ci(nix): build PRs that touch the PipeWire and whisper sources, and assert the libEGL rpath

[EtienneLescot]

Summary

Two gaps in nix-build.yml, both found while working #533 and #531.

• The pull_request path filter misses sources the derivations read. nix/pipewire-helper.nix builds electron/native/pipewire-capture, nix/whisper-stt.nix builds electron/native/whisper-stt, and nix/package.nix runs npx vite build and copies public/wallpapers unguarded. No other workflow compiles the PipeWire crate, so fix(linux): validate mapped DMA-BUF frames #386 and fix(capture-linux): measure the cursor against the window, not its mo… #514 changed it and merged with no nix build on the PR. This adds those four paths, and drops the header comment that still says the workflow is "deliberately not on every pull request yet".
• The dlopen RPATH assertion covers libpipewire, not libEGL. csrc/dmabuf_modifiers.c loads libEGL.so.1 at runtime, and nix/pipewire-helper.nix adds libglvnd to the helper's RPATH for it. Nothing checked that entry, and ubuntu-latest's system libEGL would satisfy the dlopen anyway, so losing it would go unnoticed. This adds the same check_dlopen_rpath assertion already used for libpipewire.

Related issue

Fixes #533
Refs #531

Type of change

• Refactor / maintenance

Release impact

• No release note needed

Desktop impact

• Linux
• Installer / packaging

Testing

• Both changes apply cleanly on main, and the workflow file parses as YAML with its 10 pull_request paths.
• The entry the new assertion checks was verified on a real nix build .#pipewire-helper of main (fedf576) under Nix in WSL: exit 0, the helper's DT_RPATH ends with /nix/store/…-libglvnd-1.7.0/lib, and a probe binary built with that exact RPATH resolves dlopen("libEGL.so.1") to the libglvnd store path.
• This PR edits nix-build.yml, which is in its own path filter, so the workflow runs on it. That run is the first real exercise of the new assertion.
• Not covered: the filter change itself is only proven by the next PR touching one of the new paths. The filter still deliberately leaves out src/ and electron/, which the push to main covers, so a PR that breaks the smoke test from application code will still only show it on main.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}