Merge remote-tracking branch 'DetSys/main' into merge-upstream

- moved the setting of upgrade-nix-store-path-url behind the
  nix-community feature
- moved some enterprise volume creation behind the nix-community
  feature, and just deleted some of it
- bumped nixpkgs and fenix since we need a newer rustc
- grab a nix tarball out of the nix flake's hydraJobs rather than using
  FlakeHub

.github/workflows/build-aarch64-darwin.yml

@@ -0,0 +1,36 @@
+name: Build aarch64 Darwin
+
+on:
+  workflow_call:
+    inputs:
+      cache-key:
+        type: string
+        required: false
+        default: aarch64-darwin-artifacts-${{ github.sha }}
+
+jobs:
+  build-aarch64-darwin:
+    name: Build aarch64 Darwin
+    runs-on: macos-latest-xlarge
+    concurrency: ${{ inputs.cache-key }}
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          flakehub: true
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-gha-cache: false
+      - name: Build the installer
+        run: |
+          nix build .#packages.aarch64-darwin.nix-installer -L
+          cp result/bin/nix-installer .
+      - name: Create GitHub cache from build artifacts
+        uses: actions/cache/save@v3
+        with:
+          path: nix-installer
+          key: ${{ inputs.cache-key }}

.github/workflows/build-aarch64-linux.yml

@@ -0,0 +1,36 @@
+name: Build aarch64 Linux (static)
+
+on:
+  workflow_call:
+    inputs:
+      cache-key:
+        type: string
+        required: false
+        default: aarch64-linux-artifacts-${{ github.sha }}
+
+jobs:
+  build-aarch64-linux:
+    name: Build aarch64 Linux (static)
+    runs-on: namespace-profile-default-arm64
+    concurrency: ${{ inputs.cache-key }}
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          flakehub: true
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-gha-cache: false
+      - name: Build the installer
+        run: |
+          nix build .#packages.aarch64-linux.nix-installer-static -L
+          cp result/bin/nix-installer .
+      - name: Create GitHub cache from build artifacts
+        uses: actions/cache/save@v3
+        with:
+          path: nix-installer
+          key: ${{ inputs.cache-key }}

.github/workflows/build-i686-linux.yml

@@ -0,0 +1,36 @@
+name: Build i686 Linux (static)
+
+on:
+  workflow_call:
+    inputs:
+      cache-key:
+        type: string
+        required: false
+        default: i686-linux-artifacts-${{ github.sha }}
+
+jobs:
+  build-i686-linux:
+    name: Build i686 Linux (static)
+    runs-on: UbuntuLatest32Cores128G
+    concurrency: ${{ inputs.cache-key }}
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          flakehub: true
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-gha-cache: false
+      - name: Build the installer
+        run: |
+          nix build .#packages.i686-linux.nix-installer-static -L
+          cp result/bin/nix-installer .
+      - name: Create GitHub cache from build artifacts
+        uses: actions/cache/save@v3
+        with:
+          path: nix-installer
+          key: ${{ inputs.cache-key }}

.github/workflows/build-x86_64-darwin.yml

@@ -0,0 +1,36 @@
+name: Build x86_64 Darwin
+
+on:
+  workflow_call:
+    inputs:
+      cache-key:
+        type: string
+        required: false
+        default: x86_64-darwin-artifacts-${{ github.sha }}
+
+jobs:
+  build-x86_64-darwin:
+    name: Build x86_64 Darwin
+    runs-on: macos-13-large
+    concurrency: ${{ inputs.cache-key }}
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          flakehub: true
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-gha-cache: false
+      - name: Build the installer
+        run: |
+          nix build .#packages.x86_64-darwin.nix-installer -L
+          cp result/bin/nix-installer .
+      - name: Create GitHub cache from build artifacts
+        uses: actions/cache/save@v3
+        with:
+          path: nix-installer
+          key: ${{ inputs.cache-key }}

.github/workflows/build-x86_64-linux.yml

@@ -0,0 +1,36 @@
+name: Build x86_64 Linux (static)
+
+on:
+  workflow_call:
+    inputs:
+      cache-key:
+        type: string
+        required: false
+        default: x86_64-linux-artifacts-${{ github.sha }}
+
+jobs:
+  build-x86_64-linux:
+    name: Build x86_64 Linux (static)
+    runs-on: UbuntuLatest32Cores128G
+    concurrency: ${{ inputs.cache-key }}
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          flakehub: true
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          use-gha-cache: false
+      - name: Build the installer
+        run: |
+          nix build .#packages.x86_64-linux.nix-installer-static -L
+          cp result/bin/nix-installer .
+      - name: Create GitHub cache from build artifacts
+        uses: actions/cache/save@v3
+        with:
+          path: nix-installer
+          key: ${{ inputs.cache-key }}