flake: Use nix-github-actions from npins

This eliminates the last external Flake dependency.
I really don't like how flake dependencies pollute into downstream lock files with no distinction of development deps & runtime deps.

flake.nix

@@ -3,30 +3,26 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-
-    nix-github-actions.url = "github:nix-community/nix-github-actions";
-    nix-github-actions.inputs.nixpkgs.follows = "nixpkgs";
-
     pyproject-nix.url = "github:nix-community/pyproject.nix";
     pyproject-nix.inputs.nixpkgs.follows = "nixpkgs";
-    pyproject-nix.inputs.nix-github-actions.follows = "nix-github-actions";
   };
 
   outputs =
     {
       self,
       nixpkgs,
       pyproject-nix,
-      nix-github-actions,
       ...
     }@inputs:
     let
+      npins = import ./npins;
+
       forAllSystems = lib.genAttrs lib.systems.flakeExposed;
       inherit (nixpkgs) lib;
     in
     {
 
-      githubActions = nix-github-actions.lib.mkGithubMatrix {
+      githubActions = (import npins.nix-github-actions).mkGithubMatrix {
         checks =
           let
             strip = lib.flip removeAttrs [
@@ -111,12 +107,7 @@
                   pname = "lix-unit";
                   name = "lix-unit-${lix.version}";
                   inherit (lix) version;
-                  src = pkgs.fetchFromGitHub {
-                    owner = "adisbladis";
-                    repo = "lix-unit";
-                    rev = "6202da22614dc0fb849e34d761621d6b1a3c110e";
-                    hash = "sha256-wf45evw+BvDccVrBuFfFOZjVxh6ZI/nS7S6Lq8mv/No=";
-                  };
+                  src = npins.lix-unit;
                 });
           };
 

npins/default.nix

@@ -0,0 +1,79 @@
+# Generated by npins. Do not modify; will be overwritten regularly
+let
+  data = builtins.fromJSON (builtins.readFile ./sources.json);
+  inherit (data) version;
+
+  mkSource =
+    spec:
+    assert spec ? type;
+    let
+      path =
+        if spec.type == "Git" then
+          mkGitSource spec
+        else if spec.type == "GitRelease" then
+          mkGitSource spec
+        else if spec.type == "PyPi" then
+          mkPyPiSource spec
+        else if spec.type == "Channel" then
+          mkChannelSource spec
+        else
+          builtins.throw "Unknown source type ${spec.type}";
+    in
+    spec // { outPath = path; };
+
+  mkGitSource =
+    {
+      repository,
+      revision,
+      url ? null,
+      hash,
+      ...
+    }:
+    assert repository ? type;
+    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
+    # In the latter case, there we will always be an url to the tarball
+    if url != null then
+      (builtins.fetchTarball {
+        inherit url;
+        sha256 = hash; # FIXME: check nix version & use SRI hashes
+      })
+    else
+      assert repository.type == "Git";
+      let
+        urlToName =
+          url: rev:
+          let
+            matched = builtins.match "^.*/([^/]*)(\\.git)?$" repository.url;
+
+            short = builtins.substring 0 7 rev;
+
+            appendShort = if (builtins.match "[a-f0-9]*" rev) != null then "-${short}" else "";
+          in
+          "${if matched == null then "source" else builtins.head matched}${appendShort}";
+        name = urlToName repository.url revision;
+      in
+      builtins.fetchGit {
+        inherit (repository) url;
+        rev = revision;
+        inherit name;
+        # hash = hash;
+      };
+
+  mkPyPiSource =
+    { url, hash, ... }:
+    builtins.fetchurl {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkChannelSource =
+    { url, hash, ... }:
+    builtins.fetchTarball {
+      inherit url;
+      sha256 = hash;
+    };
+in
+if version == 3 then
+  builtins.mapAttrs (_: mkSource) data.pins
+else
+  throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"

npins/sources.json

@@ -0,0 +1,35 @@
+{
+  "pins": {
+    "lix-unit": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "adisbladis",
+        "repo": "lix-unit"
+      },
+      "branch": "main",
+      "revision": "6202da22614dc0fb849e34d761621d6b1a3c110e",
+      "url": "https://github.com/adisbladis/lix-unit/archive/6202da22614dc0fb849e34d761621d6b1a3c110e.tar.gz",
+      "hash": "1npwmz4sp2rfxp9gj8wr3v3db61rqmbvihasf7fg01iyzix3kzn1"
+    },
+    "nix-github-actions": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "nix-community",
+        "repo": "nix-github-actions"
+      },
+      "branch": "master",
+      "revision": "e04df33f62cdcf93d73e9a04142464753a16db67",
+      "url": "https://github.com/nix-community/nix-github-actions/archive/e04df33f62cdcf93d73e9a04142464753a16db67.tar.gz",
+      "hash": "141jgrc5g0fz8fd8nd3zjy6746qi1wva9775lpfr259lqi6v7287"
+    },
+    "nixpkgs": {
+      "type": "Channel",
+      "name": "nixpkgs-unstable",
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-24.11pre704822.85f7e662eda4/nixexprs.tar.xz",
+      "hash": "0dqlz0xqd3nn49hnx943y5sfqd7nmj25s6gi1pjm907j3vbgg47k"
+    }
+  },
+  "version": 3
+}