From 8c68fa1cb291649d8757cfd4f45c8d37925376f4 Mon Sep 17 00:00:00 2001 From: alexander <259883306+AlexHardAtWork@users.noreply.github.com> Date: Mon, 31 Aug 2026 15:41:51 +0200 Subject: [PATCH 1/2] feat: add setup-nix composite action --- .github/actions/setup-nix/action.yml | 35 +++++++++++++++++++++++++ README.md | 38 ++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) create mode 100644 .github/actions/setup-nix/action.yml diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml new file mode 100644 index 0000000..797b080 --- /dev/null +++ b/.github/actions/setup-nix/action.yml @@ -0,0 +1,35 @@ +name: Setup Nix +description: Install upstream Nix and enable the shared Cachix binary cache. +inputs: + cachix-name: + description: Name of the Cachix cache to use. + required: false + default: opendefensecloud + cachix-auth-token: + description: >- + Cachix auth token. Leave empty to fall back to a read-only cache, which + is what happens on fork pull requests, where secrets are unavailable. + required: false + default: '' + cachix-signing-key: + description: >- + Cachix signing key. Empty disables pushing to the cache. + required: false + default: '' +runs: + using: composite + steps: + - name: Install nix + uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 + with: + # Use upstream Nix, not the Determinate fork (avoids the + # determinate-nixd binary + FlakeHub auto-enablement we don't want). + determinate: false + # Don't post install telemetry to Determinate Systems. + diagnostic-endpoint: '' + - name: Use ${{ inputs.cachix-name }} Cachix cache + uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 + with: + name: ${{ inputs.cachix-name }} + authToken: ${{ inputs.cachix-auth-token }} + signingKey: ${{ inputs.cachix-signing-key }} diff --git a/README.md b/README.md index 6eb0729..c9540dd 100644 --- a/README.md +++ b/README.md @@ -119,6 +119,44 @@ The repository settings are configurable via make variables (set them in your `M | `REPO_STATUS_CHECKS` | `[]` | JSON array of status-check contexts that must pass (e.g. `["CI","Check action pins"]`); each job name is used as-is, so contexts with spaces work; the `required_status_checks` rule is only added when this is non-empty | | `REPO_RULESET_BRANCHES` | `[]` | JSON array of additional branch patterns the ruleset applies to (e.g. `["release/*"]`); short names are normalized to `refs/heads/...`; the default branch is always protected | +### GitHub Actions + +The repo ships composite actions that consuming repositories reference directly. +Pin them to a SHA with a version comment, as the action-pin check requires: + +| Action | Description | +| --- | --- | +| `.github/actions/setup-nix` | Install upstream Nix and enable the shared Cachix cache | +| `.github/actions/get-go-version` | Extract the Go version from `flake.nix` | +| `.github/actions/diff-check` | Fail if a command left uncommitted changes behind | + +`setup-nix` replaces the two-step Nix installer + Cachix preamble that every +job needs before it can use `nix develop` as its shell. Secrets are not visible +inside a composite action, so the caller passes them in: + +```yaml +jobs: + build: + runs-on: ubuntu-24.04 + defaults: + run: + shell: nix develop --command bash -e {0} + steps: + - uses: actions/checkout@... # v7 + - name: Set up nix + uses: opendefensecloud/dev-kit/.github/actions/setup-nix@... # v2.1.0 + with: + cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} + cachix-signing-key: ${{ secrets.CACHIX_SIGNING_KEY }} + - run: make test +``` + +| Input | Default | Description | +| --- | --- | --- | +| `cachix-name` | `opendefensecloud` | Cachix cache to use | +| `cachix-auth-token` | `''` | Auth token; empty falls back to a read-only cache, as on fork PRs | +| `cachix-signing-key` | `''` | Signing key; empty disables pushing to the cache | + ### Default git hooks The dev shell installs the following git hooks automatically: From 36ec2aad9d8ce5869713950605ab97dcb57321ec Mon Sep 17 00:00:00 2001 From: alexander <259883306+AlexHardAtWork@users.noreply.github.com> Date: Mon, 31 Aug 2026 18:12:25 +0200 Subject: [PATCH 2/2] docs: clarify setup-nix pins and upstream-Nix sunset --- .github/actions/setup-nix/action.yml | 4 ++++ README.md | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml index 797b080..dc759fe 100644 --- a/.github/actions/setup-nix/action.yml +++ b/.github/actions/setup-nix/action.yml @@ -24,6 +24,10 @@ runs: with: # Use upstream Nix, not the Determinate fork (avoids the # determinate-nixd binary + FlakeHub auto-enablement we don't want). + # Upstream announced this option would stop working on 2026-01-01; + # nix-installer still honours --prefer-upstream-nix as of 2026-08-31, + # but the action always fetches the latest installer, so this is not + # pinned. If it ever flips, this is the one place to change. determinate: false # Don't post install telemetry to Determinate Systems. diagnostic-endpoint: '' diff --git a/README.md b/README.md index c9540dd..333b15e 100644 --- a/README.md +++ b/README.md @@ -122,7 +122,8 @@ The repository settings are configurable via make variables (set them in your `M ### GitHub Actions The repo ships composite actions that consuming repositories reference directly. -Pin them to a SHA with a version comment, as the action-pin check requires: +Pin them to a SHA with a version comment, as the action-pin check requires. The +`<40-char-sha>` placeholders below are not copy-pasteable — substitute real digests: | Action | Description | | --- | --- | @@ -142,9 +143,9 @@ jobs: run: shell: nix develop --command bash -e {0} steps: - - uses: actions/checkout@... # v7 + - uses: actions/checkout@<40-char-sha> # v7 - name: Set up nix - uses: opendefensecloud/dev-kit/.github/actions/setup-nix@... # v2.1.0 + uses: opendefensecloud/dev-kit/.github/actions/setup-nix@<40-char-sha> # v2.1.0 with: cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} cachix-signing-key: ${{ secrets.CACHIX_SIGNING_KEY }}