feat: add Nix flake support

[levonk]

What

Adds a flake.nix so the project can be installed and run directly from GitHub at the latest release:

nix run github:nolabs-ai/nono
nix profile add github:nolabs-ai/nono

The flake tracks the default branch and is auto-bumped to the latest release by a daily workflow, so github:nolabs-ai/nono always serves the current release.

Why

Enables nix run github:nolabs-ai/nono and nix profile add github:nolabs-ai/nono for users who already have Nix installed. The flake wraps the prebuilt release binary directly (no nixpkgs build toolchain in the path) and includes a from-source build option for reproducibility/auditability.

Relationship to nixpkgs

This project is already in nixpkgs as nixpkgs#nono (currently 0.61.1 on unstable; latest release is 0.75.0). This flake is complementary, not redundant:

• Faster release cadence — the hash-automation workflow bumps to the latest release within ~24 hours; nixpkgs follows its own staging schedule (days to weeks behind).
• #prebuilt serves the official release artifact directly — no nixpkgs build toolchain in the path; #source builds from source for auditability. Both are exercised by CI.
• x86_64-darwin at the latest version — nixpkgs's meta.platforms declares x86_64-darwin but the stable darwin channel ships an older version; the flake's nixpkgs-darwin-legacy pin builds it at the latest release, where the nixpkgs darwin stable channel ships 0.61.1.
• Shorter supply chain — fetches directly from GitHub Releases, one fewer packaging layer to audit.

nix profile add nixpkgs#nono still works and this flake does not replace it.

Changes

• flake.nix: Nix flake wrapping the prebuilt release tarball as packages.<system>.default and apps.<system>.default.
• flake.lock: pinned nixpkgs-unstable input.
• .github/workflows/nix-release.yml: scheduled lag-check automation that auto-bumps version + per-platform sha256 hashes and opens a PR when flake.nix falls behind the latest release.
• .github/workflows/nix.yml: GitHub Actions CI for Nix validation with cross-platform matrix (ubuntu-latest, macos-13, macos-14).
• .gitignore: Added Nix build result symlinks
• README.md: Added Nix installation subsection
• CHANGELOG.md: Added changelog entry

Testing

Verified locally:

nix flake check --no-build
nix build .
nix run . -- --help

Builds and runs successfully on aarch64-darwin.

Notes

• The flake exposes the prebuilt release tarball as #prebuilt (also #default, fast, no compilation) and a from-source build as #source (reproducible, auditable). Both are exercised by CI.
• Tag-pinning (github:.../vX.Y.Z) is not supported for the prebuilt output — release tags are cut before the bump workflow updates flake.nix. Use github:.../ (tracks default branch) or pin to a commit SHA. The #source output works at any tag since it builds from source.
• No breaking changes to existing build paths.

Scope

The PR scope is well-contained — additive only, no existing functionality affected.

Related

Resolves #1783

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+512
Lines removed	-1
Total changed	513
Classification	Large (> 300 lines)

Affected crates

No crate source directories are directly affected.

Blast radius — Moderate

This PR touches: documentation,CI / build tooling

---

_{Updated automatically on each push to this PR.}

[SequeI]

This feels overbuilt for what we need, and CI is broken right now.

CI: Action Lint is failing because nix.yml:52 uses runs-on: macos-13, which isn't a valid runner label anymore. That's also why the Nix flake workflow's macos-13 job has been stuck queued for over an hour. Just swap to macos-14 or macos-15.

Bugs:

• nix-release.yml's bump script updates the prebuilt binary hashes but never touches sourceFor's hash/cargoHash in flake.nix. After a version bump, nix build .#source breaks.
• The .#source build step in nix.yml has no pull_request guard like the nix run step does, so once the above breaks, it'll fail on every unrelated PR.
• IGNORED = (..., "pnpr-", ...) looks like a leftover from a pnpm workflow this was copied from. Doesn't match anything real, just dead code.

main had zero Nix support before this, so we don't need to be this complex. The prebuilt binary table plus bump script is solving a problem we don't have. Nix's whole point is reproducible source builds. I'd rather just have one flake.nix with a single buildRustPackage derivation (version pulled from Cargo.toml so nothing needs syncing), and one CI job checking nix flake check + nix build on Linux and macOS. Drop nix-release.yml entirely.

For installing a specific version: nix run github:nolabs-ai/nono?ref=v0.75.0. For latest, just document a curl-the-github-api-then-nix-run one-liner, same pattern as our existing install docs.

I'm also going to submit nono to nixpkgs directly and become its maintainer there. Once that's in, nixpkgs' own update bot handles version bumps automatically, so people can just install from nixpkgs/NixOS too. Separate issue, not blocking this one.

Last thing: the comments in nix-release.yml are way too long. Keep them to one line where the reasoning isn't obvious.

Can pair on rewriting this if helpful, will do so on Monday as this is something we do want to get in. Thanks for the PR!