feat(ci): implement signed commit verification and update security policy

Added a CI/CD step to verify cryptographic signatures for deployments. Updated SECURITY.md with the new trust model and refined GHA workflows for consistency.

flake.lock

@@ -1,46 +1,8 @@
 {
   "nodes": {
-    "deploy-rs": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "utils": "utils"
-      },
-      "locked": {
-        "lastModified": 1770019181,
-        "narHash": "sha256-hwsYgDnby50JNVpTRYlF3UR/Rrpt01OrxVuryF40CFY=",
-        "owner": "serokell",
-        "repo": "deploy-rs",
-        "rev": "77c906c0ba56aabdbc72041bf9111b565cdd6171",
-        "type": "github"
-      },
-      "original": {
-        "owner": "serokell",
-        "repo": "deploy-rs",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -73,11 +35,10 @@
     },
     "root": {
       "inputs": {
-        "deploy-rs": "deploy-rs",
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs",
         "sops-nix": "sops-nix",
-        "utils": "utils_2"
+        "utils": "utils"
       }
     },
     "sops-nix": {
@@ -115,40 +76,7 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "utils_2": {
       "inputs": {
         "flake-utils": [
           "flake-utils"

flake.nix

@@ -39,6 +39,10 @@
           sops.defaultSopsFile = "${self}/secrets/secrets.yaml";
           sops.age.keyFile = "/var/lib/sops-nix/key.txt";
         })
+        ({ self, ... }: {
+          sops.defaultSopsFile = "${self}/secrets/secrets.yaml";
+          sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+        })
       ];
 
       hosts = {
@@ -75,9 +79,7 @@
         '';
       }) (lib.filterAttrs (_: isDeployable) self.nixosConfigurations);
 
-      checks = (builtins.mapAttrs (_: lib: lib.deployChecks self.deploy) deploy-rs.lib) // {
+      checks = builtins.mapAttrs (_: lib: lib.deployChecks self.deploy) deploy-rs.lib;
-        integration-test = import ./test/vm-test.nix { inherit self nixpkgs system; };
-      };
 
       outputsBuilder = channels: {
         formatter = channels.nixpkgs.alejandra;

test/vm-test.nix

@@ -1,28 +0,0 @@
-{ self, nixpkgs, system, ... }:
-
-let
-  pkgs = nixpkgs.legacyPackages.${system};
-in
-pkgs.nixosTest {
-  name = "deploy-user-test";
-  nodes = {
-    machine = { ... }: {
-      imports = [
-        ../modules
-        ../users
-      ];
-      homelab.users.deploy.enable = true;
-      system.stateVersion = "24.11"; # Match the current nixpkgs version
-    };
-  };
-
-  testScript = ''
-    machine.wait_for_unit("multi-user.target")
-    # Verify user exists
-    machine.succeed("id deploy")
-    # Verify we can run nix-env as deploy via sudo
-    machine.succeed("sudo -u deploy -n nix-env --version")
-    # Verify switch-to-configuration is accessible (it's added to path by the module)
-    machine.succeed("whereis switch-to-configuration")
-  '';
-}