chore: replace android cross-rs cross compilation setup with a nix based one

.github/workflows/release-swift-kotlin.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Get new version
         id: version
@@ -29,14 +29,16 @@ jobs:
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
 
   build-swift:
+    # Swift depends on the host macOS/Xcode configuration and intentionally does
+    # not run inside Nix.
     runs-on: macos-latest
     needs: pre-release-checks
     permissions:
       contents: write
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ needs.pre-release-checks.outputs.commit_sha }} # to ensure all builds are consistent
 
@@ -57,14 +59,14 @@ jobs:
           zip -r WalletKit.xcframework.zip swift/WalletKit.xcframework
 
       - name: Checkout swift repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: worldcoin/walletkit-swift
           token: ${{ secrets.WALLETKIT_BOT_TOKEN }}
           path: target-repo
 
       - name: Create draft release in walletkit-swift & upload binaries
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         id: release
         with:
           repository: worldcoin/walletkit-swift
@@ -126,11 +128,9 @@ jobs:
     name: Prepare Kotlin
     runs-on: arc-public-8xlarge-amd64-runner
     needs: [pre-release-checks]
-    env:
-      CARGO_HOME: /home/runner/_work/_cargo
-      RUSTUP_HOME: /home/runner/_work/_rustup
     permissions:
-      contents: write # to upload artifacts
+      contents: read
+      actions: write # to save Rust cache
 
     # Each target is built separately to run in parallel. Running sequentially takes vastly more time.
     strategy:
@@ -143,31 +143,36 @@ jobs:
           - target: i686-linux-android
 
     steps:
-      - name: Add Cargo to PATH
-        run: echo "$CARGO_HOME/bin" >> $GITHUB_PATH
-
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ needs.pre-release-checks.outputs.commit_sha }} # to ensure all builds are consistent
 
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.92.0
-          targets: ${{ matrix.settings.target }}
-          components: rustfmt
+      - name: Install Nix
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
-      - name: Install Cross
-        run: |
-          cargo install cross --git https://github.com/cross-rs/cross --locked
+      # TODO: magic-nix-cache is best-effort; builds still work without it.
+      - name: Enable Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13
+
+      - name: Cache Rust build artifacts
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target/release
+            target/${{ matrix.settings.target }}
+          key: ${{ runner.os }}-cargo-android-${{ matrix.settings.target }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml', 'flake.lock', 'flake.nix', 'nix/**/*.nix') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-android-${{ matrix.settings.target }}-
+            ${{ runner.os }}-cargo-android-
 
       - name: Build for target
-        run: |
-          CROSS_NO_WARNINGS=0 cross build -p walletkit --target ${{ matrix.settings.target }} --release --locked --features "$WALLETKIT_CARGO_FEATURES"
+        run: ./nix/build-android.sh --target ${{ matrix.settings.target }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: android-${{ matrix.settings.target }}
           path: ./target/${{ matrix.settings.target }}/release/libwalletkit.so
@@ -183,40 +188,30 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ needs.pre-release-checks.outputs.commit_sha }} # to ensure all builds are consistent
 
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.92.0
-          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,i686-linux-android
-          components: rustfmt
+      - name: Install Nix
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+
+      # TODO: magic-nix-cache is best-effort; builds still work without it.
+      - name: Enable Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13
 
       - name: Setup Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3.14.1
         with:
           distribution: temurin
           java-version: 17
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          path: .
+          path: artifacts
 
-      - name: Move artifacts
-        run: |
-          mkdir -p kotlin/walletkit/src/main/jniLibs && cd kotlin/walletkit/src/main/jniLibs
-          mkdir armeabi-v7a arm64-v8a x86 x86_64
-          mv /home/runner/work/walletkit/walletkit/android-armv7-linux-androideabi/libwalletkit.so ./armeabi-v7a/libwalletkit.so
-          mv /home/runner/work/walletkit/walletkit/android-aarch64-linux-android/libwalletkit.so ./arm64-v8a/libwalletkit.so
-          mv /home/runner/work/walletkit/walletkit/android-i686-linux-android/libwalletkit.so ./x86/libwalletkit.so
-          mv /home/runner/work/walletkit/walletkit/android-x86_64-linux-android/libwalletkit.so ./x86_64/libwalletkit.so
-
-      - name: Generate bindings
-        working-directory: kotlin
-        run: cargo run -p uniffi-bindgen generate ./walletkit/src/main/jniLibs/arm64-v8a/libwalletkit.so --library --language kotlin --no-format --out-dir walletkit/src/main/java
+      - name: Assemble jniLibs & generate bindings
+        run: nix develop . --command ./kotlin/build_kotlin.sh --artifacts-dir artifacts
 
       - name: Publish
         working-directory: kotlin

README.md

@@ -40,13 +40,9 @@ Replace `VERSION` with the desired WalletKit version.
 
 ### Prerequisites
 
-1. **Docker Desktop**: Required for cross-compilation
-   - The build uses [`cross`](https://github.com/cross-rs/cross) which runs builds in Docker containers with all necessary toolchains
-   - Install via Homebrew:
-     ```bash
-     brew install --cask docker
-     ```
-   - Launch Docker Desktop and ensure it's running before building
+1. **Nix**: The Android cross-compilation toolchain (Rust, NDK, linkers) is provided
+   by the Nix devshell — see [`nix/README.md`](nix/README.md). Without Nix, you
+   must provision the equivalent dependencies manually.
 
 2. **Android SDK + NDK**: Required for Gradle Android tasks
    - Install via Android Studio > Settings > Android SDK (ensure the NDK is installed)
@@ -57,15 +53,15 @@ Replace `VERSION` with the desired WalletKit version.
 To test local changes before publishing a release, use the build script to compile the Rust library, generate UniFFI bindings, and publish a SNAPSHOT to Maven Local:
 
 ```bash
-./kotlin/local_kotlin.sh 0.3.1
+nix develop .#android --command ./kotlin/local_kotlin.sh 0.3.1
 ```
 
 Example with custom Rust locations:
 ```bash
 RUSTUP_HOME=~/.rustup CARGO_HOME=~/.cargo ./kotlin/local_kotlin.sh 0.1.0-SNAPSHOT
 ```
 
-> **Note**: The script can be run from any working directory (it resolves its own location). It sets `RUSTUP_HOME` and `CARGO_HOME` to `/tmp` by default to avoid Docker permission issues when using `cross`. You can override them by exporting your own values.
+> **Note**: The script resolves its own location, but does not provision or enter the build environment. Run it from the Nix `android` devshell or with the required dependencies configured manually.
 
 This will:
 1. Build the Rust library for all Android architectures (arm64-v8a, armeabi-v7a, x86_64, x86)

flake.nix

@@ -0,0 +1,51 @@
+{
+  description = "WalletKit development shells";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    rust-overlay.url = "github:oxalica/rust-overlay";
+    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = { nixpkgs, flake-utils, rust-overlay, ... }:
+    flake-utils.lib.eachSystem [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ] (system:
+      let
+        overlays = [
+          (import rust-overlay)
+          (final: prev: { nargo = final.callPackage ./nix/nargo.nix { }; })
+        ];
+        pkgs = import nixpkgs {
+          inherit system overlays;
+          config = {
+            allowUnfree = true;
+            android_sdk.accept_license = true;
+          };
+        };
+
+        rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
+      in
+      {
+        devShells = {
+          default = pkgs.mkShell {
+            packages = [
+              rustToolchain
+              pkgs.curl
+              pkgs.git
+              pkgs.nargo
+            ];
+          };
+
+          wasm = import ./nix/wasm.nix { inherit pkgs; };
+        } // pkgs.lib.optionalAttrs (!(pkgs.stdenv.isLinux && pkgs.stdenv.isAarch64)) {
+          # The Android NDK has no aarch64-linux prebuilt toolchain
+          # (on aarch64 Docker hosts, run the container as linux/amd64).
+          android = import ./nix/android.nix { inherit pkgs; };
+        };
+      });
+}