Pin GitHub Action refs, set certificate environment variables

.github/actions/setup/action.yml

@@ -19,27 +19,26 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Nix
-      uses: DeterminateSystems/nix-installer-action@v20
+    - name: Install Lix
+      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
       with:
-        source-url: "https://install.lix.systems/lix/lix-installer-${{ inputs.nix_system }}"
-        extra-conf: |
+        extra_nix_config: |
           accept-flake-config = true
           max-jobs = auto
     - name: Add SSH keys to ssh-agent
-      uses: webfactory/ssh-agent@v0.9.0
+      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
       with:
         ssh-private-key: |
           ${{ inputs.pragmatapro_deploy_key }}
           ${{ inputs.secrets_deploy_key }}
     - name: Setup Attic cache
-      uses: ryanccn/attic-action@v0
+      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
       with:
         endpoint: https://cache.e10.camp
         cache: tilde
         token: ${{ inputs.attic_token }}
     - name: Use Cachix store
-      uses: cachix/cachix-action@master
+      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
       with:
         authToken: ${{ inputs.cachix_auth_token }}
         installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix

.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: macos-15
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - uses: ./.github/actions/setup
         with:
           nix_system: aarch64-darwin
@@ -31,7 +31,7 @@ jobs:
           - macos-26
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - uses: ./.github/actions/setup
         with:
           nix_system: aarch64-darwin
@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - uses: ./.github/actions/setup
         with:
           nix_system: x86_64-linux

modules/profiles/home/certs.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }: {
+  home.sessionVariables = rec {
+    SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+    NIX_SSL_CERT_FILE = SSL_CERT_FILE;
+  };
+}

modules/profiles/home/tools/darwin.nix

@@ -1,3 +1,3 @@
 { pkgs, lib, ... }: {
-  home.packages = with pkgs; (lib.optionals stdenv.isDarwin [ mas ]);
+  home.packages = with pkgs; (lib.optionals stdenv.isDarwin [ cacert mas ]);
 }

modules/profiles/system/darwin/brew.nix

@@ -14,11 +14,8 @@
       "1password"
       "arc"
       "cleanshot"
-      "dash"
-      "docker-desktop"
       "elgato-stream-deck"
       "emacs-mac-spacemacs-icon"
-      # "ghostty"
       "fantastical"
       "firefox"
       "istat-menus"

modules/suites/home.nix

@@ -8,6 +8,7 @@ with profiles;
     atuin
     autojump
     bat
+    certs
     direnv
     fish
     fzf