ci: run nix jobs with --fallback

cache.nixos.org intermittently serves corrupt NARs; build from source on
substitute failure instead of failing the job.

.github/workflows/build.yml

@@ -42,7 +42,7 @@ jobs:
         id: vendorhash
         if: steps.changed-files.outputs.files == 'true'
         run: |
-          nix develop --command -- go run ./cmd/vendorhash check | tee check-result
+          nix develop --fallback --command -- go run ./cmd/vendorhash check | tee check-result
           {
             grep '^expected_sri=' check-result || true
             grep '^actual_sri='   check-result || true
@@ -63,7 +63,7 @@ jobs:
 
       - name: Run nix build
         if: steps.changed-files.outputs.files == 'true'
-        run: nix build
+        run: nix build --fallback
 
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: steps.changed-files.outputs.files == 'true'
@@ -91,7 +91,7 @@ jobs:
       - name: Run go cross compile
         env:
           CGO_ENABLED: 0
-        run: env ${{ matrix.env }} nix develop --command -- go build -o "headscale"
+        run: env ${{ matrix.env }} nix develop --fallback --command -- go build -o "headscale"
           ./cmd/headscale
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:

.github/workflows/check-generated.yml

@@ -41,7 +41,7 @@ jobs:
 
       - name: Run make generate
         if: steps.changed-files.outputs.files == 'true'
-        run: nix develop --command -- make generate
+        run: nix develop --fallback --command -- make generate
 
       - name: Check for uncommitted changes
         if: steps.changed-files.outputs.files == 'true'

.github/workflows/check-tests.yaml

@@ -36,7 +36,7 @@ jobs:
       - name: Generate and check integration tests
         if: steps.changed-files.outputs.files == 'true'
         run: |
-          nix develop --command bash -c "cd .github/workflows && go generate"
+          nix develop --fallback --command bash -c "cd .github/workflows && go generate"
           git diff --exit-code .github/workflows/test-integration.yaml
 
       - name: Show missing tests

.github/workflows/container-main.yml

@@ -56,7 +56,7 @@ jobs:
           KO_DEFAULTBASEIMAGE: gcr.io/distroless/base-debian13
           CGO_ENABLED: "0"
         run: |
-          nix develop --command -- ko build \
+          nix develop --fallback --command -- ko build \
             --bare \
             --platform=linux/amd64,linux/arm64 \
             --tags=main-${GITHUB_SHA::7},development \
@@ -68,7 +68,7 @@ jobs:
           KO_DEFAULTBASEIMAGE: gcr.io/distroless/base-debian13
           CGO_ENABLED: "0"
         run: |
-          nix develop --command -- ko build \
+          nix develop --fallback --command -- ko build \
             --bare \
             --platform=linux/amd64,linux/arm64 \
             --tags=main-${GITHUB_SHA::7},development \
@@ -104,7 +104,7 @@ jobs:
           CGO_ENABLED: "0"
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
-        run: nix develop --command -- go build -o headscale ./cmd/headscale
+        run: nix develop --fallback --command -- go build -o headscale ./cmd/headscale
 
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
 
       - name: golangci-lint
         if: steps.changed-files.outputs.files == 'true'
-        run: nix develop --command -- golangci-lint run
+        run: nix develop --fallback --command -- golangci-lint run
           --new-from-rev=${{github.event.pull_request.base.sha}}
           --output.text.path=stdout
           --output.text.print-linter-name
@@ -75,7 +75,7 @@ jobs:
 
       - name: Prettify code
         if: steps.changed-files.outputs.files == 'true'
-        run: nix develop --command -- prettier --no-error-on-unmatched-pattern
+        run: nix develop --fallback --command -- prettier --no-error-on-unmatched-pattern
           --ignore-unknown --check **/*.{ts,js,md,yaml,yml,sass,css,scss,html}
 
   proto-lint:
@@ -90,4 +90,4 @@ jobs:
           restore-prefixes-first-match: nix-${{ runner.os }}-${{ runner.arch }}
 
       - name: Buf lint
-        run: nix develop --command -- buf lint proto
+        run: nix develop --fallback --command -- buf lint proto

.github/workflows/release.yml

@@ -38,6 +38,6 @@ jobs:
           restore-prefixes-first-match: nix-${{ runner.os }}-${{ runner.arch }}
 
       - name: Run goreleaser
-        run: nix develop --command -- goreleaser release --clean
+        run: nix develop --fallback --command -- goreleaser release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test-integration.yaml

@@ -47,7 +47,7 @@ jobs:
         if: steps.changed-files.outputs.files == 'true'
         run: |
           # Build all Go binaries in one nix shell to maximize cache reuse
-          nix develop --command -- bash -c '
+          nix develop --fallback --command -- bash -c '
             go build -o hi ./cmd/hi
             CGO_ENABLED=0 GOOS=linux go build -o headscale ./cmd/headscale
             # Build integration test binary to warm the cache with all dependencies
@@ -182,7 +182,7 @@ jobs:
       - name: List Tailscale versions to pre-pull
         id: versions
         run: |
-          versions=$(nix develop --command go run ./cmd/hi list-versions --set=must --exclude=head)
+          versions=$(nix develop --fallback --command go run ./cmd/hi list-versions --set=must --exclude=head)
           echo "versions=${versions}" >> "$GITHUB_OUTPUT"
           echo "Pre-pulling: ${versions}"
       - name: Pull Tailscale images

.github/workflows/test.yml

@@ -44,4 +44,4 @@ jobs:
           # some of the database migration tests.
           LC_ALL: "en_US.UTF-8"
           LC_CTYPE: "en_US.UTF-8"
-        run: nix develop --command -- gotestsum
+        run: nix develop --fallback --command -- gotestsum