From 7e6ac9386c0740d0a3ec9f3751a4e8cdb0cd547a Mon Sep 17 00:00:00 2001
From: darshankabariya <darshan@status.im>
Date: Wed, 7 Jan 2026 16:20:35 +0530
Subject: [PATCH] ci - 5

---
 .github/workflows/ci.yml | 22 ++++++----------------
 Makefile                 | 16 +++++-----------
 2 files changed, 11 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 825f0425a..05fa76416 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,11 +69,8 @@ jobs:
           nimble-version: '0.16.3'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Nim
-        run: nimble setup --accept
-
-      - name: Make update
-        run: make update -j
+      - name: Setup dependencies
+        run: make update
 
       - name: Build binaries
         run: make V=1 QUICK_AND_DIRTY_COMPILER=1 all tools
@@ -106,11 +103,8 @@ jobs:
           nimble-version: '0.16.3'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Nim
-        run: nimble setup --accept
-
-      - name: Make update
-        run: make update -j
+      - name: Setup dependencies
+        run: make update
 
       - name: Run tests
         run: |
@@ -169,12 +163,8 @@ jobs:
           nimble-version: '0.16.3'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Nim
-        run: nimble setup --accept
-
-      - name: Build nph
-        run: |
-          make build-nph
+      - name: Setup dependencies
+        run: make update
 
       - name: Check nph formatting
         run: |
diff --git a/Makefile b/Makefile
index 829d55f27..be13207c4 100644
--- a/Makefile
+++ b/Makefile
@@ -86,13 +86,12 @@ waku.nims:
 
 # Update dependencies using Nimble
 # This is the ONLY target that should install/update Nimble packages
+# Uses nimble.lock for reproducible builds (Nim version + all dependencies locked)
 update: | waku.nims
 	@echo -e $(INFO_MSG) "Updating vendor submodules..."
 	git submodule update --init --recursive
-	@echo -e $(INFO_MSG) "Installing/updating Nimble dependencies..."
-	nimble install --depsOnly -y
-	@echo -e $(INFO_MSG) "Setting up Nimble paths..."
-	nimble setup
+	@echo -e $(INFO_MSG) "Setting up Nim and dependencies from nimble.lock..."
+	nimble setup --accept
 	@echo -e $(INFO_MSG) "Building nph formatter..."
 	$(MAKE) build-nph
 	@echo -e $(INFO_MSG) "Update complete!"
@@ -335,13 +334,8 @@ NPH_NIMBLE := $(NIMBLE_BIN_DIR)/nph
 
 build-nph: | build deps
 ifeq ("$(wildcard $(NPH))","")
-	@echo -e $(INFO_MSG) "Installing nph via Nimble..."
-	nimble install -y nph
-	@# copy binary next to Nim compiler if not already there
-	@if [ ! -f "$(NPH)" ]; then \
-		NPH_INSTALLED=$$(command -v nph 2>/dev/null || true); \
-		[ -n "$$NPH_INSTALLED" ] && cp "$$NPH_INSTALLED" "$(NPH)"; \
-	fi
+	@echo -e $(INFO_MSG) "Building nph from locked dependencies..."
+	cd $(shell nimble path nph) && nim c -d:release -o:$(NPH) src/nph.nim
 	@echo "nph utility is available at $(NPH)"
 else
 	@echo "nph utility already exists at $(NPH)"