Checklist

• Tests added/updated
• No breaking changes (or upgrade path documented above)
• Readable commit history (squashed and cleaned up as desired)
• AI code review considered and comments resolved

Summary by CodeRabbit

• Chores

  • Standardized Nix installation and shared cache configuration across automated code generation, linting, testing, publishing, and end-to-end workflows.
  • Updated workflow tooling to use the latest shared automation configuration.
  • Updated the automated dependency-update approval workflow to a newer version.

• Tests

  • Preserved existing code generation, validation, publishing, and end-to-end test coverage while simplifying their environment setup.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 00de0e70-4185-414d-932c-9fd3a9d3d237

📥 Commits

Reviewing files that changed from the base of the PR and between 6fe7495 and 81a4a25.

📒 Files selected for processing (7)

• .github/workflows/codegen.yaml
• .github/workflows/golang.yaml
• .github/workflows/helm-lint.yaml
• .github/workflows/helm-publish.yaml
• .github/workflows/renovate-auto-approve.yml
• .github/workflows/test-demo.yaml
• .github/workflows/test-e2e.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflows now use the shared dev-kit setup-nix action with Cachix authentication and signing secrets. The Renovate auto-approve workflow reference is updated to dev-kit v2.2.0.

Changes

Shared Nix workflow setup

Layer / File(s)	Summary
Replace Nix and Cachix setup steps .github/workflows/codegen.yaml, .github/workflows/golang.yaml, .github/workflows/helm-*.yaml, .github/workflows/test-demo.yaml, .github/workflows/test-e2e.yaml	The workflows replace separate Nix installer and Cachix steps with the shared setup-nix action. The codegen diff-check action also updates to v2.2.0.

Renovate workflow update

Layer / File(s)	Summary
Update Renovate workflow reference .github/workflows/renovate-auto-approve.yml	The reusable Renovate auto-approve workflow reference changes from dev-kit v1.0.15 to v2.2.0.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 81a4a

The change centralizes existing Nix and Cachix setup across six workflows and refreshes related action pins without an intended behavior change; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: rebellieous, yocaba

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: replacing inline CI setup with the dev-kit setup-nix composite action.
Description check	✅ Passed	The description covers the required What, Why, Testing, Notes for reviewers, and Checklist sections. It explains the workflow changes, motivation, testing evidence, compatibility details, and scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (7 skipped: 7 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch improvement/setup-nix-action

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 33647610448

Coverage increased (+0.09%) to 80.264%

Details

• Coverage increased (+0.09%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 2 coverage regressions across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

2 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
pkg/controller/target_controller.go	2	78.26%

---

Coverage Stats

Relevant Lines:	6881
Covered Lines:	5523
Line Coverage:	80.26%
Coverage Strength:	29.44 hits per line

---

💛 - Coveralls