The installer scripts would normally set up the various environment variables that Nix needs.
Since GitHub doesn't run any profile or rc scripts by default, we need to set these up ourselves.
Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`, and then
manually bumping the version tag to the relevant number.
This fixes the issue that it is common practice for GitHub Actions
authors to move major tags when releasing new minor versions.
Dependabot supports updating in the same fashion, bumping the version
tag when updating the hash.
Fixes the following warning:
```
Warning: the flag --darwin-use-unencrypted-nix-store-volume is no longer needed and will be removed in the future.
````
This version fixes GC bugs, which can be triggered under memory
pressure. Since GitHub runners are at times memory constraint,
it would be good to get this out.
A typical CI machine will have fast internet access, but may not have
all the inputs already in the store to rebuild trivial derivations
marked with `allowSubstitutes = false`. This leads to expensive cycles
of downloads and rebuilds for derivations like the top-level NixOS
system, which will be rebuilt from scratch on every CI run, despite
being cached.
Set `TMPDIR` if not already set to workaround potential disk space
issues while running builds in a nix shell. See NixOS/nix#395 for
more info.
fixes#197
The Nix installer produces a significant number of log messages, but
usually those messages are not really interesting. Group those messages
under a header, so that GitHub will keep them collapsed by default.
(Usually log messages are collapsed under the step title anyway, but if
this action is uses inside another composite action, there is no
separate step title, therefore the whole Nix installer output is
immediately visible when the log section for the outer composite action
is expanded. Adding the group header fixes this problem.)
sudo has stuck around since the early days of this repo when /etc/nix/nix.conf
was being created/mutated and required `sudo`. This was changed to a different/local
file where sudo is no longer needed in commit 642cfa0200.
Installs [Nix](https://nixos.org/nix/) on GitHub Actions for the supported platforms: Linux and macOS.
By default it has no nixpkgs configured, you have to set `nix_path`
by [picking a channel](https://status.nixos.org/)
or [pin nixpkgs yourself](https://nix.dev/reference/pinning-nixpkgs.html)
(see also [pinning tutorial](https://nix.dev/tutorials/towards-reproducibility-pinning-nixpkgs.html)).
Installs [Nix](https://nixos.org/nix/) on GitHub Actions runners for Linux and macOS.
# Features
- Quick installation (~4s on Linux, ~20s on macOS)
- Multi-User installation (with sandboxing enabled only on Linux)
- [Self-hosted github runner](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners) support
- Allows specifying Nix installation URL via `install_url`
- Allows specifying extra Nix configration options via `extra_nix_config`
- Quick installation (~4s on Linux / ~20s on macOS)
- Multi-user installation with sandboxing enabled by default on Linux
- Support for [self-hosted GitHub runners](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners)
- Allows specifying Nix installation URL via `install_url` (the oldest supported Nix version is 2.3.5)
- Allows specifying extra Nix configuration options via `extra_nix_config`
- Allows specifying `$NIX_PATH` and channels via `nix_path`
-Share `/nix/store` between builds using [cachix-action](https://github.com/cachix/cachix-action) for simple binary cache setup to speed up your builds and share binaries with your team
-Enables KVM on supported machines: run VMs and NixOS tests with full hardware-acceleration
- Pair with a binary cache from [cachix-action](https://github.com/cachix/cachix-action) to speed up re-builds and share binaries across your team
-`install_url`: specify URL to install Nix from (useful for testing non-stable releases or pinning Nix for example https://releases.nixos.org/nix/nix-2.3.7/install)
| Name | Description | Default |
|------|-------------|---------|
| `install_url` | URL to install Nix from. Useful for testing non-stable releases or pinning a specific Nix version (e.g., https://releases.nixos.org/nix/nix-2.3.7/install) | `""` |
| `install_options` | Additional flags to pass to the Nix installer script | `""` |
| `extra_nix_config` | Additional configuration to append to `/etc/nix/nix.conf` | `""` |
| `nix_path` | Value to set for the `NIX_PATH` environment variable (e.g., `nixpkgs=channel:nixos-unstable`) | `""` |
| `github_access_token` | GitHub token for Nix to use when pulling from GitHub repositories. Helps work around rate limit issues. Has no effect when `access-tokens` is specified in `extra_nix_config`. | `$GITHUB_TOKEN` if available |
| `set_as_trusted_user` | Add the current user to the `trusted-users` list | `true` |
| `enable_kvm` | Enable KVM for hardware-accelerated virtualization on Linux | `true` |
-`nix_path`: set `NIX_PATH` environment variable, for example `nixpkgs=channel:nixos-unstable`
-`extra_nix_config`: append to `/etc/nix/nix.conf`
## Differences from the default Nix installer
Some settings have been optimised for use in CI environments:
-`nix.conf` settings. Override these defaults with `extra_nix_config`:
- The experimental `flakes` and `nix-command` features are enabled. Disable by overriding `experimental-features` in `extra_nix_config`.
-`max-jobs` is set to `auto`.
-`show-trace` is set to `true`.
-`$USER` is added to `trusted-users`.
-`$GITHUB_TOKEN` is added to `access_tokens` if no other `github_access_token` is provided.
-`always-allow-substitutes` is set to `true`.
-`ssl-cert-file` is set to `/etc/ssl/cert.pem` on macOS.
- KVM is enabled on Linux if available. Disable by setting `enable_kvm: false`.
-`$TMPDIR` is set to `$RUNNER_TEMP` if empty.
---
## FAQ
### Is it possible to run NixOS tests / Qemu+KVM with GitHub Actions?
### How do I print the nixpkgs version I've configured?
[Currently GitHub Actions are not running on Azure instance types that support nested virtualization](https://github.com/actions/virtual-environments/issues/183#issuecomment-610723516).
### How do I print nixpkgs version with the channel I have configured?
This action doesn't set up any channels by default.
Use `nix_path` to configure optional channels by [picking a channel](https://status.nixos.org/) or [pinning nixpkgs](https://nix.dev/reference/pinning-nixpkgs) to a specific commit.
```yaml
- uses:cachix/install-nix-action@v31
with:
nix_path:nixpkgs=channel:nixos-unstable
```
Run the tests :heavy_check_mark:
```bash
$ yarn test
See also the [tutorial on pinning on nix.dev](https://nix.dev/tutorials/towards-reproducibility-pinning-nixpkgs).
### How do I configure steps to use my flake's development environment?
You can configure [`jobs.<job_id>.steps[*].shell`](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepsshell)
to use `nix develop`.
```yaml
# (optional) pre-build the shell separately to avoid skewing the run time of the next
# step and have clear point of failure should the shell fail to build
Or you can disable pure mode entirely with the `--impure` flag:
```
nix develop --impure
```
### How do I pass AWS credentials to the Nix daemon?
In multi-user mode, Nix commands that operate on the Nix store are forwarded to a privileged daemon. This daemon runs in a separate context from your GitHub Actions workflow and cannot access the workflow's environment variables. Consequently, any secrets or credentials defined in your workflow environment will not be available to Nix operations that require store access.
There are two ways to pass AWS credentials to the Nix daemon:
- Configure a default profile using the AWS CLI
- Install Nix in single-user mode
#### Configure a default profile using the AWS CLI
The Nix daemon supports reading AWS credentials from the `~/.aws/credentials` file.
We can use the AWS CLI to configure a default profile using short-lived credentials fetched using OIDC:
- name:Make AWS Credentials accessible to nix-daemon
run:|
sudo -i aws configure set aws_access_key_id "${AWS_ACCESS_KEY_ID}"
sudo -i aws configure set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"
sudo -i aws configure set aws_session_token "${AWS_SESSION_TOKEN}"
sudo -i aws configure set region "${AWS_REGION}"
```
#### Install Nix in single-user mode
In some environments it may be possible to install Nix in single-user mode by passing the `--no-daemon` flag to the installer.
This mode is normally used on platforms without an init system, like systemd, and in containerized environments with a single user that can own the entire Nix store.
This approach is more generic as it allows passing environment variables directly to Nix, including secrets, proxy settings, and other configuration options.
However, it may not be suitable for all environments. [Consult the Nix manual](https://nix.dev/manual/nix/latest/installation/nix-security) for the latest restrictions and differences between the two modes.
For example, single-user mode is currently supported on hosted Linux GitHub runners, like `ubuntu-latest`.
It is not supported on macOS runners, like `macos-latest`.
// "baseUrl": "./", /* Base directory to resolve non-absolute module names. */
// "paths": {}, /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
// "rootDirs": [], /* List of root folders whose combined content represents the structure of the project at runtime. */
// "typeRoots": [], /* List of folders to include type definitions from. */
// "types": [], /* Type declaration files to be included in compilation. */
// "allowSyntheticDefaultImports": true, /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
// "sourceRoot": "", /* Specify the location where debugger should locate TypeScript files instead of source locations. */
// "mapRoot": "", /* Specify the location where debugger should locate map files instead of generated locations. */
// "inlineSourceMap": true, /* Emit a single file with source maps instead of having a separate file. */
// "inlineSources": true, /* Emit the source alongside the sourcemaps within a single file; requires '--inlineSourceMap' or '--sourceMap' to be set. */
/*ExperimentalOptions*/
// "experimentalDecorators": true, /* Enables experimental support for ES7 decorators. */
// "emitDecoratorMetadata": true, /* Enables experimental support for emitting type metadata for decorators. */
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
