ci: address Copilot review on release workflow

- Use github.sha for checkout/build/cut-release refs instead of the
  invalid github.event.push.head.sha (empty on push events).
- Enable flakes via NIX_CONFIG for the whole nix-cache step so the kup
  build and its internal builds don't depend on flakes being globally
  enabled on the runner.
- check-cachix-pin.sh: tolerate transient pin-API errors (|| true +
  empty-response guard) so set -e no longer defeats the retry loop.
- Dockerfile: --no-install-recommends + drop apt lists, COPY instead of
  ADD, and pip install --no-cache-dir --user to keep the image lean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: RaoulSchaffranek

.github/scripts/check-cachix-pin.sh

@@ -49,7 +49,15 @@ PIN_VISIBILITY_TIMEOUT_SECONDS=120 # 2 minutes
 PIN_VISIBILITY_INTERVAL_SECONDS=5  # 5 seconds
 PIN_VISIBILITY_ATTEMPTS=$((PIN_VISIBILITY_TIMEOUT_SECONDS / PIN_VISIBILITY_INTERVAL_SECONDS))
 for i in $(seq 1 "$PIN_VISIBILITY_ATTEMPTS"); do
-  PIN_JSON="$(curl -fsSL "${PIN_API_URL}?q=${REV}")"
+  # `|| true` keeps `set -e` from aborting the whole script on a transient
+  # network/API hiccup: an empty/failed response is treated as not-ready and
+  # retried, rather than failing the release outright.
+  PIN_JSON="$(curl -fsSL "${PIN_API_URL}?q=${REV}" || true)"
+  if [ -z "$PIN_JSON" ]; then
+    printf 'cachix-check-attempt-%s: pin-api-unreachable, retrying in %ss\n' "$i" "$PIN_VISIBILITY_INTERVAL_SECONDS" | summary_and_log
+    sleep "$PIN_VISIBILITY_INTERVAL_SECONDS"
+    continue
+  fi
   ALL_OK=1
 
   for PKG in "${CHECK_PACKAGES[@]}"; do

.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
       - name: 'Check out code'
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.push.head.sha }}
+          ref: ${{ github.sha }}
           fetch-depth: 0
 
       # Build the komet-node derivation once, then push it to both the public
@@ -51,14 +51,18 @@ jobs:
         uses: workflow/nix-shell-action@v3
         env:
           GC_DONT_GC: '1'
+          # Enable flakes for every nix invocation in this step (the initial
+          # build, the kup build, and the builds kup runs internally) so the
+          # job does not depend on flakes being globally enabled on the runner.
+          NIX_CONFIG: 'extra-experimental-features = nix-command flakes'
           CACHIX_PUBLIC_TOKEN: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
           CACHIX_PRIVATE_KFB_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}'
           OWNER_REPO: '${{ github.repository }}'
           REV: '${{ github.sha }}'
         with:
           packages: jq
           script: |
-            KOMET_NODE=$(nix build --extra-experimental-features 'nix-command flakes' .#komet-node --json | jq -r '.[].outputs | to_entries[].value')
+            KOMET_NODE=$(nix build .#komet-node --json | jq -r '.[].outputs | to_entries[].value')
             DRV=$(nix-store --query --deriver ${KOMET_NODE})
 
             # Push the full build closure to the public k-framework cache.
@@ -93,7 +97,7 @@ jobs:
       - name: 'Check out code'
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.push.head.sha }}
+          ref: ${{ github.sha }}
           fetch-depth: 0
 
       - name: 'Set environment'
@@ -135,7 +139,7 @@ jobs:
       - name: 'Check out code'
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.push.head.sha }}
+          ref: ${{ github.sha }}
           fetch-depth: 0
 
       - name: 'Finalize Release'

Dockerfile

@@ -13,16 +13,17 @@ FROM runtimeverificationinc/kframework-k:ubuntu-jammy-${K_VERSION}
 
 ARG PYTHON_VERSION=3.10
 
-RUN    apt-get -y update             \
-    && apt-get -y install            \
-         curl                        \
-         git                         \
-         graphviz                    \
-         python${PYTHON_VERSION}     \
-         python${PYTHON_VERSION}-dev \
-         python3-pip                 \
-         wabt                        \
-    && apt-get -y clean
+RUN    apt-get -y update                            \
+    && apt-get -y install --no-install-recommends   \
+         curl                                       \
+         git                                        \
+         graphviz                                   \
+         python${PYTHON_VERSION}                    \
+         python${PYTHON_VERSION}-dev                \
+         python3-pip                                \
+         wabt                                       \
+    && apt-get -y clean                             \
+    && rm -rf /var/lib/apt/lists/*
 
 ARG USER_ID=1010
 ARG GROUP_ID=1010
@@ -32,12 +33,14 @@ RUN    groupadd -g ${GROUP_ID} user \
 USER user
 WORKDIR /home/user
 
-ADD --chown=user:user . komet-node
+COPY --chown=user:user . komet-node
 
 ENV PATH=/home/user/.local/bin:${PATH}
 # Installs komet-node together with its dependencies (the `komet` package, which
 # carries the Soroban K semantics source, and the matching `kframework` pyk).
-RUN    pip install ./komet-node \
+# `--user` installs into ~/.local (already on PATH) and `--no-cache-dir` keeps
+# pip's download cache out of the image layer.
+RUN    pip install --no-cache-dir --user ./komet-node \
     && rm -rf komet-node
 
 # Pre-kompile the K semantics so the container is ready to serve immediately.