From 013de8dc35da2229e8e7e693d8b2f5c25cbe75b1 Mon Sep 17 00:00:00 2001
From: TsunamiNoAi <spam@falseblue.com>
Date: Sat, 6 Jun 2026 12:31:23 -0400
Subject: [PATCH] =?UTF-8?q?fix:=20align=20release=20build=20job=20with=20C?=
 =?UTF-8?q?I=20=E2=80=94=20sandbox=3Dfalse,=20zigmark-safe=20target?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

aarch64-linux was failing because:
1. Missing sandbox=false caused zig2nix to fail building from source
   when the FlakeHub cache returned 401 (same fix CI already has)
2. nix build (debug default) has a different dep closure than zigmark-safe;
   using the same target as CI ensures consistent behaviour
Also bumps checkout to v6 to match CI.
---
 .github/workflows/release.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8d02f3f..c026948 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,10 +28,13 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@v3
+        with:
+          extra-conf: |
+            sandbox = false
 
       - name: Setup Nix cache
         uses: DeterminateSystems/flakehub-cache-action@v3
@@ -40,7 +43,7 @@ jobs:
           flakehub-flake-name: "sc2in/ZigMark"
 
       - name: Build
-        run: nix build
+        run: nix build .#zigmark-safe -o result
 
       - name: Package
         run: |