From 7892b3cbe17ceb3a2b63d6a50eeae550ed95d59b Mon Sep 17 00:00:00 2001
From: Mohamed Boudra <boudra.moha@gmail.com>
Date: Thu, 26 Mar 2026 20:19:12 +0700
Subject: [PATCH] fix(nix): update stale npmDepsHash and auto-fix on all
 lockfile changes

Hash mismatch was hidden by continue-on-error. Now the Nix Build
workflow fails visibly, and fix-nix-hash runs on every push/PR that
touches the lockfile (not just Dependabot).
---
 .github/workflows/fix-nix-hash.yml | 8 ++++++--
 .github/workflows/nix-build.yml    | 2 +-
 nix/package.nix                    | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/fix-nix-hash.yml b/.github/workflows/fix-nix-hash.yml
index 939216a96..b5f0f7b1e 100644
--- a/.github/workflows/fix-nix-hash.yml
+++ b/.github/workflows/fix-nix-hash.yml
@@ -1,6 +1,11 @@
 name: Fix Nix hash
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - 'package.json'
+      - 'package-lock.json'
   pull_request:
     paths:
       - 'package.json'
@@ -12,11 +17,10 @@ permissions:
 jobs:
   fix-nix-hash:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.head_ref }}
+          ref: ${{ github.head_ref || github.ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/setup-node@v4
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index aab287463..949c67f30 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -32,7 +32,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    continue-on-error: true
+    continue-on-error: false
     steps:
       - uses: actions/checkout@v4
 
diff --git a/nix/package.nix b/nix/package.nix
index 8341a5659..0b0f4cfbb 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -42,7 +42,7 @@ buildNpmPackage rec {
 
   # To update: run `nix build` with lib.fakeHash, copy the `got:` hash.
   # CI auto-updates this when package-lock.json changes (see .github/workflows/).
-  npmDepsHash = "sha256-gOwvUBvem1SxDMypaexz6RaHRm2xFmUT9iwOW2ErEAM=";
+  npmDepsHash = "sha256-xj5pSRE/F8zvrOcVgc22bSHG4GTFzVHgB6eFSs+eI8Y=";
 
   # Prevent onnxruntime-node's install script from running during automatic
   # npm rebuild (it tries to download from api.nuget.org, which fails in the sandbox).