Add Nix flake for declarative installation

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

.github/workflows/release.yml

@@ -63,3 +63,29 @@ jobs:
             dist/*.AppImage
             dist/*.deb
             dist/*.rpm
+
+      - name: Update flake.nix hashes
+        env:
+          VERSION: ${{ steps.bump.outputs.version }}
+        run: |
+          X86_HASH=$(sha256sum dist/linear-linux-${VERSION}-x86_64.AppImage | awk '{print $1}')
+          ARM_HASH=$(sha256sum dist/linear-linux-${VERSION}-arm64.AppImage | awk '{print $1}')
+
+          X86_SRI="sha256-$(echo -n "$X86_HASH" | python3 -c "import sys,base64,binascii; print(base64.b64encode(binascii.unhexlify(sys.stdin.read())).decode())")"
+          ARM_SRI="sha256-$(echo -n "$ARM_HASH" | python3 -c "import sys,base64,binascii; print(base64.b64encode(binascii.unhexlify(sys.stdin.read())).decode())")"
+
+          sed -i "s|version = \".*\";|version = \"${VERSION}\";|" flake.nix
+          sed -i "s|hash = \"sha256-.*\"; # x86_64|hash = \"${X86_SRI}\"; # x86_64|" flake.nix
+          sed -i "s|hash = \"sha256-.*\"; # aarch64|hash = \"${ARM_SRI}\"; # aarch64|" flake.nix
+
+      - name: Commit flake.nix update
+        env:
+          VERSION: ${{ steps.bump.outputs.version }}
+        run: |
+          git add flake.nix
+          if git diff --cached --quiet; then
+            echo "No changes to flake.nix"
+          else
+            git commit -m "chore: update flake.nix hashes for v${VERSION}"
+            git push
+          fi