From f1f1f8ad4d6f94b6a529c7657e21f87f1ca3dadb Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Sun, 11 Oct 2026 21:53:52 +0200
Subject: [PATCH] ci(release): build the Nix flake at every release tag

A flake input pinned to vX.Y.Z is the Nix release, so the release
workflow now builds the flake at the tag and checks its version before
the GitHub release is published. The install guide shows how to pin the
input to a release tag, and the release checklist names the files that
carry the version.
---
 .github/workflows/release.yml | 23 ++++++++++++++++++++++-
 docs/DEVELOPMENT.md           |  9 ++++++---
 docs/INSTALL.md               |  9 +++++++++
 3 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cc73135..7c032f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -230,9 +230,30 @@ jobs:
             *.rpm
           if-no-files-found: error
 
+  # The flake is the Nix release: a tag is what `github:narrrl/proton-drive-linux/vX.Y.Z`
+  # pins, so it has to build before the release is announced.
+  nix:
+    name: Build the Nix package
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: cachix/install-nix-action@v31
+
+      - name: Build the flake
+        run: nix build --print-build-logs .#proton-drive-linux
+
+      - name: Check the version
+        run: |
+          built="$(./result/bin/pdfs --version)"
+          echo "$built"
+          case "$GITHUB_REF" in
+            refs/tags/v*) grep -qF "${GITHUB_REF_NAME#v}" <<< "$built" ;;
+          esac
+
   publish:
     name: Create GitHub Release
-    needs: [checks, build-release]
+    needs: [checks, build-release, nix]
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-24.04
 
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index 2844758..39aeb83 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -153,15 +153,18 @@ Releases are cut from `main` by pushing a `v*` tag. `.github/workflows/release.y
 1. checks that the tag, the workspace version in `Cargo.toml` and `pkgver` in
    `packaging/PKGBUILD` agree;
 2. runs the quality gates;
-3. builds the release binaries and packages a `.tar.gz`, a `.deb` and a GPG-signed `.rpm`;
-4. publishes them as a GitHub release;
+3. builds the release binaries and packages a `.tar.gz`, a `.deb` and a GPG-signed `.rpm`, and
+   builds the Nix flake at the tag, which is what a flake input pinned to `vX.Y.Z` gets;
+4. publishes them as a GitHub release, with the version's section of `docs/CHANGELOG.md` as the
+   notes;
 5. calls `.github/workflows/aur.yml`, which updates and pushes the AUR recipes and commits them
    back to `main`.
 
 To prepare a release:
 
 ```bash
-# 1. Bump the version in Cargo.toml and packaging/PKGBUILD, then refresh the lock file.
+# 1. Bump the version in Cargo.toml, packaging/PKGBUILD, po/pdfs.pot and the pinned flake
+#    URL in docs/INSTALL.md, then refresh the lock file.
 cargo update --workspace
 # 2. Move the [Unreleased] notes in docs/CHANGELOG.md under the new version.
 # 3. Commit, tag and push.
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 5936dd6..6821073 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -103,6 +103,15 @@ GNOME Keyring for you:
 }
 ```
 
+That URL follows `main`. To stay on releases, pin the input to a release tag instead, and change
+the tag to update:
+
+```nix
+inputs.proton-drive-linux.url = "github:narrrl/proton-drive-linux/v3.3.0";
+```
+
+Each release tag is built with Nix before the release is published.
+
 To try it without changing your system, run the app straight from the flake:
 
 ```bash