see what we can get in GA

.github/workflows/ci.yml

@@ -7,6 +7,22 @@ on:
 permissions: read-all
 
 jobs:
+  sanity_check_current_failure_modes:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: cachix/install-nix-action@v22
+    - name: Try to ~break it?
+      run: |
+        nix profile list
+        echo hehe
+        nix profile list --profile /nix/var/nix/profiles/default
+        sudo /nix/var/nix/profiles/default/bin/nix profile remove 0 --profile /nix/var/nix/profiles/default
+        sudo /nix/var/nix/profiles/default/bin/nix profile remove 0 --profile /nix/var/nix/profiles/default
+    - uses: cachix/install-nix-action@v22
 
   tests:
     needs: [check_secrets]
@@ -98,6 +114,19 @@ jobs:
     - run: exec fish -c "nix-instantiate -E 'builtins.currentTime' --eval"
     - run: exec bash -c "nix-channel --add https://releases.nixos.org/nixos/unstable/nixos-23.05pre466020.60c1d71f2ba nixpkgs"
     - run: exec bash -c "nix-channel --update && nix-env -iA nixpkgs.hello && hello"
+    - name: clear GITHUB_PATH to simulate broken install
+      run: echo "/no/way" > $GITHUB_PATH
+    - run: echo "PATH IS $PATH"
+    - name: Try to ~break it?
+      run: |
+        nix profile list --profile /nix/var/nix/profiles/default
+        sudo /nix/var/nix/profiles/default/bin/nix profile remove 0 --profile /nix/var/nix/profiles/default
+        sudo /nix/var/nix/profiles/default/bin/nix profile remove 0 --profile /nix/var/nix/profiles/default
+    - name: Verify additional install is idempotent
+      uses: cachix/install-nix-action@v22
+      with:
+        install_url: '${{needs.installer.outputs.installerURL}}'
+        install_options: "--tarball-url-prefix https://${{ env.CACHIX_NAME }}.cachix.org/serve"
 
   docker_push_image:
     needs: [check_secrets, tests]