Release v3.21.5 (#73)

* Prepare release v3.21.5

* Update the state.json for v3.21.5

* Update README.md and action.yml for v3.21.5

* flake.lock: Update

Flake lock file updates:

• Updated input 'nixpkgs':
    'https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.1017464%2Brev-567a49d1913ce81ac6e9582e3553dd90a955875f/019ed27e-44b2-7462-b1ef-3564aa6c28ee/source.tar.gz' (2026-06-16)
  → 'https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.1027867%2Brev-d407951447dcd00442e97087bf374aad70c04cea/019f32d6-f801-7201-b6cb-59773d7eec95/source.tar.gz' (2026-07-05)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - uses: ./.

.github/workflows/release.yml

@@ -25,9 +25,7 @@ jobs:
           shorttag=$(echo "$VERSION" | cut -d'.' -f1)
           echo "shorttag=$shorttag" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Create the short tag
         env:
           SHORTTAG: ${{ steps.check_tag.outputs.shorttag }}

.github/workflows/zizmor.yml

@@ -15,7 +15,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

README.md

@@ -52,8 +52,8 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: DeterminateSystems/determinate-nix-action@main # or v3.21.1 to pin to a release
+      - uses: actions/checkout@v7.0.0
+      - uses: DeterminateSystems/determinate-nix-action@main # or v3.21.5 to pin to a release
       - run: nix build .
 ```
 
@@ -67,10 +67,10 @@ jobs:
 Unlike `DeterminateSystems/nix-installer-action`, we fully support explicit version pinning for maximum consistency.
 This Action is **automatically tagged** for every Determinate Nix release, giving you complete control over your CI environment:
 
-📍 Pinning to `DeterminateSystems/determinate-nix-action@v3.21.1` guarantees:
+📍 Pinning to `DeterminateSystems/determinate-nix-action@v3.21.5` guarantees:
 
 - Same `nix-installer-action` revision every time
-- Consistent Determinate Nix v3.21.1 installation
+- Consistent Determinate Nix v3.21.5 installation
 - Reproducible CI workflows, even years later
 
 ✨ Using `@main` instead? You'll:
@@ -97,7 +97,7 @@ updates:
 ## ️⚙️ Configuration
 
 | Parameter                 | Description                                                                                                                                                                                                                                                                    | Required | Default                    |
-|-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|----------------------------|
+|---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|----------------------------|
 | `extra-conf`              | Extra configuration lines for `/etc/nix/nix.conf` (includes `access-tokens` with `secrets.GITHUB_TOKEN` automatically if `github-token` is set)                                                                                                                                |          |                            |
 | `github-server-url`       | The URL for the GitHub server, to use with the `github-token` token. Defaults to the current GitHub server, supporting GitHub Enterprise Server automatically. Only change this value if the provided `github-token` is for a different GitHub server than the current server. |          | `${{ github.server_url }}` |
 | `github-token`            | A GitHub token for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests)                                                                                                                                                          |          | `${{ github.token }}`      |
@@ -113,8 +113,15 @@ updates:
 | `source-branch`           | The branch of `nix-installer` to use (conflicts with `source-tag`, `source-revision`, `source-pr`)                                                                                                                                                                             |          |                            |
 | `source-pr`               | The PR of `nix-installer` to use (conflicts with `source-tag`, `source-revision`, `source-branch`)                                                                                                                                                                             |          |                            |
 | `source-revision`         | The revision of `nix-installer` to use (conflicts with `source-tag`, `source-branch`, `source-pr`)                                                                                                                                                                             |          |                            |
-| `source-tag`            | The tag of `nix-installer` to use (conflicts with `source-revision`, `source-branch`, `source-pr`)                                                                                                                                                                             |          | `v3.21.1`                  |
+| `source-tag`              | The tag of `nix-installer` to use (conflicts with `source-revision`, `source-branch`, `source-pr`)                                                                                                                                                                             |          | `v3.21.5`                  |
 | `source-url`              | A URL pointing to a `nix-installer` executable                                                                                                                                                                                                                                 |          |                            |
+| `source-checksums-url`    | URL of a `shasum`-format checksums file listing the SHA-256 of each
+`nix-installer-<arch>-<os>` artifact. Used together with
+`source-checksums-sha256` to verify the downloaded installer.
+                                                                                    |          |                            |
+| `source-checksums-sha256` | Pinned SHA-256 (hex) of the file served at `source-checksums-url`. Must
+be set together with `source-checksums-url`.
+                                                                                                                                                          |          |                            |
 | `backtrace`               | The setting for `RUST_BACKTRACE` (see https://doc.rust-lang.org/std/backtrace/index.html#environment-variables)                                                                                                                                                                |          |                            |
 | `diagnostic-endpoint`     | Diagnostic endpoint url where the installer sends data to. To disable set this to an empty string.                                                                                                                                                                             |          | `-`                        |
 | `log-directives`          | A list of Tracing directives, comma separated, `-`s replaced with `_` (eg. `nix_installer=trace`, see https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#directives)                                                                    |          |                            |

action.yml

@@ -72,12 +72,20 @@
         "source-tag": {
             "description": "The tag of `nix-installer` to use (conflicts with `source-revision`, `source-branch`, `source-pr`)",
             "required": false,
-            "default": "v3.21.1"
+            "default": "v3.21.5"
         },
         "source-url": {
             "description": "A URL pointing to a `nix-installer` executable",
             "required": false
         },
+        "source-checksums-url": {
+            "description": "URL of a `shasum`-format checksums file listing the SHA-256 of each\n`nix-installer-<arch>-<os>` artifact. Used together with\n`source-checksums-sha256` to verify the downloaded installer.\n",
+            "required": false
+        },
+        "source-checksums-sha256": {
+            "description": "Pinned SHA-256 (hex) of the file served at `source-checksums-url`. Must\nbe set together with `source-checksums-url`.\n",
+            "required": false
+        },
         "backtrace": {
             "description": "The setting for `RUST_BACKTRACE` (see https://doc.rust-lang.org/std/backtrace/index.html#environment-variables)",
             "required": false
@@ -105,7 +113,7 @@
         "using": "composite",
         "steps": [
             {
-                "uses": "DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f",
+                "uses": "DeterminateSystems/nix-installer-action@a7ad9c4f0c65208097f4d34f3cfa1913b80cce5c",
                 "with": {
                     "extra-conf": "${{ inputs.extra-conf }}",
                     "github-server-url": "${{ inputs.github-server-url }}",
@@ -124,6 +132,8 @@
                     "source-revision": "${{ inputs.source-revision }}",
                     "source-tag": "${{ inputs.source-tag }}",
                     "source-url": "${{ inputs.source-url }}",
+                    "source-checksums-url": "${{ inputs.source-checksums-url }}",
+                    "source-checksums-sha256": "${{ inputs.source-checksums-sha256 }}",
                     "backtrace": "${{ inputs.backtrace }}",
                     "diagnostic-endpoint": "${{ inputs.diagnostic-endpoint }}",
                     "log-directives": "${{ inputs.log-directives }}",

flake.lock

@@ -2,12 +2,12 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780749050,
-        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
-        "revCount": 1011622,
+        "lastModified": 1783224372,
+        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
+        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "revCount": 1027867,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.1011622%2Brev-a799d3e3886da994fa307f817a6bc705ae538eeb/019ea4be-9303-7001-8232-6b7ec45c4f5b/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.1027867%2Brev-d407951447dcd00442e97087bf374aad70c04cea/019f32d6-f801-7201-b6cb-59773d7eec95/source.tar.gz"
       },
       "original": {
         "type": "tarball",

tools/generate.py

@@ -74,6 +74,8 @@ keep_inputs = [
     "source-revision",
     "source-tag",
     "source-url",
+    "source-checksums-url",
+    "source-checksums-sha256",
     # debugging
     "backtrace",
     "diagnostic-endpoint",

tools/state.json

@@ -1,5 +1,5 @@
 {
-  "nix_installer_action_revision": "1d87d45818068401a10cf16bdc5f00b24994a83f",
-  "determinate_nix_tag": "v3.21.1",
-  "checkout_action_tag": "v6.0.3"
+  "nix_installer_action_revision": "a7ad9c4f0c65208097f4d34f3cfa1913b80cce5c",
+  "determinate_nix_tag": "v3.21.5",
+  "checkout_action_tag": "v7.0.0"
 }