Repository navigation
Add a shared setup-nix composite action - #3
Merged
Merged
Conversation
Consumers currently copy a setup-nix composite action into each repository. The three copies in wormhole, handoff and exosphere-zig have already drifted: different determinate-nix-action pins, different cache options, and copies that carry unrelated Zig cache steps. This action installs Nix and restores the devShell closure through nix-community/cache-nix-action. Measured on Depot runners, the restore takes 4 to 9 seconds against 24 to 31 seconds cold. DeterminateSystems/magic-nix-cache saves nothing there: the store uploads fail against the Actions cache API, and with Determinate Nix it subscribes to build events and caches nothing for substitution-only work. CI runs the action on both installer paths, and lints .github/ with zizmor and pinact. zizmor comes from its upstream action because nixpkgs carries 1.32.0, which does not build on either architecture.
The upstream-installer job restored a store where 58707 files were missing: Nix's store dedup turns duplicate files into hardlinks under /nix/store/.links, the Actions cache saves them as hardlink entries, and tar cannot restore an entry before its target. The restore dropped flake.nix along with the rest. Set `auto-optimise-store = false` on both installers so the store has no hardlinks to lose, and bump the key namespace to retire entries saved with dedup on. `nix-community/cache-nix-action` also leaves its own `primary-key` output empty, so compute the key and prefix in a step and read them from there.
zizmor 1.32.0 does not build on either architecture: aws-lc-sys asks for a system AWS-LC and the nixpkgs package does not provide one. Pin nixpkgs to 40c7d8751ffb, the last revision with 1.31.1, which builds and is in cache.nixos.org for x86_64-linux and aarch64-linux. That lets zizmor live in devShells.dev with pinact, so CI audits .github/ with the same tools a developer runs locally, and drops the zizmor action. A full revision in the URL, rather than the nixos-unstable branch, keeps the scheduled `nix flake update` from moving the pin.
The action had an `installer` input choosing between Determinate Nix and plain Nix. That was the wrong shape: the point is one way to set up Nix, and the measurement picked the winner. cachix/install-nix-action installs in 2-4s on Depot against 4-8s for determinate-nix-action. It also pins `install_url` to nix-2.35.4, so every repository runs the same Nix instead of following the latest release. pinact and Renovate do not track that line, so a bump is deliberate. The `auto-optimise-store = false` setting moves to `extra_nix_config`, which is where cachix/install-nix-action takes it.
The input URL is `nixos-unstable` again. The working revision stays in flake.lock's `locked` node, which is where a pin belongs. The scheduled flake update now names the three inputs it may move, so the nixpkgs pin survives the night. It used `nix flake update` with no arguments, which would have moved nixpkgs to HEAD and brought back the zizmor build failure. Also drops the temporary dedup diagnostic from CI.
The note claimed a mechanism for the Determinate Nix arm and an authorization conclusion from a control that ran on the wrong arm. Keep the numbers and name what is untested.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/actions/setup-nix: installs Nix and restores the devShell closure from the Actions cache.Wormhole, handoff and exosphere-zig each carry a copy of this action and they've drifted: three different
determinate-nix-actionpins, magic-nix-cache v14 in one and v15 in the others, unrelated Zig cache steps in two of them, and two different ways of authenticating private flake inputs.It installs Nix with
cachix/install-nix-actionpinned to nix-2.35.4, then restores/nixwithnix-community/cache-nix-action. For wormhole's 3.3 GiB closure that restore takes 4-9s, andnix developafterwards is 0.3-0.4s instead of about 25s.magic-nix-cacheis not used. On Depot it creates the upload blob and then every NAR chunk comes back 405 fromPUT /upload/{id}?comp=appendblock, so nothing is stored and every job stays cold.flake.lockholds nixpkgs at 40c7d875, the last revision whose zizmor builds. The nightly flake update now names the inputs it may move, so it cannot lift that pin.CI runs the action and lints
.githubwith zizmor and pinact.