improve release workflow

.github/workflows/ci.yml

@@ -1,22 +1,14 @@
-name: Build and Check
+name: Check PR
 
 on:
-  push:
-    branches: master
   pull_request:
 
 jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
+  check-pr:
+    runs-on: ubuntu-22.04
     steps:
-      - name: Checkout 🛎️
-        uses: actions/[email protected]
-
-      - name: Install Nix ❄️
-        uses: cachix/install-nix-action@v20
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
+      - uses: actions/[email protected]
+      - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Link Cachix 🔌
         uses: cachix/cachix-action@v12

.github/workflows/release.yaml

@@ -3,18 +3,32 @@ name: Release
 on:
   push:
     tags:
-      - "*"
+      - "v?[0-9]+.[0-9]+.[0-9]+*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The existing tag to publish to FlakeHub"
+        type: "string"
+        required: true
 
 jobs:
   release:
     name: Release
     runs-on: ubuntu-22.04
     permissions:
+      id-token: write
       contents: write
     steps:
+      - uses: DeterminateSystems/nix-installer-action@v4
       - uses: actions/checkout@v3
-      - name: Create Github Release
+
+      - name: Create Github Release 📦
         uses: ncipollo/release-action@v1
         with:
           generateReleaseNotes: true
 
+      - name: Push to FlakeHub ❄️
+        uses: determinatesystems/flakehub-push@main
+        with:
+          visibility: "public"
+          tag: "${{ inputs.tag }}"

.github/workflows/rolling.yaml

@@ -0,0 +1,33 @@
+name: Deploy Main
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  deploy-main:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v3
+      - uses: DeterminateSystems/nix-installer-action@main
+
+      - name: Link Cachix 🔌
+        uses: cachix/cachix-action@v12
+        with:
+          name: cosmos
+          authToken: '${{ secrets.COSMOS_CACHE_KEY }}'
+
+      - name: Check 🔎
+        run: |
+          nix flake check --print-build-logs
+
+      - name: Run Shell 🐚
+        run: |
+          nix develop
+
+      - name: Push to FlakeHub ❄️
+        uses: determinatesystems/flakehub-push@main
+        with:
+          rolling: true
+          visibility: "public"