Skip to content

Switch to secure packages #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lucperkins wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Switch to secure packages #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6551618
Switch to secure packages
lucperkins Nov 12, 2025
d2811f3
Streamline release logic
lucperkins Nov 13, 2025
5197f48
Remove x86_64-darwin in two more places
lucperkins Nov 13, 2025
2514963
Update checkout action
lucperkins Nov 13, 2025
723a225
Standardize download-artifact action
lucperkins Nov 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/actions/download-persist.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Download and persist artifact

inputs:
arch:
type: choice
options:
- X64
- ARM64
required: true
os:
type: choice
options:
- Linux
- macOS
required: true

runs:
using: composite
steps:
- uses: actions/download-artifact@v6
with:
name: magic-nix-cache-${{ inputs.arch }}-${{ inputs.os }}
path: cache-binary-${{ inputs.arch }}-${{ inputs.os }}
- shell: bash
run: cp ./cache-binary-${{ inputs.arch }}-${{ inputs.os }}/magic-nix-cache.closure.xz ./artifacts/${{ inputs.arch }}-${{ inputs.os }}
7 changes: 2 additions & 5 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,18 +18,15 @@ jobs:
systems:
- nix-system: x86_64-linux
system: X64-Linux
runner: ubuntu-22.04
runner: ubuntu-24.04
- nix-system: aarch64-linux
system: ARM64-Linux
runner: namespace-profile-default-arm64
- nix-system: x86_64-darwin
system: X64-macOS
runner: macos-14-large
- nix-system: aarch64-darwin
system: ARM64-macOS
runner: macos-latest-xlarge
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5
- name: Install Nix on ${{ matrix.systems.system }}
uses: DeterminateSystems/determinate-nix-action@v3
- name: Set up FlakeHub Cache
Expand Down
8 changes: 3 additions & 5 deletions .github/workflows/check-and-test.yaml
View file
Open in desktop
Copy link
Copy Markdown
Member

@cole-h cole-h Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You changed the runner type in build.yaml but not here?

Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5

- name: Check health of flake.lock
uses: DeterminateSystems/flake-checker-action@main
Expand Down Expand Up @@ -51,18 +51,16 @@ jobs:
runner: ubuntu-22.04
- system: ARM64-Linux
runner: namespace-profile-default-arm64
- system: X64-macOS
runner: macos-14-large
- system: ARM64-macOS
runner: macos-latest-xlarge
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5

- name: Download closure for ${{ matrix.systems.system }}
uses: actions/download-artifact@v4.1.8
uses: actions/download-artifact@v6
with:
name: ${{ env.ARTIFACT_KEY }}
path: ${{ env.ARTIFACT_KEY }}
Expand Down
20 changes: 10 additions & 10 deletions .github/workflows/flakehub.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,21 @@
name: "Publish every Git push to main to FlakeHub"
name: Publish every Git push to main to FlakeHub

on:
push:
branches:
- "main"
- main

jobs:
flakehub-publish:
runs-on: "ubuntu-latest"
runs-on: ubuntu-latest
permissions:
id-token: "write"
contents: "read"
id-token: write
contents: read
steps:
- uses: "actions/checkout@v4"
- uses: "DeterminateSystems/determinate-nix-action@v3"
- uses: "DeterminateSystems/flakehub-push@main"
- uses: actions/checkout@v5
- uses: DeterminateSystems/determinate-nix-action@v3
- uses: DeterminateSystems/flakehub-push@main
with:
name: "DeterminateSystems/magic-nix-cache"
name: DeterminateSystems/magic-nix-cache
rolling: true
visibility: "public"
visibility: public
37 changes: 13 additions & 24 deletions .github/workflows/release-branches.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,14 @@ jobs:

release:
needs: build

concurrency: release
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write # In order to request a JWT for AWS auth
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v2
with:
Expand All @@ -32,33 +31,23 @@ jobs:
- name: Create the artifacts directory
run: rm -rf ./artifacts && mkdir ./artifacts

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-ARM64-macOS
path: cache-binary-ARM64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/ARM64-macOS

- uses: actions/download-artifact@v4.1.8
# aarch64-darwin
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-X64-macOS
path: cache-binary-X64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/X64-macOS
arch: ARM64
os: macOS

- uses: actions/download-artifact@v4.1.8
# x86_64-linux
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-X64-Linux
path: cache-binary-X64-Linux
- name: Persist the cache binary
run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/X64-Linux
arch: X64
os: Linux

- uses: actions/download-artifact@v4.1.8
# aarch64-linux
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-ARM64-Linux
path: cache-binary-ARM64-Linux
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-Linux/magic-nix-cache.closure.xz ./artifacts/ARM64-Linux
arch: ARM64
os: Linux

- uses: DeterminateSystems/push-artifact-ids@main
with:
Expand Down
36 changes: 13 additions & 23 deletions .github/workflows/release-prs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,38 +31,28 @@ jobs:
contents: read
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Create the artifacts directory
run: rm -rf ./artifacts && mkdir ./artifacts

- uses: actions/download-artifact@v4.1.8
# aarch64-darwin
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-ARM64-macOS
path: cache-binary-ARM64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/ARM64-macOS
arch: ARM64
os: macOS

- uses: actions/download-artifact@v4.1.8
# x86_64-linux
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-X64-macOS
path: cache-binary-X64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/X64-macOS
arch: X64
os: Linux

- uses: actions/download-artifact@v4.1.8
# aarch64-linux
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-X64-Linux
path: cache-binary-X64-Linux
- name: Persist the cache binary
run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/X64-Linux

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-ARM64-Linux
path: cache-binary-ARM64-Linux
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-Linux/magic-nix-cache.closure.xz ./artifacts/ARM64-Linux
arch: ARM64
os: Linux

- uses: DeterminateSystems/push-artifact-ids@main
with:
Expand Down
37 changes: 13 additions & 24 deletions .github/workflows/release-tags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,38 +19,28 @@ jobs:
id-token: write # In order to request a JWT for AWS auth
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Create the artifacts directory
run: rm -rf ./artifacts && mkdir ./artifacts

- uses: actions/download-artifact@v4.1.8
# aarch64-darwin
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-ARM64-macOS
path: cache-binary-ARM64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-macOS/magic-nix-cache.closure.xz ./artifacts/ARM64-macOS
arch: ARM64
os: macOS

- uses: actions/download-artifact@v4.1.8
# x86_64-linux
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-X64-macOS
path: cache-binary-X64-macOS
- name: Persist the cache binary
run: cp ./cache-binary-X64-macOS/magic-nix-cache.closure.xz ./artifacts/X64-macOS
arch: X64
os: Linux

- uses: actions/download-artifact@v4.1.8
# aarch64-linux
- uses: ./.github/actions/download-persist
with:
name: magic-nix-cache-X64-Linux
path: cache-binary-X64-Linux
- name: Persist the cache binary
run: cp ./cache-binary-X64-Linux/magic-nix-cache.closure.xz ./artifacts/X64-Linux

- uses: actions/download-artifact@v4.1.8
with:
name: magic-nix-cache-ARM64-Linux
path: cache-binary-ARM64-Linux
- name: Persist the cache binary
run: cp ./cache-binary-ARM64-Linux/magic-nix-cache.closure.xz ./artifacts/ARM64-Linux
arch: ARM64
os: Linux
Comment thread
lucperkins marked this conversation as resolved.

- uses: DeterminateSystems/push-artifact-ids@main
with:
Expand All @@ -63,7 +53,6 @@ jobs:
- name: Rename binaries for GH release
run: |
mv ./artifacts/{,magic-nix-cache-closure-}ARM64-macOS
mv ./artifacts/{,magic-nix-cache-closure-}X64-macOS
mv ./artifacts/{,magic-nix-cache-closure-}X64-Linux
mv ./artifacts/{,magic-nix-cache-closure-}ARM64-Linux

Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/update-flake-lock.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,11 @@ on:
jobs:
lockfile:
runs-on: ubuntu-latest
permissions:
contents: write
id-token: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5
- uses: DeterminateSystems/determinate-nix-action@v3
- uses: DeterminateSystems/flakehub-cache-action@main
- uses: DeterminateSystems/update-flake-lock@main
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5
- uses: DeterminateSystems/nix-installer-action@main
- uses: DeterminateSystems/magic-nix-cache-action@main
- run: nix flake check
Expand Down Expand Up @@ -52,7 +52,7 @@ jobs:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5
- uses: DeterminateSystems/nix-installer-action@main
- uses: DeterminateSystems/magic-nix-cache-action@main
- run: nix flake check
Expand Down
12 changes: 6 additions & 6 deletions flake.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 1 addition & 4 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,8 @@
description = "GitHub Actions-powered Nix binary cache";

inputs = {
nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1";

nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure/0";
crane.url = "https://flakehub.com/f/ipetkov/crane/*";

nix.url = "https://flakehub.com/f/NixOS/nix/=2.27.*";
};

Expand All @@ -15,7 +13,6 @@
"aarch64-linux"
"x86_64-linux"
"aarch64-darwin"
"x86_64-darwin"
];

forEachSupportedSystem = f: inputs.nixpkgs.lib.genAttrs supportedSystems (system: f rec {
Expand Down