Move nix CI jobs to separate workflow

[epompeii]

The 3 nix jobs (lints, build bencher, build api) are fully independent of the main CI pipeline. Extract them into a standalone nix.yml workflow to simplify lint.yml and build.yml.

[github-actions]

🤖 Claude Code Review

PR: #708
Base: devel
Head: u/ep/ci-nix
Commit: 37e5ad7ff8ba7844048da808e14e4ee2b0243ed1

---

Here's my review of the PR:

---

PR Review: Move Nix CI jobs to separate workflow + Skip script_gen on forks

Commits: 077ec7cea (Move nix CI jobs to separate workflow), 37e5ad7ff (pr_fork_no_script_gen)

Summary

Two changes:

1. Nix CI jobs (lints + builds) extracted from build.yml and lint.yml into a dedicated nix.yml workflow with path-based change detection.
2. script_gen and script_gen_version jobs in cli.yml are skipped for fork PRs via a new is-fork input.
3. CLAUDE.md updated to prohibit Co-Authored-By lines in commit messages.

Findings

No issues (good)

• The is-fork detection expression github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository is the standard correct pattern.
• Skipping script_gen on forks makes sense since those jobs use ${{ secrets.BENCHER_API_TOKEN }} which isn't available to fork PRs.
• The concurrency group in nix.yml correctly matches the pattern used in ci.yml.
• Change detection filters for cli and api in nix.yml are reasonable and aligned with what's in ci.yml.

Minor observations:

1. nix.yml:23 — Missing Cargo.toml/Cargo.lock in CLI filter: The cli filter in nix.yml includes Cargo.toml, Cargo.lock, lib/**, services/cli/**. The ci.yml cli filter also includes services/api/openapi.json. This is likely intentional (the Nix build doesn't depend on the OpenAPI spec), but worth confirming.

2. nix.yml — No if: github.ref != 'refs/heads/cloud' on the workflow level: The changes job has if: github.ref != 'refs/heads/cloud', but the three downstream jobs only have needs: changes — they won't run when changes is skipped. This works correctly in practice (GitHub Actions skips dependent jobs when their needs are skipped), so this is fine.

3. nix.yml — Nix builds always run on ubuntu-22.04: Consistent with how they were defined before in build.yml. No issue, just noting continuity.

4. is-fork type is boolean but the expression evaluates to a string: In GitHub Actions, workflow input expressions like ${{ github.event_name == 'pull_request' && ... }} produce string 'true'/'false', but type: boolean inputs auto-coerce these correctly for workflow_call. This works as expected.

Verdict

Looks good. The changes are clean, correct, and well-structured. The Nix workflow extraction adds proper change detection (which the old inline jobs lacked), reducing unnecessary CI runs. The fork detection for script_gen correctly prevents failures on fork PRs that lack access to secrets.

---

_{Model: claude-opus-4-6}