fix(setup): checksum-verified just install instead of curl|bash (CWE-… #211

	# This workflow is managed by gh actions-lock.
	# SPDX-License-Identifier: MPL-2.0
	# This workflow is managed by gh actions-lock.
	# This workflow is managed by gh actions-lock.
	name: Guix/Nix Package Policy
	on:
	push:
	branches: [main, master]
	pull_request:

	# Estate guardrail: scope push to default branches so a PR fires once (not
	# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read
	jobs:
	check:
	runs-on: ubuntu-latest
	timeout-minutes: 15
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@v7.0.1
	- name: Enforce Guix / channels (Nix deprecated)
	run: \|
	HAS_GUIX=$(find . $ -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" $ 2>/dev/null \| head -1)
	HAS_NIX=$(find . -name ".nix" -not -path './.git/' 2>/dev/null \| head -1)

	NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null \| grep -E 'package-lock\.json\|yarn\.lock\|Gemfile\.lock\|Pipfile\.lock\|poetry\.lock\|cargo\.lock' \|\| true)
	if [ -n "$NEW_LOCKS" ]; then
	echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility."
	fi

	if [ -n "$HAS_NIX" ]; then
	echo "::error::Nix is deprecated in this estate. Use Guix + channels (build/guix.scm, build/.guix-channel). Found: $HAS_NIX"
	exit 1
	fi

	if [ -n "$HAS_GUIX" ]; then
	echo "✅ Guix package management detected"
	else
	echo "::error::Missing Guix channel/manifest (build/guix.scm or .guix-channel)"
	exit 1
	fi

	echo "✅ Package policy check passed"

Navigation Menu