Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`, and then
manually bumping the version tag to the relevant number.
This fixes the issue that it is common practice for GitHub Actions
authors to move major tags when releasing new minor versions.
Dependabot supports updating in the same fashion, bumping the version
tag when updating the hash.
Fixes the following warning:
```
Warning: the flag --darwin-use-unencrypted-nix-store-volume is no longer needed and will be removed in the future.
````
This version fixes GC bugs, which can be triggered under memory
pressure. Since GitHub runners are at times memory constraint,
it would be good to get this out.
A typical CI machine will have fast internet access, but may not have
all the inputs already in the store to rebuild trivial derivations
marked with `allowSubstitutes = false`. This leads to expensive cycles
of downloads and rebuilds for derivations like the top-level NixOS
system, which will be rebuilt from scratch on every CI run, despite
being cached.
Set `TMPDIR` if not already set to workaround potential disk space
issues while running builds in a nix shell. See NixOS/nix#395 for
more info.
fixes#197
The Nix installer produces a significant number of log messages, but
usually those messages are not really interesting. Group those messages
under a header, so that GitHub will keep them collapsed by default.
(Usually log messages are collapsed under the step title anyway, but if
this action is uses inside another composite action, there is no
separate step title, therefore the whole Nix installer output is
immediately visible when the log section for the outer composite action
is expanded. Adding the group header fixes this problem.)
Installs [Nix](https://nixos.org/nix/) on GitHub Actions for the supported platforms: Linux and macOS.
By default it has no nixpkgs configured, you have to set `nix_path`
by [picking a channel](https://status.nixos.org/)
or [pin nixpkgs yourself](https://nix.dev/reference/pinning-nixpkgs.html)
(see also [pinning tutorial](https://nix.dev/tutorials/towards-reproducibility-pinning-nixpkgs.html)).
or [pin nixpkgs yourself](https://nix.dev/reference/pinning-nixpkgs)
(see also [pinning tutorial](https://nix.dev/tutorials/towards-reproducibility-pinning-nixpkgs)).
# Features
- Quick installation (~4s on Linux, ~20s on macOS)
- Multi-User installation (with sandboxing enabled only on Linux)
- [Self-hosted github runner](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners) support
- [Self-hosted GitHub runner](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners) support
- Allows specifying Nix installation URL via `install_url` (the oldest supported Nix version is 2.3.5)
- Allows specifying extra Nix configration options via `extra_nix_config`
- Allows specifying extra Nix configuration options via `extra_nix_config`
- Allows specifying `$NIX_PATH` and channels via `nix_path`
- Share `/nix/store` between builds using [cachix-action](https://github.com/cachix/cachix-action) for simple binary cache setup to speed up your builds and share binaries with your team
- Enables `flakes` and `nix-command` experimental features by default (to disable, set ``experimental-features`` via ``extra_nix_config``)
- Enables KVM on supported machines: run VMs and NixOS tests with full hardware-acceleration
@ -65,11 +63,44 @@ To install Nix from any commit, go to [the corresponding installer_test action](
## Inputs (specify using `with:`)
- `install_url`: specify URL to install Nix from (useful for testing non-stable releases or pinning Nix for example https://releases.nixos.org/nix/nix-2.3.7/install)
- `extra_nix_config`: append to `/etc/nix/nix.conf`
- `github_access_token`: configure Nix to pull from GitHub using the given GitHub token. This helps work around rate limit issues. Has no effect when `access-tokens` is also specified in `extra_nix_config`.
- `install_url`: specify URL to install Nix from (useful for testing non-stable releases or pinning Nix, for example https://releases.nixos.org/nix/nix-2.3.7/install)
- `install_options`: additional installer flags passed to the installer script.
- `nix_path`: set `NIX_PATH` environment variable, for example `nixpkgs=channel:nixos-unstable`
- `extra_nix_config`: append to `/etc/nix/nix.conf`
- `enable_kvm`: whether to enable KVM for hardware-accelerated virtualization on Linux. Enabled by default if available.
- `set_as_trusted_user`: whether to add the current user to `trusted-users`. Enabled by default.
## Differences from the default Nix installer
Some settings have been optimised for use in CI environments:
- `nix.conf` settings. Override these defaults with `extra_nix_config`:
- The experimental `flakes` and `nix-command` features are enabled. Disable by overriding `experimental-features` in `extra_nix_config`.
- `max-jobs` is set to `auto`.
- `show-trace` is set to `true`.
- `$USER` is added to `trusted-users`.
- `$GITHUB_TOKEN` is added to `access_tokens` if no other `github_access_token` is provided.
- `always-allow-substitutes` is set to `true`.
- `ssl-cert-file` is set to `/etc/ssl/cert.pem` on macOS.
- KVM is enabled on Linux if available. Disable by setting `enable_kvm: false`.
- `$TMPDIR` is set to `$RUNNER_TEMP` if empty.
---
@ -77,25 +108,23 @@ To install Nix from any commit, go to [the corresponding installer_test action](
### How do I print nixpkgs version I have configured?
Or you can disable pure mode entirely with the `--impure` flag:
```
nix develop --impure
```
Run the tests :heavy_check_mark:
```bash
$ yarn test
### How do I pass AWS credentials to the Nix daemon?
In multi-user mode, Nix commands that operate on the Nix store are forwarded to a privileged daemon. This daemon runs in a separate context from your GitHub Actions workflow and cannot access the workflow's environment variables. Consequently, any secrets or credentials defined in your workflow environment will not be available to Nix operations that require store access.
There are two ways to pass AWS credentials to the Nix daemon:
- Configure a default profile using the AWS CLI
- Install Nix in single-user mode
#### Configure a default profile using the AWS CLI
The Nix daemon supports reading AWS credentials from the `~/.aws/credentials` file.
We can use the AWS CLI to configure a default profile using short-lived credentials fetched using OIDC:
- name: Make AWS Credentials accessible to nix-daemon
run: |
sudo -i aws configure set aws_access_key_id "${AWS_ACCESS_KEY_ID}"
sudo -i aws configure set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"
sudo -i aws configure set aws_session_token "${AWS_SESSION_TOKEN}"
sudo -i aws configure set region "${AWS_REGION}"
```
#### Install Nix in single-user mode
In some environments it may be possible to install Nix in single-user mode by passing the `--no-daemon` flag to the installer.
This mode is normally used on platforms without an init system, like systemd, and in containerized environments with a single user that can own the entire Nix store.
This approach is more generic as it allows passing environment variables directly to Nix, including secrets, proxy settings, and other configuration options.
However, it may not be suitable for all environments. [Consult the Nix manual](https://nix.dev/manual/nix/latest/installation/nix-security) for the latest restrictions and differences between the two modes.
For example, single-user mode is currently supported on hosted Linux GitHub runners, like `ubuntu-latest`.
It is not supported on macOS runners, like `macos-latest`.
