Add binary file streams, Nix release packages, and bounded release checks

.github/workflows/ci.yml

@@ -39,13 +39,13 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-09-23-c7852fd
+          nightly-tag: nightly-2026-09-26-d6267b4
       - name: Install Rust toolchain
         run: |
           rustup toolchain install "${{ needs.rust-version.outputs.version }}" --profile minimal --target x86_64-unknown-linux-musl --component llvm-tools-preview
           rustup default "${{ needs.rust-version.outputs.version }}"
-      - name: Test release version validation
-        run: python3 -m unittest scripts/test_check_release_version.py
+      - name: Test release tooling
+        run: python3 -m unittest scripts/test_check_release_version.py scripts/test_check_version_bump.py scripts/test_update_nix_release.py
       - name: Format, check, and test examples
         run: ./scripts/test.py --operation validate
       - name: Check native resource ownership with glibc and Valgrind
@@ -54,6 +54,20 @@ jobs:
           sudo apt-get install --yes valgrind
           python3 scripts/test_resource_lifetimes.py
 
+  nix:
+    name: Nix release consumer (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-26]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - name: Build and run an application against the pinned release
+        run: nix flake check --print-build-logs
+
   validate-windows:
     name: validate sources (windows)
     needs: rust-version
@@ -63,7 +77,7 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-09-23-c7852fd
+          nightly-tag: nightly-2026-09-26-d6267b4
       - name: Install Rust toolchain
         shell: bash
         run: |
@@ -108,7 +122,7 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-09-23-c7852fd
+          nightly-tag: nightly-2026-09-26-d6267b4
       - name: Install Rust toolchain
         shell: bash
         run: |

.github/workflows/deploy-docs.yml

@@ -37,10 +37,10 @@ jobs:
         uses: actions/configure-pages@v6
 
       - name: Install Roc
-        uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
+        uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-09-23-c7852fd
+          nightly-tag: nightly-2026-09-26-d6267b4
 
       - name: Restore released docs
         env:

.github/workflows/release.yml

@@ -111,10 +111,10 @@ jobs:
           fetch-depth: 0
 
       - name: Install Roc
-        uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
+        uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-09-23-c7852fd
+          nightly-tag: nightly-2026-09-26-d6267b4
 
       - name: Install Zig
         uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f
@@ -155,18 +155,21 @@ jobs:
         with:
           github_token: ${{ github.token }}
 
-      # Bootstrap exception: 0.20.0 is a .tar.br bundle in old Roc syntax and
-      # alpha-0 is also no longer parseable, so current `roc bump` cannot compare
-      # either predecessor. Change this to `require` after the first stable
-      # new-compiler .tar.zst release.
+      # 0.22.2 publicly aliases InternalHttp.TransportErr; roc bump currently
+      # rejects that alias during API extraction. Keep warning until the compiler
+      # can compare it, and bound the check so a compiler hang cannot block release.
       - name: Check version bump
-        uses: roc-lang/release-package/actions/run-bump-check@af2f0cd8662874b825ff3917f4286e793ba18c55
-        with:
-          release_version: ${{ needs.release-info.outputs.release_version }}
-          dry_run: ${{ github.event_name != 'workflow_dispatch' }}
-          bump_check: warn
-          bump_entrypoint: platform/main.roc
-          previous_url: ${{ steps.previous.outputs.previous_url }}
+        env:
+          RELEASE_VERSION: ${{ needs.release-info.outputs.release_version }}
+          DRY_RUN: ${{ github.event_name != 'workflow_dispatch' }}
+          PREVIOUS_URL: ${{ steps.previous.outputs.previous_url }}
+        run: |
+          python3 scripts/check_version_bump.py \
+            --version "$RELEASE_VERSION" \
+            --dry-run "$DRY_RUN" \
+            --mode warn \
+            --previous-url "$PREVIOUS_URL" \
+            --timeout-seconds 120
 
       - name: Bundle platform
         run: ./scripts/bundle.py --output-dir dist
@@ -212,10 +215,10 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install Roc
-        uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
+        uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-09-23-c7852fd
+          nightly-tag: nightly-2026-09-26-d6267b4
 
       - name: Install Rust
         shell: bash
@@ -257,10 +260,10 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install Roc
-        uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
+        uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-09-23-c7852fd
+          nightly-tag: nightly-2026-09-26-d6267b4
 
       - name: Create docs staging tree
         run: mkdir -p docs-site
@@ -429,18 +432,18 @@ jobs:
           fetch-depth: 0
 
       - name: Install Roc
-        uses: roc-lang/setup-roc@bd311e2fb815a3d2255f7ee14a922f0b736e020b
+        uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-09-23-c7852fd
+          nightly-tag: nightly-2026-09-26-d6267b4
 
       - name: Download release metadata
         uses: actions/download-artifact@v8
         with:
           name: release-metadata
           path: .release
 
-      - name: Derive release bundle URL and update examples
+      - name: Derive release bundle URL and update examples and Nix pins
         env:
           RELEASE_VERSION: ${{ needs.build.outputs.release_version }}
         run: |
@@ -463,6 +466,9 @@ jobs:
           ./scripts/update_app_platform_urls.py \
             --platform-url "$bundle_url" \
             examples
+          python3 scripts/update_nix_release.py \
+            --version "$RELEASE_VERSION" \
+            --url "$bundle_url"
 
       - name: Validate updated examples
         run: |
@@ -544,13 +550,14 @@ jobs:
             Cargo.toml
             Cargo.lock
             examples
+            nix/release.json
           branch_prefix: release-followup
           base_branch: ${{ github.event.repository.default_branch }}
           commit_message: Update sources for ${{ needs.build.outputs.release_version }}
           pr_title: Update sources for ${{ needs.build.outputs.release_version }}
           pr_body: |
             Release follow-up for ${{ needs.build.outputs.release_version }}.
 
-            Updates the Cargo package version and checked-in examples to match
-            the published platform release.
+            Updates the Cargo package version, checked-in examples, and Nix
+            release pins to match the published platform release.
           github_token: ${{ github.token }}

CONTRIBUTING.md

@@ -77,6 +77,21 @@ drift independently. When updating the nightly pin in the workflows:
 
 ## Verification
 
+For changes to the Nix release outputs, run `nix flake check`. This builds and
+runs an application against the pinned published platform inside the Nix sandbox;
+see [the Nix consumer documentation](nix/README.md).
+
+Release-tooling regression tests run with:
+
+```sh
+python3 -m unittest scripts/test_check_release_version.py scripts/test_check_version_bump.py scripts/test_update_nix_release.py
+```
+
+The release workflow bounds `roc bump` to 120 seconds and saves its output in
+`.release/bump-output.txt`. It currently warns on comparison errors and timeouts:
+the compiler still rejects the public `InternalHttp.TransportErr` alias in the
+0.22.2 predecessor. Switch to `--mode require` once that comparison works.
+
 Run the full local check before opening release or CI-facing changes:
 
 ```sh

README.md

@@ -71,6 +71,20 @@ HTTP examples use Roc's builtin `Json` parser and encoder directly through
 - [`0.21.0-rc4` release documentation](https://roc-lang.github.io/basic-cli/0.21.0-rc4/)
 - [latest main branch](https://roc-lang.github.io/basic-cli/main/)
 
+## Nix
+
+Fetch the pinned published platform without rebuilding its Rust hosts:
+
+```sh
+nix build github:roc-lang/basic-cli#platform  # result/main.roc and result/targets/
+nix build github:roc-lang/basic-cli#bundle    # result is the original release archive
+```
+
+The default package is `platform`. These outputs provide the release recorded in
+[`nix/release.json`](nix/release.json), rather than the current checkout's platform
+sources. The flake also provides the compiler and dependency pins needed to build
+applications offline; see the [downstream application example](nix/README.md).
+
 ## Help
 
 Ask questions on [Roc Zulip](https://roc.zulipchat.com), especially in the `#beginners` stream.

examples/file-read-binary.roc

@@ -0,0 +1,38 @@
+## Count binary file bytes in bounded chunks after inspecting its header.
+app [main!] { pf: platform "../platform/main.roc" }
+
+import pf.File
+import pf.OsStr
+import pf.Path
+import pf.Stdout
+
+main! : List(OsStr) => Try({}, _)
+main! = |args| {
+	path = match args {
+		[first, ..] => Path.from_os_str(first)
+		[] => return Err(MissingPathArgument)
+	}
+	reader = File.open_reader!(path)?
+	# Preview at most 16 bytes; even a short or empty file is valid.
+	header = reader.read_up_to!(16)?
+	Stdout.line!("Header bytes: ${Str.inspect(header)}")?
+	_ = reader.seek!(Start(0))?
+	var $chunks = reader.chunks(65_536)?
+	var $total = 0.U64
+	while Bool.True {
+		match Stream.next!($chunks) {
+			Done => {
+				break
+			}
+			Skip({ rest }) => {
+				$chunks = rest
+			}
+			One({ item, rest }) => {
+				bytes = item?
+				$total = $total + bytes.len()
+				$chunks = rest
+			}
+		}
+	}
+	Stdout.line!("Read ${$total.to_str()} bytes")
+}

flake.nix

@@ -1,5 +1,5 @@
 {
-  description = "basic-cli development environment";
+  description = "basic-cli release platform and development environment";
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
@@ -59,10 +59,14 @@
             rust-overlay.overlays.default
           ];
         };
+      releaseFor = system: import ./nix/release.nix { pkgs = pkgsFor system; };
     in
     {
       formatter = forAllSystems (system: (pkgsFor system).nixfmt);
 
+      packages = forAllSystems (system: (releaseFor system).packages);
+      checks = forAllSystems (system: (releaseFor system).checks);
+
       devShells = forAllSystems (
         system:
         let
@@ -75,7 +79,7 @@
           default = pkgs.mkShell {
             packages = [
               # Keep in sync with the nightly pinned in .github/workflows.
-              pkgs.rocpkgs."nightly-2026-09-23-c7852fd"
+              pkgs.rocpkgs."nightly-2026-09-26-d6267b4"
               pkgs.python3
               rustToolchain
               pkgs.simple-http-server