ci(nix): fix the bump workflow's PR creation, and catch npmDepsHash drift

.github/workflows/bump-nix-package.yml

@@ -10,9 +10,10 @@ on:
         required: true
         type: string
 
+# GITHUB_TOKEN only pushes the branch here — the PR itself is opened with the
+# PAT below, so no `pull-requests: write` is needed (and it never worked).
 permissions:
   contents: write
-  pull-requests: write
 
 jobs:
   bump:
@@ -78,7 +79,13 @@ jobs:
 
       - name: Create PR
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # NOT GITHUB_TOKEN: the repo has "Allow GitHub Actions to create and
+          # approve pull requests" turned off, so `gh pr create` dies with
+          # "GitHub Actions is not permitted to create or approve pull requests"
+          # — it did exactly that on v1.7.0, after pushing the branch, and #136
+          # had to be opened by hand. The PAT every other release workflow
+          # already uses has no such restriction, and its PRs trigger CI.
+          GH_TOKEN: ${{ secrets.OPENSCREEN_RELEASE_TOKEN }}
           VERSION: ${{ steps.meta.outputs.version }}
           HASH: ${{ steps.hash.outputs.hash }}
           BRANCH: ${{ steps.meta.outputs.branch }}
@@ -112,7 +119,5 @@ jobs:
           - \`npmDepsHash\` → \`${HASH}\` (computed via \`prefetch-npm-deps package-lock.json\`)
 
           Merge this so Nix users (NixOS, Home Manager, \`nix run github:${{ github.repository }}\`) pick up the new release.
-
-          > Note: PRs opened by \`GITHUB_TOKEN\` don't auto-trigger CI. The diff is two lines — review the change here, then merge. If you want CI to run, push an empty commit to this branch or close-and-reopen the PR.
           EOF
           )"

.github/workflows/nix-check.yml

@@ -0,0 +1,72 @@
+name: Nix
+
+# nix/package.nix records `npmDepsHash`, a hash of the npm dependency set that
+# package-lock.json resolves to. The two have to agree or `nix build` fails
+# outright, and nothing here ever checked that they did.
+#
+# The only thing that refreshed the hash was bump-nix-package.yml, which fires
+# on stable releases. `src` is this repo's own tree, not a fetched tarball, so
+# every lockfile change landing between two releases left main's hash pointing
+# at dependencies that no longer existed. It last matched on 2026-07-05 (v1.6.0)
+# while package-lock.json moved ten more times, so `nix run github:…` was broken
+# for four weeks with nothing reporting it.
+#
+# Release-time bumps can't fix that — the drift starts the moment a lockfile PR
+# merges. This runs on the PR that causes it and prints the hash to paste.
+on:
+  pull_request:
+    paths:
+      - package-lock.json
+      - nix/**
+      - .github/workflows/nix-check.yml
+  # Same branch list as ci.yml, and for the reason its own comment gives: a
+  # release branch is the last place to skip a check. PRs need no filter here —
+  # the trigger above has none, so they are covered wherever they land — but a
+  # direct push or a rebase force-push onto a long-lived branch is not a PR and
+  # would otherwise go unchecked.
+  push:
+    branches: [main, feat/ai-edition, "release/**"]
+    paths:
+      - package-lock.json
+      - nix/**
+      - .github/workflows/nix-check.yml
+
+# Read-only, and stated rather than inherited: the repo default happens to be
+# `read` today, which is exactly the kind of repo-level setting that silently
+# changed this workflow's sibling out from under it.
+permissions:
+  contents: read
+
+jobs:
+  npm-deps-hash:
+    name: npmDepsHash matches package-lock.json
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: Compare recorded hash against the lockfile
+        run: |
+          set -euo pipefail
+          EXPECTED=$(nix run nixpkgs#prefetch-npm-deps -- package-lock.json)
+          RECORDED=$(sed -nE 's|^[[:space:]]*npmDepsHash[[:space:]]*=[[:space:]]*"([^"]*)";|\1|p' nix/package.nix)
+
+          echo "recorded in nix/package.nix: ${RECORDED:-<none>}"
+          echo "expected from package-lock.json: $EXPECTED"
+
+          if [[ -z "$EXPECTED" ]]; then
+            echo "::error::prefetch-npm-deps returned an empty hash"
+            exit 1
+          fi
+
+          if [[ "$EXPECTED" != "$RECORDED" ]]; then
+            echo "::error file=nix/package.nix::npmDepsHash is stale — set it to $EXPECTED"
+            exit 1
+          fi
+
+          echo "In sync."

nix/package.nix

@@ -11,7 +11,7 @@
 buildNpmPackage {
   nodejs = nodejs_22;
   pname = "openscreen";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src =
     let
@@ -33,7 +33,7 @@ buildNpmPackage {
       );
     };
 
-  npmDepsHash = "sha256-IZypOLWlDShIjCKWxlJcrdtIkMu0P/DuXaq4c0HW3FY=";
+  npmDepsHash = "sha256-SggSPoDnKzmvgXpIGP11y6h390SkoZszeMjFTaokRjQ=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";