From b5480a92f16dff6c3541779a283027a8cd4a9ad2 Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Mon, 2 Jun 2025 11:21:08 -0400
Subject: [PATCH 01/13] Update nix build to reflect recent changes on master

---
 flake.nix | 76 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/flake.nix b/flake.nix
index 5a06fab7f0..ad3de1f339 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,8 +43,84 @@
 
         isLinux = pkgs.stdenv.isLinux;
         isDarwin = pkgs.stdenv.isDarwin;
+        customRustPlatform = pkgs.makeRustPlatform {
+          cargo = rustToolchain;
+          rustc = rustToolchain;
+        };
       in
       {
+        packages.partner-chains = customRustPlatform.buildRustPackage rec {
+        pname = "partner-chains";
+        version = "1.7";
+        src = ./.;
+        # preBuild = ''
+        #   export SUBSTRATE_CLI_GIT_COMMIT_HASH=${dirtyShortRev or shortRev}
+        # '';
+
+        useFetchCargoVendor = true;
+        cargoHash = "sha256-evSP89WBwPl2jL43/ddZWyt+CgxRR9Xst1mGn8bKKgo=";
+        buildType = "production";
+        #buildAndTestSubdir = dir;
+        doCheck = false;
+        patches = [];
+
+        nativeBuildInputs = [
+          pkgs.pkg-config
+          pkgs.protobuf
+
+          pkgs.llvmPackages.lld
+          customRustPlatform.bindgenHook
+        ];
+        buildInputs = [
+          pkgs.rocksdb
+          pkgs.openssl
+          pkgs.libclang.lib
+        ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
+          pkgs.rust-jemalloc-sys-unprefixed
+        ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
+          pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
+          pkgs.darwin.apple_sdk.frameworks.Security
+        ];
+
+        postFixup = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
+          patchelf --set-rpath "${pkgs.rocksdb}/lib:${pkgs.stdenv.cc.cc.lib}/lib" $out/bin/partner-chains-demo-node
+        '';
+
+        # Force skip support check in CC crate
+        #CRATE_CC_NO_DEFAULTS = "1";
+
+        # Platform-specific features
+        RUSTFLAGS = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin
+          "--cfg unwinding_backport --cfg unwinding_apple";
+
+        # Existing environment variables
+        CC_ENABLE_DEBUG_OUTPUT = "1";
+        #CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_LINKER = "${pkgs.llvmPackages.lld}/bin/lld";
+        #RUST_SRC_PATH = "${customRustPlatform.rustLibSrc}";
+        LIBCLANG_PATH = "${pkgs.libclang.lib}/lib";
+        LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
+          rustToolchain
+          pkgs.stdenv.cc.cc
+          pkgs.libz
+          pkgs.clang
+        ];
+
+        # Platform-specific flags
+        CFLAGS =
+          if pkgs.lib.hasSuffix "linux" system then
+            "-DJEMALLOC_STRERROR_R_RETURNS_CHAR_WITH_GNU_SOURCE"
+          else
+            "";
+
+        PROTOC = "${pkgs.protobuf}/bin/protoc";
+        ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib/";
+        OPENSSL_NO_VENDOR = 1;
+        OPENSSL_DIR = "${pkgs.openssl.dev}";
+        OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
+        OPENSSL_LIB_DIR = "${pkgs.openssl.out}/lib";
+        BINDGEN_EXTRA_CLANG_ARGS = "-I${pkgs.stdenv.cc.cc}/include -std=c++17";
+
+      };
         devShells.default = pkgs.mkShell {
           packages =
             with pkgs;

From 4a62e65b7b0e6c5eaf467afcc830d38c4a4454f0 Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Wed, 9 Jul 2025 12:09:58 -0400
Subject: [PATCH 02/13] fix: update sha

---
 flake.nix           | 2 +-
 rust-toolchain.toml | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index ad3de1f339..82b702982a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -58,7 +58,7 @@
         # '';
 
         useFetchCargoVendor = true;
-        cargoHash = "sha256-evSP89WBwPl2jL43/ddZWyt+CgxRR9Xst1mGn8bKKgo=";
+        cargoHash = "sha256-Kg8Z4IWJZ2Ml70JUf8dmIYI6QSYVflq+0lCk790taAc=";
         buildType = "production";
         #buildAndTestSubdir = dir;
         doCheck = false;
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 524028cd1d..20fddf9a26 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -4,8 +4,6 @@ components = [
 	"cargo",
 	"clippy",
 	"rust-analyzer",
-	"rust-src",
-	"rust-std",
 	"rustc-dev",
 	"rustc",
 	"rustfmt",

From 1d050f01799313b6c344389135dceed9bcdb8d64 Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Tue, 15 Jul 2025 16:59:58 -0400
Subject: [PATCH 03/13] feat: switch from cargoHash to cargoLock

---
 flake.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index 82b702982a..92a4f38fcd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -57,8 +57,15 @@
         #   export SUBSTRATE_CLI_GIT_COMMIT_HASH=${dirtyShortRev or shortRev}
         # '';
 
-        useFetchCargoVendor = true;
-        cargoHash = "sha256-Kg8Z4IWJZ2Ml70JUf8dmIYI6QSYVflq+0lCk790taAc=";
+        useFetchCargoVendor = false;
+        #cargoHash = "sha256-Kg8Z4IWJZ2Ml70JUf8dmIYI6QSYVflq+0lCk790taAc=";
+        cargoLock = {
+          lockFile = ./Cargo.lock;
+          outputHashes = {
+            "binary-merkle-tree-16.0.0" = "sha256-Yt0KWRMOG53hxdMZvYA60hQ4Vsfkk1R5lv+dd+mzcNI=";
+            "raw-scripts-7.2.1" = "sha256-HTi/mubyBz7dAeLXekexikZZaOHkoI32oUQgmnFe2YM=";
+          };
+        };
         buildType = "production";
         #buildAndTestSubdir = dir;
         doCheck = false;

From d3c5164054bfbf935a1ad12dda0df5d16b64c1a4 Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Tue, 15 Jul 2025 18:17:33 -0400
Subject: [PATCH 04/13] fix: read version from Cargo manifest

---
 flake.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/flake.nix b/flake.nix
index 92a4f38fcd..47966804b9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -24,6 +24,7 @@
 
   outputs =
     {
+      self,
       nixpkgs,
       fenix,
       flake-utils,
@@ -51,14 +52,13 @@
       {
         packages.partner-chains = customRustPlatform.buildRustPackage rec {
         pname = "partner-chains";
-        version = "1.7";
+        version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;
         src = ./.;
-        # preBuild = ''
-        #   export SUBSTRATE_CLI_GIT_COMMIT_HASH=${dirtyShortRev or shortRev}
-        # '';
+        preBuild = ''
+          export SUBSTRATE_CLI_GIT_COMMIT_HASH=${self.dirtyShortRev or self.shortRev}
+        '';
 
         useFetchCargoVendor = false;
-        #cargoHash = "sha256-Kg8Z4IWJZ2Ml70JUf8dmIYI6QSYVflq+0lCk790taAc=";
         cargoLock = {
           lockFile = ./Cargo.lock;
           outputHashes = {
@@ -67,7 +67,6 @@
           };
         };
         buildType = "production";
-        #buildAndTestSubdir = dir;
         doCheck = false;
         patches = [];
 

From cd42b348784d078b28fe714b28444201b74ac172 Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Wed, 16 Jul 2025 14:17:17 -0400
Subject: [PATCH 05/13] fix: don't clean up some essential files

---
 flake.lock |  16 ++++
 flake.nix  | 269 +++++++++++++++++++++++++++++------------------------
 2 files changed, 165 insertions(+), 120 deletions(-)

diff --git a/flake.lock b/flake.lock
index cbb431a1d8..ce6b909b85 100644
--- a/flake.lock
+++ b/flake.lock
@@ -17,6 +17,21 @@
         "type": "github"
       }
     },
+    "crane": {
+      "locked": {
+        "lastModified": 1752625801,
+        "narHash": "sha256-T1XWEFfw+iNrvlRczZS4BkaZJ5W3Z2Xp+31P2IShJj8=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "471f8cd756349f4e86784ea10fdc9ccb91711fca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "fenix": {
       "inputs": {
         "nixpkgs": [
@@ -92,6 +107,7 @@
     "root": {
       "inputs": {
         "cardano-node": "cardano-node",
+        "crane": "crane",
         "fenix": "fenix",
         "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
diff --git a/flake.nix b/flake.nix
index 47966804b9..722832c72e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,8 +1,13 @@
 {
-  description = "Your devShell environment using flake-utils";
+  description = "Partner Chains - A Substrate-based blockchain with Cardano integration";
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    
+    crane = {
+      url = "github:ipetkov/crane";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     fenix = {
       url = "github:nix-community/fenix";
@@ -22,139 +27,163 @@
     };
   };
 
-  outputs =
-    {
-      self,
-      nixpkgs,
-      fenix,
-      flake-utils,
-      ...
-    }:
-    flake-utils.lib.eachDefaultSystem (
-      system:
+  outputs = { self, nixpkgs, crane, fenix, flake-utils, ... }:
+    flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = import nixpkgs {
           inherit system;
           config.allowUnfree = true;
         };
+
         rustToolchain = fenix.packages.${system}.fromToolchainFile {
           file = ./rust-toolchain.toml;
           sha256 = "SJwZ8g0zF2WrKDVmHrVG3pD2RGoQeo24MEXnNx5FyuI=";
         };
 
-        isLinux = pkgs.stdenv.isLinux;
-        isDarwin = pkgs.stdenv.isDarwin;
-        customRustPlatform = pkgs.makeRustPlatform {
-          cargo = rustToolchain;
-          rustc = rustToolchain;
-        };
-      in
-      {
-        packages.partner-chains = customRustPlatform.buildRustPackage rec {
-        pname = "partner-chains";
-        version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;
-        src = ./.;
-        preBuild = ''
-          export SUBSTRATE_CLI_GIT_COMMIT_HASH=${self.dirtyShortRev or self.shortRev}
-        '';
-
-        useFetchCargoVendor = false;
-        cargoLock = {
-          lockFile = ./Cargo.lock;
-          outputHashes = {
-            "binary-merkle-tree-16.0.0" = "sha256-Yt0KWRMOG53hxdMZvYA60hQ4Vsfkk1R5lv+dd+mzcNI=";
-            "raw-scripts-7.2.1" = "sha256-HTi/mubyBz7dAeLXekexikZZaOHkoI32oUQgmnFe2YM=";
+        craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
+
+        # Common build inputs for all targets
+        commonArgs = {
+          src = pkgs.lib.cleanSourceWith {
+            src = self;
+            filter = path: type:
+              # Include all files that crane normally includes
+              (craneLib.filterCargoSources path type) ||
+              # Also include examples directories and JSON files
+              (pkgs.lib.hasSuffix "examples" path) ||
+              (pkgs.lib.hasSuffix ".json" path);
           };
-        };
-        buildType = "production";
-        doCheck = false;
-        patches = [];
-
-        nativeBuildInputs = [
-          pkgs.pkg-config
-          pkgs.protobuf
-
-          pkgs.llvmPackages.lld
-          customRustPlatform.bindgenHook
-        ];
-        buildInputs = [
-          pkgs.rocksdb
-          pkgs.openssl
-          pkgs.libclang.lib
-        ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
-          pkgs.rust-jemalloc-sys-unprefixed
-        ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
-          pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
-          pkgs.darwin.apple_sdk.frameworks.Security
-        ];
-
-        postFixup = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
-          patchelf --set-rpath "${pkgs.rocksdb}/lib:${pkgs.stdenv.cc.cc.lib}/lib" $out/bin/partner-chains-demo-node
-        '';
-
-        # Force skip support check in CC crate
-        #CRATE_CC_NO_DEFAULTS = "1";
-
-        # Platform-specific features
-        RUSTFLAGS = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin
-          "--cfg unwinding_backport --cfg unwinding_apple";
-
-        # Existing environment variables
-        CC_ENABLE_DEBUG_OUTPUT = "1";
-        #CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_LINKER = "${pkgs.llvmPackages.lld}/bin/lld";
-        #RUST_SRC_PATH = "${customRustPlatform.rustLibSrc}";
-        LIBCLANG_PATH = "${pkgs.libclang.lib}/lib";
-        LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
-          rustToolchain
-          pkgs.stdenv.cc.cc
-          pkgs.libz
-          pkgs.clang
-        ];
-
-        # Platform-specific flags
-        CFLAGS =
-          if pkgs.lib.hasSuffix "linux" system then
+          
+          # Build inputs
+          buildInputs = with pkgs; [
+            openssl
+            libclang.lib
+          ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
+            pkgs.rust-jemalloc-sys-unprefixed
+          ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
+            pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
+            pkgs.darwin.apple_sdk.frameworks.Security
+          ];
+
+          # Native build inputs
+          nativeBuildInputs = with pkgs; [
+            pkg-config
+            protobuf
+            llvmPackages.lld
+          ];
+
+          # Environment variables
+          CC_ENABLE_DEBUG_OUTPUT = "1";
+          LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
+            rustToolchain
+            pkgs.stdenv.cc.cc
+            pkgs.libz
+            pkgs.clang
+          ];
+          
+          # Bindgen configuration
+          BINDGEN_EXTRA_CLANG_ARGS = "-I${pkgs.glibc.dev}/include -I${pkgs.clang.cc.lib}/lib/clang/19/include";
+          LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
+
+          # Platform-specific flags
+          CFLAGS = if pkgs.lib.hasSuffix "linux" system then
             "-DJEMALLOC_STRERROR_R_RETURNS_CHAR_WITH_GNU_SOURCE"
           else
             "";
 
-        PROTOC = "${pkgs.protobuf}/bin/protoc";
-        ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib/";
-        OPENSSL_NO_VENDOR = 1;
-        OPENSSL_DIR = "${pkgs.openssl.dev}";
-        OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
-        OPENSSL_LIB_DIR = "${pkgs.openssl.out}/lib";
-        BINDGEN_EXTRA_CLANG_ARGS = "-I${pkgs.stdenv.cc.cc}/include -std=c++17";
+          PROTOC = "${pkgs.protobuf}/bin/protoc";
+          doCheck = false;
+          #C_INCLUDE_PATH = "${pkgs.clang.cc.lib}/lib/clang/19/include";
+          
+          # RocksDB configuration - use system library
+          ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib/";
+          OPENSSL_NO_VENDOR = 1;
+          OPENSSL_DIR = "${pkgs.openssl.dev}";
+          OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
+          OPENSSL_LIB_DIR = "${pkgs.openssl.out}/lib";
+
+          # Platform-specific RUSTFLAGS
+          RUSTFLAGS = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin
+            "--cfg unwinding_backport --cfg unwinding_apple";
+
+          # Git commit hash for Substrate CLI
+          SUBSTRATE_CLI_GIT_COMMIT_HASH = self.dirtyShortRev or self.shortRev;
+        };
+
+        # Build the workspace dependencies
+        cargoArtifacts = craneLib.buildDepsOnly (commonArgs // {
+          pname = "partner-chains-deps";
+        });
+
+        # Build the main binary
+        partner-chains = craneLib.buildPackage (commonArgs // {
+          pname = "partner-chains";
+          version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;
+          
+          inherit cargoArtifacts;
+          
+          # Post-fixup for Linux
+          postFixup = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
+            patchelf --set-rpath "${pkgs.rocksdb}/lib:${pkgs.stdenv.cc.cc.lib}/lib" $out/bin/partner-chains-demo-node
+          '';
+        });
+
+        # Run tests
+        cargoTest = craneLib.cargoTest (commonArgs // {
+          inherit cargoArtifacts;
+        });
+
+        # Run clippy
+        cargoClippy = craneLib.cargoClippy (commonArgs // {
+          inherit cargoArtifacts;
+          cargoClippyExtraArgs = "--all-targets -- --deny warnings";
+        });
+
+        # Run fmt check
+        cargoFmt = craneLib.cargoFmt {
+          inherit (commonArgs) src;
+        };
+
+      in
+      {
+        checks = {
+          # Build the crate as part of `nix flake check`
+          inherit partner-chains cargoTest cargoClippy cargoFmt;
+        };
+
+        packages = {
+          default = partner-chains;
+          inherit partner-chains;
+        };
 
-      };
         devShells.default = pkgs.mkShell {
-          packages =
-            with pkgs;
-            [
-              awscli2
-              bashInteractive
-              cargo-edit
-              cargo-license
-              coreutils
-              docker-compose
-              earthly
-              gawk
-              gnumake
-              kubectl
-              libiconv
-              nixfmt-rfc-style
-              openssl
-              patchelf
-              pkg-config
-              protobuf
-              python312
-              python312Packages.pip
-              python312Packages.virtualenv
-              rustToolchain
-              sops
-              xxd
-            ]
-            ++ (if isDarwin then [ pkgs.darwin.apple_sdk.frameworks.SystemConfiguration ] else [ pkgs.clang ]);
+          packages = with pkgs; [
+            awscli2
+            bashInteractive
+            cargo-edit
+            cargo-license
+            coreutils
+            docker-compose
+            earthly
+            gawk
+            gnumake
+            kubectl
+            libiconv
+            nixfmt-rfc-style
+            openssl
+            patchelf
+            pkg-config
+            protobuf
+            python312
+            python312Packages.pip
+            python312Packages.virtualenv
+            rustToolchain
+            sops
+            xxd
+          ] ++ (if pkgs.stdenv.hostPlatform.isDarwin then 
+            [ pkgs.darwin.apple_sdk.frameworks.SystemConfiguration ] 
+          else 
+            [ pkgs.clang ]);
 
           shellHook = ''
             export RUST_SRC_PATH="${rustToolchain}/lib/rustlib/src/rust/library"
@@ -174,12 +203,12 @@
 
             export PYTHONNOUSERSITE=1
             export CRATE_CC_NO_DEFAULTS=1
-            ${if isLinux then "export CFLAGS=-DJEMALLOC_STRERROR_R_RETURNS_CHAR_WITH_GNU_SOURCE" else ""}
+            ${if pkgs.stdenv.hostPlatform.isLinux then "export CFLAGS=-DJEMALLOC_STRERROR_R_RETURNS_CHAR_WITH_GNU_SOURCE" else ""}
           '';
         };
+
         formatter = pkgs.nixfmt-rfc-style;
-      }
-    );
+      });
 
   nixConfig = {
     allow-import-from-derivation = true;

From 44a06c8679ab31ba1ff2d1d62f2aa377a257c130 Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Wed, 16 Jul 2025 15:42:55 -0400
Subject: [PATCH 06/13] fix: add flag for build on macos

---
 flake.nix | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/flake.nix b/flake.nix
index 722832c72e..7f25828b26 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,7 +54,6 @@
               (pkgs.lib.hasSuffix ".json" path);
           };
           
-          # Build inputs
           buildInputs = with pkgs; [
             openssl
             libclang.lib
@@ -65,7 +64,6 @@
             pkgs.darwin.apple_sdk.frameworks.Security
           ];
 
-          # Native build inputs
           nativeBuildInputs = with pkgs; [
             pkg-config
             protobuf
@@ -74,6 +72,7 @@
 
           # Environment variables
           CC_ENABLE_DEBUG_OUTPUT = "1";
+          CRATE_CC_NO_DEFAULTS = 1;
           LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
             rustToolchain
             pkgs.stdenv.cc.cc
@@ -81,8 +80,7 @@
             pkgs.clang
           ];
           
-          # Bindgen configuration
-          BINDGEN_EXTRA_CLANG_ARGS = "-I${pkgs.glibc.dev}/include -I${pkgs.clang.cc.lib}/lib/clang/19/include";
+          BINDGEN_EXTRA_CLANG_ARGS = if pkgs.lib.hasSuffix "linux" system then "-I${pkgs.glibc.dev}/include -I${pkgs.clang.cc.lib}/lib/clang/19/include" else "";
           LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
 
           # Platform-specific flags
@@ -102,12 +100,9 @@
           OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
           OPENSSL_LIB_DIR = "${pkgs.openssl.out}/lib";
 
-          # Platform-specific RUSTFLAGS
           RUSTFLAGS = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin
             "--cfg unwinding_backport --cfg unwinding_apple";
 
-          # Git commit hash for Substrate CLI
-          SUBSTRATE_CLI_GIT_COMMIT_HASH = self.dirtyShortRev or self.shortRev;
         };
 
         # Build the workspace dependencies
@@ -121,8 +116,10 @@
           version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;
           
           inherit cargoArtifacts;
+
+          # Git commit hash for Substrate CLI
+          SUBSTRATE_CLI_GIT_COMMIT_HASH = self.dirtyShortRev or self.shortRev;
           
-          # Post-fixup for Linux
           postFixup = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
             patchelf --set-rpath "${pkgs.rocksdb}/lib:${pkgs.stdenv.cc.cc.lib}/lib" $out/bin/partner-chains-demo-node
           '';

From 8925496d398415c058f353d4a067f97aa9367fbf Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Thu, 17 Jul 2025 13:33:15 -0400
Subject: [PATCH 07/13] chore: cleanup envs used in multiple places

---
 flake.nix | 132 ++++++++++++++++++++++--------------------------------
 1 file changed, 53 insertions(+), 79 deletions(-)

diff --git a/flake.nix b/flake.nix
index 7f25828b26..795c18d8f2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,10 +4,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     
-    crane = {
-      url = "github:ipetkov/crane";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    crane.url = "github:ipetkov/crane";
 
     fenix = {
       url = "github:nix-community/fenix";
@@ -42,35 +39,7 @@
 
         craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
 
-        # Common build inputs for all targets
-        commonArgs = {
-          src = pkgs.lib.cleanSourceWith {
-            src = self;
-            filter = path: type:
-              # Include all files that crane normally includes
-              (craneLib.filterCargoSources path type) ||
-              # Also include examples directories and JSON files
-              (pkgs.lib.hasSuffix "examples" path) ||
-              (pkgs.lib.hasSuffix ".json" path);
-          };
-          
-          buildInputs = with pkgs; [
-            openssl
-            libclang.lib
-          ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
-            pkgs.rust-jemalloc-sys-unprefixed
-          ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
-            pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
-            pkgs.darwin.apple_sdk.frameworks.Security
-          ];
-
-          nativeBuildInputs = with pkgs; [
-            pkg-config
-            protobuf
-            llvmPackages.lld
-          ];
-
-          # Environment variables
+        shellEnv = {
           CC_ENABLE_DEBUG_OUTPUT = "1";
           CRATE_CC_NO_DEFAULTS = 1;
           LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
@@ -83,14 +52,12 @@
           BINDGEN_EXTRA_CLANG_ARGS = if pkgs.lib.hasSuffix "linux" system then "-I${pkgs.glibc.dev}/include -I${pkgs.clang.cc.lib}/lib/clang/19/include" else "";
           LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
 
-          # Platform-specific flags
           CFLAGS = if pkgs.lib.hasSuffix "linux" system then
             "-DJEMALLOC_STRERROR_R_RETURNS_CHAR_WITH_GNU_SOURCE"
           else
             "";
 
           PROTOC = "${pkgs.protobuf}/bin/protoc";
-          doCheck = false;
           #C_INCLUDE_PATH = "${pkgs.clang.cc.lib}/lib/clang/19/include";
           
           # RocksDB configuration - use system library
@@ -102,22 +69,50 @@
 
           RUSTFLAGS = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin
             "--cfg unwinding_backport --cfg unwinding_apple";
-
         };
 
-        # Build the workspace dependencies
+        # Common build inputs for all targets
+        commonArgs = {
+          pname = "partner-chains-demo-node"; 
+          src = pkgs.lib.cleanSourceWith {
+            src = self;
+            filter = path: type:
+              (craneLib.filterCargoSources path type) ||
+              (pkgs.lib.hasSuffix "examples" path) ||
+              (pkgs.lib.hasSuffix ".json" path);
+          };
+          
+          buildInputs = with pkgs; [
+            openssl
+            libclang.lib
+          ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
+            pkgs.rust-jemalloc-sys-unprefixed
+          ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
+            pkgs.darwin.apple_sdk.frameworks.SystemConfiguration
+            pkgs.darwin.apple_sdk.frameworks.Security
+          ];
+
+          nativeBuildInputs = with pkgs; [
+            pkg-config
+            protobuf
+            llvmPackages.lld
+          ];
+
+          doCheck = false;
+        } // shellEnv;
+
+        # Build the workspace dependencies separately
         cargoArtifacts = craneLib.buildDepsOnly (commonArgs // {
-          pname = "partner-chains-deps";
+          pname = "partner-chains-demo-node-deps";
         });
 
-        # Build the main binary
-        partner-chains = craneLib.buildPackage (commonArgs // {
-          pname = "partner-chains";
+        partner-chains-demo-node = craneLib.buildPackage (commonArgs // {
+          pname = "partner-chains-demo-node";
           version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;
           
           inherit cargoArtifacts;
 
-          # Git commit hash for Substrate CLI
+          # Git commit hash for partner-chains CLI --version flag
           SUBSTRATE_CLI_GIT_COMMIT_HASH = self.dirtyShortRev or self.shortRev;
           
           postFixup = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
@@ -125,35 +120,36 @@
           '';
         });
 
-        # Run tests
         cargoTest = craneLib.cargoTest (commonArgs // {
           inherit cargoArtifacts;
         });
 
-        # Run clippy
         cargoClippy = craneLib.cargoClippy (commonArgs // {
           inherit cargoArtifacts;
           cargoClippyExtraArgs = "--all-targets -- --deny warnings";
         });
 
-        # Run fmt check
         cargoFmt = craneLib.cargoFmt {
-          inherit (commonArgs) src;
+          inherit (commonArgs) pname src;
         };
 
       in
       {
-        checks = {
+        checks = { 
           # Build the crate as part of `nix flake check`
-          inherit partner-chains cargoTest cargoClippy cargoFmt;
+          inherit partner-chains-demo-node cargoTest cargoClippy cargoFmt;
         };
 
         packages = {
-          default = partner-chains;
-          inherit partner-chains;
+          default = partner-chains-demo-node;
+          inherit partner-chains-demo-node;
         };
+        devShells.default = craneLib.devShell ({
+          name = "partner-chains-demo-node-shell";
+          # Inherit inputs from checks, which pulls in the build environment from packages.default (and others)
+          checks = self.checks.${system};
 
-        devShells.default = pkgs.mkShell {
+          # Extra packages for the dev shell
           packages = with pkgs; [
             awscli2
             bashInteractive
@@ -161,7 +157,6 @@
             cargo-license
             coreutils
             docker-compose
-            earthly
             gawk
             gnumake
             kubectl
@@ -177,32 +172,11 @@
             rustToolchain
             sops
             xxd
-          ] ++ (if pkgs.stdenv.hostPlatform.isDarwin then 
-            [ pkgs.darwin.apple_sdk.frameworks.SystemConfiguration ] 
-          else 
-            [ pkgs.clang ]);
-
-          shellHook = ''
-            export RUST_SRC_PATH="${rustToolchain}/lib/rustlib/src/rust/library"
-            export LIBCLANG_PATH="${pkgs.libclang.lib}/lib"
-            export LD_LIBRARY_PATH="${
-              pkgs.lib.makeLibraryPath [
-                rustToolchain
-                pkgs.libz
-                pkgs.stdenv.cc.cc
-              ]
-            }"
-
-            export OPENSSL_NO_VENDOR=1
-            export OPENSSL_DIR="${pkgs.openssl.dev}"
-            export OPENSSL_INCLUDE_DIR="${pkgs.openssl.dev}/include"
-            export OPENSSL_LIB_DIR="${pkgs.openssl.out}/lib"
-
-            export PYTHONNOUSERSITE=1
-            export CRATE_CC_NO_DEFAULTS=1
-            ${if pkgs.stdenv.hostPlatform.isLinux then "export CFLAGS=-DJEMALLOC_STRERROR_R_RETURNS_CHAR_WITH_GNU_SOURCE" else ""}
-          '';
-        };
+          ] ++ (if pkgs.stdenv.hostPlatform.isDarwin then
+            [ pkgs.darwin.apple_sdk.frameworks.SystemConfiguration ]
+          else
+            [pkgs.clang]);
+        } // shellEnv);
 
         formatter = pkgs.nixfmt-rfc-style;
       });
@@ -221,4 +195,4 @@
       "cache.sc.iog.io:b4YIcBabCEVKrLQgGW8Fylz4W8IvvfzRc+hy0idqrWU="
     ];
   };
-}
+}
\ No newline at end of file

From 6faf13b85780dc38dcb13581607c9021bc96b2a9 Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Tue, 18 Nov 2025 14:30:07 -0500
Subject: [PATCH 08/13] fix: cleanup substrate source and fix build

---
 flake.lock          |  57 ++++++++-------------
 flake.nix           | 118 +++++++++++++++++++++++++++-----------------
 rust-toolchain.toml |   2 +
 3 files changed, 97 insertions(+), 80 deletions(-)

diff --git a/flake.lock b/flake.lock
index ce6b909b85..17e8cc4955 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,22 +1,5 @@
 {
   "nodes": {
-    "cardano-node": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1736202991,
-        "narHash": "sha256-Oys38YkpSpB48/H2NseP9kTWXm92a7kjAZtdnorcIEY=",
-        "owner": "IntersectMBO",
-        "repo": "cardano-node",
-        "rev": "1f63dbf2ab39e0b32bf6901dc203866d3e37de08",
-        "type": "github"
-      },
-      "original": {
-        "owner": "IntersectMBO",
-        "ref": "10.1.4",
-        "repo": "cardano-node",
-        "type": "github"
-      }
-    },
     "crane": {
       "locked": {
         "lastModified": 1752625801,
@@ -53,23 +36,6 @@
         "type": "github"
       }
     },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1647532380,
-        "narHash": "sha256-wswAxyO8AJTH7d5oU8VK82yBCpqwA+p6kLgpb1f1PAY=",
-        "owner": "input-output-hk",
-        "repo": "flake-compat",
-        "rev": "7da118186435255a30b5ffeabba9629c344c0bec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "input-output-hk",
-        "ref": "fixes",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -88,6 +54,26 @@
         "type": "github"
       }
     },
+    "n2c": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1761716996,
+        "narHash": "sha256-vdOuy2pid2/DasUgb08lDOswdPJkN5qjXfBYItVy/R4=",
+        "owner": "nlewo",
+        "repo": "nix2container",
+        "rev": "e5496ab66e9de9e3f67dc06f692dfbc471b6316e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nlewo",
+        "repo": "nix2container",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1739866667,
@@ -106,11 +92,10 @@
     },
     "root": {
       "inputs": {
-        "cardano-node": "cardano-node",
         "crane": "crane",
         "fenix": "fenix",
-        "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
+        "n2c": "n2c",
         "nixpkgs": "nixpkgs"
       }
     },
diff --git a/flake.nix b/flake.nix
index 795c18d8f2..0f0832bd1d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -13,18 +13,13 @@
 
     flake-utils.url = "github:numtide/flake-utils";
 
-    cardano-node = {
-      url = "github:IntersectMBO/cardano-node/10.1.4";
-      flake = false;
-    };
-
-    flake-compat = {
-      url = "github:input-output-hk/flake-compat/fixes";
-      flake = false;
+    n2c = {
+      url = "github:nlewo/nix2container";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
-  outputs = { self, nixpkgs, crane, fenix, flake-utils, ... }:
+  outputs = { self, nixpkgs, crane, fenix, flake-utils, n2c, ... }:
     flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = import nixpkgs {
@@ -49,7 +44,9 @@
             pkgs.clang
           ];
           
-          BINDGEN_EXTRA_CLANG_ARGS = if pkgs.lib.hasSuffix "linux" system then "-I${pkgs.glibc.dev}/include -I${pkgs.clang.cc.lib}/lib/clang/19/include" else "";
+          BINDGEN_EXTRA_CLANG_ARGS = if pkgs.lib.hasSuffix "linux" system
+                                     then "-I${pkgs.glibc.dev}/include -I${pkgs.clang.cc.lib}/lib/clang/19/include"
+                                     else "";
           LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
 
           CFLAGS = if pkgs.lib.hasSuffix "linux" system then
@@ -59,9 +56,7 @@
 
           PROTOC = "${pkgs.protobuf}/bin/protoc";
           #C_INCLUDE_PATH = "${pkgs.clang.cc.lib}/lib/clang/19/include";
-          
-          # RocksDB configuration - use system library
-          ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib/";
+
           OPENSSL_NO_VENDOR = 1;
           OPENSSL_DIR = "${pkgs.openssl.dev}";
           OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
@@ -73,18 +68,24 @@
 
         # Common build inputs for all targets
         commonArgs = {
-          pname = "partner-chains-demo-node"; 
-          src = pkgs.lib.cleanSourceWith {
-            src = self;
-            filter = path: type:
+          pname = "partner-chains-demo-node";
+          # Clean the project directory so that the nix hash
+          # doesn't change when unrelated files to builds update
+          src = let
+            jsonFilter = path: _type: builtins.match ".*\\.json$" path != null;
+            combinedFilter = path: type:
               (craneLib.filterCargoSources path type) ||
-              (pkgs.lib.hasSuffix "examples" path) ||
-              (pkgs.lib.hasSuffix ".json" path);
+              (jsonFilter path type);
+          in pkgs.lib.cleanSourceWith {
+            src = self;
+            filter = combinedFilter;
+            name = "source";
           };
           
           buildInputs = with pkgs; [
             openssl
             libclang.lib
+            stdenv.cc.cc.lib
           ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [
             pkgs.rust-jemalloc-sys-unprefixed
           ] ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
@@ -96,28 +97,42 @@
             pkg-config
             protobuf
             llvmPackages.lld
+            autoPatchelfHook
           ];
 
           doCheck = false;
         } // shellEnv;
 
+        cargoVendorDir = craneLib.vendorCargoDeps {
+          inherit (commonArgs) src;
+          # Remove fixture and example directories from Polkadot SDK, don't want them vendored/checked
+          # https://github.com/paritytech/polkadot-sdk/blob/polkadot-stable2412-1/.github/workflows/checks-quick.yml#L91-L97
+          overrideVendorGitCheckout = let
+            isPolkadotSdk = p: pkgs.lib.hasPrefix "git+https://github.com/paritytech/polkadot-sdk.git" p.source;
+          in ps: drv:
+            if pkgs.lib.any (p: isPolkadotSdk p) ps then
+              drv.overrideAttrs {
+                postPatch = ''
+                  rm -rf substrate/frame/contracts/fixtures/build || true
+                  rm -rf substrate/frame/contracts/fixtures/contracts/common || true
+                  rm -rf substrate/primitives/state-machine/fuzz || true
+                '';
+              }
+            else
+              drv;
+          };
         # Build the workspace dependencies separately
         cargoArtifacts = craneLib.buildDepsOnly (commonArgs // {
-          pname = "partner-chains-demo-node-deps";
+          inherit cargoVendorDir;
         });
 
         partner-chains-demo-node = craneLib.buildPackage (commonArgs // {
           pname = "partner-chains-demo-node";
           version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;
-          
           inherit cargoArtifacts;
 
           # Git commit hash for partner-chains CLI --version flag
-          SUBSTRATE_CLI_GIT_COMMIT_HASH = self.dirtyShortRev or self.shortRev;
-          
-          postFixup = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
-            patchelf --set-rpath "${pkgs.rocksdb}/lib:${pkgs.stdenv.cc.cc.lib}/lib" $out/bin/partner-chains-demo-node
-          '';
+          SUBSTRATE_CLI_GIT_COMMIT_HASH = "dev"; # self.dirtyShortRev or self.shortRev;
         });
 
         cargoTest = craneLib.cargoTest (commonArgs // {
@@ -126,31 +141,20 @@
 
         cargoClippy = craneLib.cargoClippy (commonArgs // {
           inherit cargoArtifacts;
-          cargoClippyExtraArgs = "--all-targets -- --deny warnings";
         });
 
         cargoFmt = craneLib.cargoFmt {
           inherit (commonArgs) pname src;
         };
 
-      in
-      {
-        checks = { 
-          # Build the crate as part of `nix flake check`
-          inherit partner-chains-demo-node cargoTest cargoClippy cargoFmt;
-        };
-
-        packages = {
-          default = partner-chains-demo-node;
-          inherit partner-chains-demo-node;
-        };
-        devShells.default = craneLib.devShell ({
+        devShell = craneLib.devShell ({
           name = "partner-chains-demo-node-shell";
-          # Inherit inputs from checks, which pulls in the build environment from packages.default (and others)
-          checks = self.checks.${system};
+          # Inherit inputs from other build artifacts
+          inputsFrom = [ partner-chains-demo-node ];
 
           # Extra packages for the dev shell
           packages = with pkgs; [
+            attic-client
             awscli2
             bashInteractive
             cargo-edit
@@ -178,6 +182,32 @@
             [pkgs.clang]);
         } // shellEnv);
 
+      in { # Main flake outputs section
+        checks = {
+          # Build the crate as part of `nix flake check'
+          inherit partner-chains-demo-node cargoTest cargoFmt devShell;
+        };
+
+        packages = {
+          inherit partner-chains-demo-node;
+          default = partner-chains-demo-node;
+          oci-image = n2c.packages.${system}.nix2container.buildImage {
+            name = "partner-chains-demo-node";
+            config = {
+              Entrypoint = [ "${partner-chains-demo-node}/bin/partner-chains-demo-node" ];
+              Expose = [
+                "30333/tcp"
+                "9615/tcp"
+                "9933/tcp"
+                "9944/tcp"
+              ];
+              Volumes = { "/data" = {}; };
+            };
+          };
+        };
+
+        devShells.default = devShell;
+
         formatter = pkgs.nixfmt-rfc-style;
       });
 
@@ -187,12 +217,12 @@
     extra-substituters = [
       "https://nix-community.cachix.org"
       "https://cache.iog.io"
-      "https://cache.sc.iog.io"
+      "https://ci.sc.iog.io/partner-chains"
     ];
     extra-trusted-public-keys = [
       "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-      "cache.sc.iog.io:b4YIcBabCEVKrLQgGW8Fylz4W8IvvfzRc+hy0idqrWU="
+      "partner-chains:j9StpxUY/znqFqaevhQRxCH4Hi0F4rCGXDiUSjz+kew="
     ];
   };
-}
\ No newline at end of file
+}
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 20fddf9a26..524028cd1d 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -4,6 +4,8 @@ components = [
 	"cargo",
 	"clippy",
 	"rust-analyzer",
+	"rust-src",
+	"rust-std",
 	"rustc-dev",
 	"rustc",
 	"rustfmt",

From 7fd0b1c9299b68f17976ccd49863bdc5a466c1a3 Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Tue, 18 Nov 2025 14:30:23 -0500
Subject: [PATCH 09/13] feat: use nix outputs in CI

---
 .github/workflows/ci.yml | 295 +++++++--------------------------------
 1 file changed, 52 insertions(+), 243 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 985ba70162..db7801352c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,52 +54,10 @@ jobs:
           fetch-depth: 0
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v11
-        with:
-          extra-conf: |
-            experimental-features = nix-command flakes
-            substituters = https://cache.nixos.org/
-            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-
-
-      - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
-
-      - name: Enable sccache
-        run: |
-          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
-          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
-          echo "SCCACHE_CACHE_SIZE=5G" >> $GITHUB_ENV
-
-      - name: Cache sccache
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/sccache
-          key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            sccache-${{ runner.os }}-
+        uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Cache cargo registry
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-registry-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            cargo-registry-${{ runner.os }}-
-
-      - name: Setup Rust cache
-        uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: v1
-          shared-key: global
-          cache-all-crates: true
-          cache-targets: true
-          cache-bin: true
-          cache-on-failure: true
-          workspaces: |
-            .
+      - name: Setup Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Acquire AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -113,40 +71,36 @@ jobs:
           registry: ${{ secrets.ECR_REGISTRY_SECRET }}
 
       - name: Formatting
-        run: nix develop --accept-flake-config -c bash -c "cargo fmt --check"
+        run: nix build .#checks.x86_64-linux.cargoFmt --print-build-logs
 
-      - name: Build (Stable)
-        run: nix develop --accept-flake-config -c bash -c "cargo build --locked --release"
+      - name: Test
+        run: nix build .#checks.x86_64-linux.cargoTest --print-build-logs
 
-      - name: sccache stats
-        if: always()
-        run: sccache -s || true
+      - name: Build (Stable)
+        run: nix build .#partner-chains-demo-node --print-build-logs
 
       - name: Build chain specs
         run: |
-          nix develop --accept-flake-config -c bash -c '
-            source ./dev/envs/devnet/.envrc
-            target/release/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json
+          source ./dev/envs/devnet/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json
 
-            source ./dev/envs/ci-preview/.envrc
-            target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json
+          source ./dev/envs/ci-preview/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json
 
-            source ./dev/envs/staging-preview/.envrc
-            target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json
-          '
+          source ./dev/envs/staging-preview/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json
           
       - name: Build and push docker image
         run: |
-          cp target/release/partner-chains-demo-node .
-          nix develop --accept-flake-config -c bash -c "patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 partner-chains-demo-node"
-          docker build -f dev/ci/Dockerfile -t ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }} .
+          nix run .#oci-image.copyToDockerDaemon
+          docker tag partner-chains-node:latest ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }}
           docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }}
 
       - name: Upload partner-chains-node artifact
         uses: actions/upload-artifact@v4
         with:
           name: partner-chains-node-artifact
-          path: ./partner-chains-demo-node
+          path: result/bin/partner-chains-demo-node
 
       - name: Upload chain spec artifacts
         uses: actions/upload-artifact@v4
@@ -176,53 +130,10 @@ jobs:
           fetch-depth: 0
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v11
-        with:
-          extra-conf: |
-            experimental-features = nix-command flakes
-            substituters = https://cache.nixos.org/
-            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-
-
-      - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Enable sccache
-        run: |
-          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
-          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
-          echo "SCCACHE_CACHE_SIZE=2G" >> $GITHUB_ENV
-          echo "CARGO_INCREMENTAL=0" >> $GITHUB_ENV
-
-      - name: Cache sccache
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/sccache
-          key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            sccache-${{ runner.os }}-
-
-      - name: Cache cargo registry
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-registry-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            cargo-registry-${{ runner.os }}-
-
-      - name: Setup Rust cache
-        uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: v1-nightly
-          shared-key: global-nightly
-          cache-all-crates: true
-          cache-targets: true
-          cache-bin: true
-          cache-on-failure: true
-          workspaces: |
-            .
+      - name: Setup Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Build (Nightly)
         env:
@@ -237,10 +148,6 @@ jobs:
       - name: Lint (Nightly)
         run: nix develop --accept-flake-config -c bash -c "RUSTUP_TOOLCHAIN=nightly RUSTFLAGS=-Dwarnings cargo clippy --locked --all-features"
 
-      - name: sccache stats
-        if: always()
-        run: sccache -s || true
-
   local-env:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged == false
     needs: build-linux-x86_64-pre-merge
@@ -343,52 +250,10 @@ jobs:
         run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v11
-        with:
-          extra-conf: |
-            experimental-features = nix-command flakes
-            substituters = https://cache.nixos.org/
-            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+        uses: DeterminateSystems/nix-installer-action@main
 
-
-      - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
-
-      - name: Enable sccache
-        run: |
-          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
-          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
-          echo "SCCACHE_CACHE_SIZE=5G" >> $GITHUB_ENV
-
-      - name: Cache sccache
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/sccache
-          key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            sccache-${{ runner.os }}-
-
-      - name: Cache cargo registry
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-registry-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            cargo-registry-${{ runner.os }}-
-
-      - name: Setup Rust cache
-        uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: v1
-          shared-key: global
-          cache-all-crates: true
-          cache-targets: true
-          cache-bin: true
-          cache-on-failure: true
-          workspaces: |
-            .
+      - name: Setup Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Acquire AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -409,39 +274,32 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build
-        run: nix develop --accept-flake-config -c bash -c "cargo build --locked --profile=release"
-
-      - name: sccache stats
-        if: always()
-        run: sccache -s || true
+        run: nix build .#partner-chains-demo-node --print-build-logs
 
       - name: Build chain specs
         run: |
-          nix develop --accept-flake-config -c bash -c '
-            source ./dev/envs/devnet/.envrc
-            target/release/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json
+          source ./dev/envs/devnet/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json
 
-            source ./dev/envs/ci-preview/.envrc
-            target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json
+          source ./dev/envs/ci-preview/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json
 
-            source ./dev/envs/staging-preview/.envrc
-            target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json
-          '
+          source ./dev/envs/staging-preview/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json
 
       - name: Build and push docker image
         run: |
-          cp target/release/partner-chains-demo-node .
-          nix develop --accept-flake-config -c bash -c "patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 partner-chains-demo-node"
-          docker build -f dev/ci/Dockerfile -t ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }} .
-          docker tag ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }} ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:latest
-          docker tag ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }} ghcr.io/${{ github.repository }}/partner-chains-node-unstable:latest
+          nix run .#oci-image.copyToDockerDaemon
+          docker tag partner-chains-node:latest ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }}
+          docker tag partner-chains-node:latest ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:latest
+          docker tag partner-chains-node:latest ghcr.io/${{ github.repository }}/partner-chains-node-unstable:latest
           docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }}
           docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:latest
           docker push ghcr.io/${{ github.repository }}/partner-chains-node-unstable:latest
 
       - name: Rename artifact
         run: |
-          cp ./partner-chains-demo-node partner-chains-node-${{ steps.get_sha.outputs.sha }}-x86_64-linux
+          cp result/bin/partner-chains-demo-node partner-chains-node-${{ steps.get_sha.outputs.sha }}-x86_64-linux
           chmod +x ./partner-chains-node-${{ steps.get_sha.outputs.sha }}-x86_64-linux
           cp ./partner-chains-node-${{ steps.get_sha.outputs.sha }}-x86_64-linux partner-chains-node-binary
 
@@ -623,52 +481,10 @@ jobs:
           ref: ${{ inputs.sha }}
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v11
-        with:
-          extra-conf: |
-            experimental-features = nix-command flakes
-            substituters = https://cache.nixos.org/
-            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-
+        uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
-
-      - name: Enable sccache
-        run: |
-          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
-          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
-          echo "SCCACHE_CACHE_SIZE=5G" >> $GITHUB_ENV
-
-      - name: Cache sccache
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/sccache
-          key: sccache-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            sccache-${{ runner.os }}-
-
-      - name: Cache cargo registry
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-registry-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            cargo-registry-${{ runner.os }}-
-
-      - name: Setup Rust cache
-        uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: v1
-          shared-key: global
-          cache-all-crates: true
-          cache-targets: true
-          cache-bin: true
-          cache-on-failure: true
-          workspaces: |
-            .
+      - name: Setup Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Acquire AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -682,21 +498,17 @@ jobs:
           registry: ${{ secrets.ECR_REGISTRY_SECRET }}
 
       - name: Formatting
-        run: nix develop --accept-flake-config -c bash -c "cargo fmt --check"
-
-      - name: Build
-        run: nix develop --accept-flake-config -c bash -c "cargo build --locked --release"
+        run: nix build .#checks.x86_64-linux.cargoFmt --print-build-logs
 
       - name: Test
-        run: nix develop --accept-flake-config -c bash -c "cargo test --locked --release --all-features"
+        run: nix build .#checks.x86_64-linux.cargoTest --print-build-logs
+
+      - name: Build
+        run: nix build .#partner-chains-demo-node --print-build-logs
 
       - name: Lint
         run: nix develop --accept-flake-config -c bash -c "RUSTFLAGS=-Dwarnings cargo clippy --locked --release --all-features"
 
-      - name: sccache stats
-        if: always()
-        run: sccache -s || true
-
       #- name: Run cargo-deny to check licenses
       #  uses: EmbarkStudios/cargo-deny-action@v1
       #  with:
@@ -704,28 +516,25 @@ jobs:
 
       - name: Build chain specs
         run: |
-          nix develop --accept-flake-config -c bash -c '
-            source ./dev/envs/devnet/.envrc
-            target/release/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json
+          source ./dev/envs/devnet/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain local --disable-default-bootnode > devnet_chain_spec.json
 
-            source ./dev/envs/ci-preview/.envrc
-            target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json
+          source ./dev/envs/ci-preview/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > ci_preview_chain_spec.json
 
-            source ./dev/envs/staging-preview/.envrc
-            target/release/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json
-          '
+          source ./dev/envs/staging-preview/.envrc
+          result/bin/partner-chains-demo-node build-spec --chain staging --disable-default-bootnode > staging_preview_chain_spec.json
 
       - name: Build and push docker image
         run: |
-          cp target/release/partner-chains-demo-node .
-          nix develop --accept-flake-config -c bash -c "patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 partner-chains-demo-node"
-          docker build -f dev/ci/Dockerfile -t ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ inputs.sha }} .
+          nix run .#oci-image.copyToDockerDaemon
+          docker tag partner-chains-node:latest ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ inputs.sha }}
           docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ inputs.sha }}
 
       - name: Rename and prepare artifact for workflow dispatch
         run: |
           ARTIFACT_NAME="partner-chains-node-${{ inputs.sha }}-x86_64-linux"
-          cp ./partner-chains-demo-node "$ARTIFACT_NAME"
+          cp result/bin/partner-chains-demo-node "$ARTIFACT_NAME"
           chmod +x "$ARTIFACT_NAME"
         shell: bash
 

From 0c20dafd1ef0f0e733fc598c24344c6c6990a26a Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Tue, 18 Nov 2025 16:27:05 -0500
Subject: [PATCH 10/13] fix: add nightly outputs and fix errors

---
 .github/workflows/ci.yml | 23 ++++++++++-----------
 flake.lock               | 12 +++++------
 flake.nix                | 43 +++++++++++++++++++++++++++++++++++++++-
 3 files changed, 59 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db7801352c..a76d525f02 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,7 +93,8 @@ jobs:
       - name: Build and push docker image
         run: |
           nix run .#oci-image.copyToDockerDaemon
-          docker tag partner-chains-node:latest ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }}
+          SOURCE_IMAGE=$(docker images --filter "reference=partner-chains-demo-node" --format "{{.Repository}}:{{.Tag}}" | head -1)
+          docker tag "$SOURCE_IMAGE" ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }}
           docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ github.sha }}
 
       - name: Upload partner-chains-node artifact
@@ -136,17 +137,13 @@ jobs:
         uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Build (Nightly)
-        env:
-          WASM_BUILD_WORKSPACE_HINT: ${{ github.workspace }}
-        run: nix develop --accept-flake-config -c bash -c "RUSTUP_TOOLCHAIN=nightly cargo build --locked --release"
+        run: nix build .#partner-chains-demo-node-nightly --print-build-logs
 
       - name: Test (Nightly)
-        env:
-          WASM_BUILD_WORKSPACE_HINT: ${{ github.workspace }}
-        run: nix develop --accept-flake-config -c bash -c "RUSTUP_TOOLCHAIN=nightly cargo test --locked --release --all-features"
+        run: nix build .#checks.x86_64-linux.cargoTestNightly --print-build-logs
 
       - name: Lint (Nightly)
-        run: nix develop --accept-flake-config -c bash -c "RUSTUP_TOOLCHAIN=nightly RUSTFLAGS=-Dwarnings cargo clippy --locked --all-features"
+        run: nix build .#checks.x86_64-linux.cargoClippyNightly --print-build-logs
 
   local-env:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged == false
@@ -290,9 +287,10 @@ jobs:
       - name: Build and push docker image
         run: |
           nix run .#oci-image.copyToDockerDaemon
-          docker tag partner-chains-node:latest ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }}
-          docker tag partner-chains-node:latest ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:latest
-          docker tag partner-chains-node:latest ghcr.io/${{ github.repository }}/partner-chains-node-unstable:latest
+          SOURCE_IMAGE=$(docker images --filter "reference=partner-chains-demo-node" --format "{{.Repository}}:{{.Tag}}" | head -1)
+          docker tag "$SOURCE_IMAGE" ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }}
+          docker tag "$SOURCE_IMAGE" ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:latest
+          docker tag "$SOURCE_IMAGE" ghcr.io/${{ github.repository }}/partner-chains-node-unstable:latest
           docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ steps.get_sha.outputs.sha }}
           docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:latest
           docker push ghcr.io/${{ github.repository }}/partner-chains-node-unstable:latest
@@ -528,7 +526,8 @@ jobs:
       - name: Build and push docker image
         run: |
           nix run .#oci-image.copyToDockerDaemon
-          docker tag partner-chains-node:latest ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ inputs.sha }}
+          SOURCE_IMAGE=$(docker images --filter "reference=partner-chains-demo-node" --format "{{.Repository}}:{{.Tag}}" | head -1)
+          docker tag "$SOURCE_IMAGE" ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ inputs.sha }}
           docker push ${{ secrets.ECR_REGISTRY_SECRET }}/partner-chains-node:${{ inputs.sha }}
 
       - name: Rename and prepare artifact for workflow dispatch
diff --git a/flake.lock b/flake.lock
index 17e8cc4955..c61b3105f3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -23,11 +23,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1740378829,
-        "narHash": "sha256-cwmm7F73aQFJY6YN1roNibNKwxT6FlfXkG3MEbpSp7Q=",
+        "lastModified": 1763448288,
+        "narHash": "sha256-gW/dY5WRlAxyxgYuyrTdjLDgpXr4/Mdu+pQoZRpSTGo=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "92823f1b0c919d7e2d806956aaf98e90f3761ab7",
+        "rev": "da5cda85b3a63baab8018ff647fb2dbe5030a2d0",
         "type": "github"
       },
       "original": {
@@ -102,11 +102,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1740329432,
-        "narHash": "sha256-eKQ7aBkNvF5AhUpyJ1cW450jxomZ4gTIaYir5qsNl7Y=",
+        "lastModified": 1762860488,
+        "narHash": "sha256-rMfWMCOo/pPefM2We0iMBLi2kLBAnYoB9thi4qS7uk4=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "6d68c475c7aaf7534251182662456a4bf4216dfe",
+        "rev": "2efc80078029894eec0699f62ec8d5c1a56af763",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 0f0832bd1d..19a67ef0a8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -32,7 +32,10 @@
           sha256 = "SJwZ8g0zF2WrKDVmHrVG3pD2RGoQeo24MEXnNx5FyuI=";
         };
 
+        rustToolchainNightly = fenix.packages.${system}.complete.toolchain;
+
         craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
+        craneLibNightly = (crane.mkLib pkgs).overrideToolchain rustToolchainNightly;
 
         shellEnv = {
           CC_ENABLE_DEBUG_OUTPUT = "1";
@@ -147,6 +150,43 @@
           inherit (commonArgs) pname src;
         };
 
+        # Nightly builds
+        cargoVendorDirNightly = craneLibNightly.vendorCargoDeps {
+          inherit (commonArgs) src;
+          overrideVendorGitCheckout = let
+            isPolkadotSdk = p: pkgs.lib.hasPrefix "git+https://github.com/paritytech/polkadot-sdk.git" p.source;
+          in ps: drv:
+            if pkgs.lib.any (p: isPolkadotSdk p) ps then
+              drv.overrideAttrs {
+                postPatch = ''
+                  rm -rf substrate/frame/contracts/fixtures/build || true
+                  rm -rf substrate/frame/contracts/fixtures/contracts/common || true
+                  rm -rf substrate/primitives/state-machine/fuzz || true
+                '';
+              }
+            else
+              drv;
+        };
+
+        cargoArtifactsNightly = craneLibNightly.buildDepsOnly (commonArgs // {
+          cargoVendorDir = cargoVendorDirNightly;
+        });
+
+        partner-chains-demo-node-nightly = craneLibNightly.buildPackage (commonArgs // {
+          pname = "partner-chains-demo-node-nightly";
+          version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;
+          cargoArtifacts = cargoArtifactsNightly;
+          SUBSTRATE_CLI_GIT_COMMIT_HASH = "dev";
+        });
+
+        cargoTestNightly = craneLibNightly.cargoTest (commonArgs // {
+          cargoArtifacts = cargoArtifactsNightly;
+        });
+
+        cargoClippyNightly = craneLibNightly.cargoClippy (commonArgs // {
+          cargoArtifacts = cargoArtifactsNightly;
+        });
+
         devShell = craneLib.devShell ({
           name = "partner-chains-demo-node-shell";
           # Inherit inputs from other build artifacts
@@ -186,10 +226,11 @@
         checks = {
           # Build the crate as part of `nix flake check'
           inherit partner-chains-demo-node cargoTest cargoFmt devShell;
+          inherit partner-chains-demo-node-nightly cargoTestNightly cargoClippyNightly;
         };
 
         packages = {
-          inherit partner-chains-demo-node;
+          inherit partner-chains-demo-node partner-chains-demo-node-nightly;
           default = partner-chains-demo-node;
           oci-image = n2c.packages.${system}.nix2container.buildImage {
             name = "partner-chains-demo-node";

From d385ee71857ad329886ce21dbc16abd389572dad Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Tue, 18 Nov 2025 20:38:08 -0500
Subject: [PATCH 11/13] wip: bump

---
 .github/workflows/ci.yml | 19 -------------------
 demo/node/build.rs       |  2 +-
 flake.nix                |  6 +++++-
 3 files changed, 6 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a76d525f02..cc6e2dfd33 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,16 +39,6 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request' && github.event.pull_request.merged == false
     steps:
-
-      - name: Free up disk space
-        run: |
-          df -h
-          sudo rm -rf /opt/hostedtoolcache || true
-          sudo rm -rf /usr/share/dotnet || true
-          sudo rm -rf /usr/local/lib/android || true
-          docker system prune -af || true
-          df -h
-
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
@@ -117,15 +107,6 @@ jobs:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged == false
     steps:
 
-      - name: Free up disk space
-        run: |
-          df -h
-          sudo rm -rf /opt/hostedtoolcache || true
-          sudo rm -rf /usr/share/dotnet || true
-          sudo rm -rf /usr/local/lib/android || true
-          docker system prune -af || true
-          df -h
-
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
diff --git a/demo/node/build.rs b/demo/node/build.rs
index e3bfe3116b..5b74f914db 100644
--- a/demo/node/build.rs
+++ b/demo/node/build.rs
@@ -1,5 +1,5 @@
 use substrate_build_script_utils::{generate_cargo_keys, rerun_if_git_head_changed};
-
+// ebump
 fn main() {
 	generate_cargo_keys();
 
diff --git a/flake.nix b/flake.nix
index 19a67ef0a8..3f9ffebb8c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,11 +28,15 @@
         };
 
         rustToolchain = fenix.packages.${system}.fromToolchainFile {
+          #dir = ./.; 
           file = ./rust-toolchain.toml;
           sha256 = "SJwZ8g0zF2WrKDVmHrVG3pD2RGoQeo24MEXnNx5FyuI=";
         };
 
-        rustToolchainNightly = fenix.packages.${system}.complete.toolchain;
+        rustToolchainNightly = fenix.packages.${system}.combine [
+          fenix.packages.${system}.complete.toolchain
+          fenix.packages.${system}.targets.wasm32-unknown-unknown.latest.rust-std
+        ];
 
         craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
         craneLibNightly = (crane.mkLib pkgs).overrideToolchain rustToolchainNightly;

From d524617f69ed3db52877df4ef0f3de011e7d98ea Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Tue, 18 Nov 2025 21:05:53 -0500
Subject: [PATCH 12/13] feat: use our attic server

---
 .github/workflows/ci.yml | 80 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 72 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cc6e2dfd33..6e42201cbf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,8 +46,18 @@ jobs:
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Setup Magic Nix Cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Install Attic client
+        run: |
+          nix profile install nixpkgs#attic-client
+
+      - name: Set up Attic cache
+        env:
+          ATTIC_ENDPOINT: ${{ secrets.ATTIC_ENDPOINT }}
+          ATTIC_CACHE: ${{ secrets.ATTIC_CACHE }}
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          attic login --set-default admin "$ATTIC_ENDPOINT" "$ATTIC_TOKEN"
+          attic use "$ATTIC_CACHE"
 
       - name: Acquire AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -69,6 +79,12 @@ jobs:
       - name: Build (Stable)
         run: nix build .#partner-chains-demo-node --print-build-logs
 
+      - name: Push to Attic cache
+        env:
+          ATTIC_CACHE: ${{ secrets.ATTIC_CACHE }}
+        run: |
+          nix path-info -r .#checks.x86_64-linux.cargoFmt .#checks.x86_64-linux.cargoTest .#partner-chains-demo-node | attic push --stdin "$ATTIC_CACHE"
+
       - name: Build chain specs
         run: |
           source ./dev/envs/devnet/.envrc
@@ -114,8 +130,18 @@ jobs:
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Setup Magic Nix Cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Install Attic client
+        run: |
+          nix profile install nixpkgs#attic-client
+
+      - name: Set up Attic cache
+        env:
+          ATTIC_ENDPOINT: ${{ secrets.ATTIC_ENDPOINT }}
+          ATTIC_CACHE: ${{ secrets.ATTIC_CACHE }}
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          attic login --set-default admin "$ATTIC_ENDPOINT" "$ATTIC_TOKEN"
+          attic use "$ATTIC_CACHE"
 
       - name: Build (Nightly)
         run: nix build .#partner-chains-demo-node-nightly --print-build-logs
@@ -126,6 +152,12 @@ jobs:
       - name: Lint (Nightly)
         run: nix build .#checks.x86_64-linux.cargoClippyNightly --print-build-logs
 
+      - name: Push to Attic cache
+        env:
+          ATTIC_CACHE: ${{ secrets.ATTIC_CACHE }}
+        run: |
+          nix path-info -r .#partner-chains-demo-node-nightly .#checks.x86_64-linux.cargoTestNightly .#checks.x86_64-linux.cargoClippyNightly | attic push --stdin "$ATTIC_CACHE"
+
   local-env:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged == false
     needs: build-linux-x86_64-pre-merge
@@ -230,8 +262,18 @@ jobs:
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Setup Magic Nix Cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Install Attic client
+        run: |
+          nix profile install nixpkgs#attic-client
+
+      - name: Set up Attic cache
+        env:
+          ATTIC_ENDPOINT: ${{ secrets.ATTIC_ENDPOINT }}
+          ATTIC_CACHE: ${{ secrets.ATTIC_CACHE }}
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          attic login --set-default admin "$ATTIC_ENDPOINT" "$ATTIC_TOKEN"
+          attic use "$ATTIC_CACHE"
 
       - name: Acquire AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -254,6 +296,12 @@ jobs:
       - name: Build
         run: nix build .#partner-chains-demo-node --print-build-logs
 
+      - name: Push to Attic cache
+        env:
+          ATTIC_CACHE: ${{ secrets.ATTIC_CACHE }}
+        run: |
+          nix path-info -r .#partner-chains-demo-node | attic push --stdin "$ATTIC_CACHE"
+
       - name: Build chain specs
         run: |
           source ./dev/envs/devnet/.envrc
@@ -462,8 +510,18 @@ jobs:
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Setup Magic Nix Cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Install Attic client
+        run: |
+          nix profile install nixpkgs#attic-client
+
+      - name: Set up Attic cache
+        env:
+          ATTIC_ENDPOINT: ${{ secrets.ATTIC_ENDPOINT }}
+          ATTIC_CACHE: ${{ secrets.ATTIC_CACHE }}
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          attic login --set-default admin "$ATTIC_ENDPOINT" "$ATTIC_TOKEN"
+          attic use "$ATTIC_CACHE"
 
       - name: Acquire AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -485,6 +543,12 @@ jobs:
       - name: Build
         run: nix build .#partner-chains-demo-node --print-build-logs
 
+      - name: Push to Attic cache
+        env:
+          ATTIC_CACHE: ${{ secrets.ATTIC_CACHE }}
+        run: |
+          nix path-info -r .#checks.x86_64-linux.cargoFmt .#checks.x86_64-linux.cargoTest .#partner-chains-demo-node | attic push --stdin "$ATTIC_CACHE"
+
       - name: Lint
         run: nix develop --accept-flake-config -c bash -c "RUSTFLAGS=-Dwarnings cargo clippy --locked --release --all-features"
 

From fdae08ac430b5463c2adc76cb48a057ab82b227f Mon Sep 17 00:00:00 2001
From: Taylor Gunnoe <taylor.gunnoe@iohk.io>
Date: Tue, 18 Nov 2025 22:15:03 -0500
Subject: [PATCH 13/13] wip: bump

---
 demo/node/build.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/demo/node/build.rs b/demo/node/build.rs
index 5b74f914db..3abc2a26ff 100644
--- a/demo/node/build.rs
+++ b/demo/node/build.rs
@@ -1,5 +1,5 @@
 use substrate_build_script_utils::{generate_cargo_keys, rerun_if_git_head_changed};
-// ebump
+// bump 2
 fn main() {
 	generate_cargo_keys();