determinatesystems / nix-installer-action Goto Github PK

View Code? Open in Web Editor NEW

136.0 5.0 14.0 3.09 MB

The Github Action for the Determinate Nix Installer

Home Page: https://github.com/determinateSystems/nix-installer

License: GNU Lesser General Public License v2.1

TypeScript 95.45% Nix 2.94% Dockerfile 1.62%

actions flakes install nix

nix-installer-action's Issues

Proposal: default github-token to github.token

Howdy,

Thanks for your work on nix-installer and this action! I'm rooting for the success of both projects 🙂

I noticed the readme recommends supplying the github-token input, otherwise "you will likely get rate limited."

Have you considered defaulting github-token to the github.token value from the github context? This would improve the ergonomics of using the action:

    - name: Install Nix
      uses: DeterminateSystems/nix-installer-action@main

though it would change the semantics of the current implementation. I'm not sure how strongly the maintainers feel about keeping the current behavior, which makes it possible to avoid authenticated requests.

Though, one option would be to explicitly opt out of authenticated requests, maybe with an input like:

    - name: Install Nix
      uses: DeterminateSystems/nix-installer-action@main
      with:
        github-token: ""

    - name: Install Nix
      uses: DeterminateSystems/nix-installer-action@main
      with:
        use-unauthenticated-requests: true

What do you think? I'm happy to open a PR if this aligns with the direction of the project.

Cheers!

Compare to other install actions

Is there a comparison between the different installer actions?

I'd like to know what I gain or loose by using this action over eg. the one by cachix.

Configuring Docker Shim aborts with Docker invocation on ARC

I wanted to try out the installer action on our recently setup actions-runner-controller. Sadly it failed while setting up the docker shim.

docker-runner: 2.312.0
actions-runner-controller: 0.27.5

I could't trace the line in src/main.ts where docker is failing.

Nix-installer   Run docker info 2024-01-31T08:47:51.8813172Z ##[group]Run docker info
Nix-installer   Run docker info 2024-01-31T08:47:51.8813666Z docker info
Nix-installer   Run docker info 2024-01-31T08:47:51.8821211Z shell: /usr/bin/bash -e {0}
Nix-installer   Run docker info 2024-01-31T08:47:51.8821625Z ##[endgroup]
Nix-installer   Run docker info 2024-01-31T08:47:51.9301635Z Client:
Nix-installer   Run docker info 2024-01-31T08:47:51.9311729Z  Version:    24.0.7
Nix-installer   Run docker info 2024-01-31T08:47:51.9312458Z  Context:    default
Nix-installer   Run docker info 2024-01-31T08:47:51.9313060Z  Debug Mode: false
Nix-installer   Run docker info 2024-01-31T08:47:51.9313666Z  Plugins:
Nix-installer   Run docker info 2024-01-31T08:47:51.9314287Z   compose: Docker Compose (Docker Inc.)
Nix-installer   Run docker info 2024-01-31T08:47:51.8821625Z ##[endgroup]
Nix-installer   Run docker info 2024-01-31T08:47:51.9301635Z Client:
Nix-installer   Run docker info 2024-01-31T08:47:51.9311729Z  Version:    24.0.7
Nix-installer   Run docker info 2024-01-31T08:47:51.9312458Z  Context:    default
Nix-installer   Run docker info 2024-01-31T08:47:51.9313060Z  Debug Mode: false
Nix-installer   Run docker info 2024-01-31T08:47:51.9313666Z  Plugins:
Nix-installer   Run docker info 2024-01-31T08:47:51.9314287Z   compose: Docker Compose (Docker Inc.)
Nix-installer   Run docker info 2024-01-31T08:47:51.9315073Z     Version:  v2.23.0
Nix-installer   Run docker info 2024-01-31T08:47:51.9316190Z     Path:     /usr/libexec/docker/cli-plugins/docker-compose
Nix-installer   Run docker info 2024-01-31T08:47:51.9317057Z
Nix-installer   Run docker info 2024-01-31T08:47:51.9317367Z Server:
Nix-installer   Run docker info 2024-01-31T08:47:51.9317955Z  Containers: 0
Nix-installer   Run docker info 2024-01-31T08:47:51.9318640Z   Running: 0
Nix-installer   Run docker info 2024-01-31T08:47:51.9319240Z   Paused: 0
Nix-installer   Run docker info 2024-01-31T08:47:51.9319833Z   Stopped: 0
Nix-installer   Run docker info 2024-01-31T08:47:51.9320459Z  Images: 0
Nix-installer   Run docker info 2024-01-31T08:47:51.9321076Z  Server Version: 24.0.7
Nix-installer   Run docker info 2024-01-31T08:47:51.9321827Z  Storage Driver: overlay2
Nix-installer   Run docker info 2024-01-31T08:47:51.9322592Z   Backing Filesystem: xfs
Nix-installer   Run docker info 2024-01-31T08:47:51.9323465Z   Supports d_type: true
Nix-installer   Run docker info 2024-01-31T08:47:51.9324210Z   Using metacopy: false
Nix-installer   Run docker info 2024-01-31T08:47:51.9324971Z   Native Overlay Diff: true
Nix-installer   Run docker info 2024-01-31T08:47:51.9325748Z   userxattr: false
Nix-installer   Run docker info 2024-01-31T08:47:51.9326650Z  Logging Driver: json-file
Nix-installer   Run docker info 2024-01-31T08:47:51.9327474Z  Cgroup Driver: cgroupfs
Nix-installer   Run docker info 2024-01-31T08:47:51.9328192Z  Cgroup Version: 1
Nix-installer   Run docker info 2024-01-31T08:47:51.9328985Z  Plugins:
Nix-installer   Run docker info 2024-01-31T08:47:51.9329483Z   Volume: local
Nix-installer   Run docker info 2024-01-31T08:47:51.9330199Z   Network: bridge host ipvlan macvlan null overlay
Nix-installer   Run docker info 2024-01-31T08:47:51.9332044Z   Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Nix-installer   Run docker info 2024-01-31T08:47:51.9332950Z  Swarm: inactive
Nix-installer   Run docker info 2024-01-31T08:47:51.9333324Z  Runtimes: io.containerd.runc.v2 runc
Nix-installer   Run docker info 2024-01-31T08:47:51.9333782Z  Default Runtime: runc
Nix-installer   Run docker info 2024-01-31T08:47:51.9334203Z  Init Binary: docker-init
Nix-installer   Run docker info 2024-01-31T08:47:51.9334700Z  containerd version: 091922f03c2762540fd057fba91260237ff86acb
Nix-installer   Run docker info 2024-01-31T08:47:51.9335354Z  runc version: v1.1.9-0-gccaecfc
Nix-installer   Run docker info 2024-01-31T08:47:51.9335775Z  init version: de40ad0
Nix-installer   Run docker info 2024-01-31T08:47:51.9336394Z  Security Options:
Nix-installer   Run docker info 2024-01-31T08:47:51.9336718Z   seccomp
Nix-installer   Run docker info 2024-01-31T08:47:51.9337102Z    Profile: builtin
Nix-installer   Run docker info 2024-01-31T08:47:51.9337565Z  Kernel Version: 5.10.197-186.748.amzn2.x86_64
Nix-installer   Run docker info 2024-01-31T08:47:51.9338156Z  Operating System: Alpine Linux v3.19 (containerized)
Nix-installer   Run docker info 2024-01-31T08:47:51.9338689Z  OSType: linux
Nix-installer   Run docker info 2024-01-31T08:47:51.9338994Z  Architecture: x86_64
Nix-installer   Run docker info 2024-01-31T08:47:51.9339327Z  CPUs: 2
Nix-installer   Run docker info 2024-01-31T08:47:51.9339619Z  Total Memory: 7.544GiB
Nix-installer   Run docker info 2024-01-31T08:47:51.9340061Z  Name: k8s-action-runner-gxfqk-zlcm8
Nix-installer   Run docker info 2024-01-31T08:47:51.9340615Z  ID: 5a8303f3-5736-4edf-b365-dc5eccd07f41
Nix-installer   Run docker info 2024-01-31T08:47:51.9341099Z  Docker Root Dir: /var/lib/docker
Nix-installer   Run docker info 2024-01-31T08:47:51.9341500Z  Debug Mode: false
Nix-installer   Run docker info 2024-01-31T08:47:51.9341834Z  Experimental: false
Nix-installer   Run docker info 2024-01-31T08:47:51.9342186Z  Insecure Registries:
Nix-installer   Run docker info 2024-01-31T08:47:51.9342504Z   127.0.0.0/8
Nix-installer   Run docker info 2024-01-31T08:47:51.9342820Z  Live Restore Enabled: false
Nix-installer   Run docker info 2024-01-31T08:47:51.9343250Z  Product License: Community Engine
Nix-installer   Run docker info 2024-01-31T08:47:51.9343556Z
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9464264Z ##[group]Run DeterminateSystems/nix-installer-action@main
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9464958Z with:
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9465403Z   start-daemon: false
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9465921Z   flakehub: false
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9466357Z   force-docker-shim: false
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9467126Z   github-token: ***
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9467615Z   github-server-url: https://github.com
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9468117Z   kvm: true
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9468548Z   modify-profile: true
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9468989Z   reinstall: false
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9469624Z   diagnostic-endpoint: https://install.determinate.systems/nix/diagnostic
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9470651Z   trust-runner-user: true
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:51.9471199Z ##[endgroup]
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1182349Z ##[group]Enabling the Docker shim for running Nix on Linux in CI without Systemd.
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1184798Z Changing init from 'null' to 'none'
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1186482Z Changing planner from 'null' to 'linux'
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1188400Z ##[endgroup]
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1189952Z ##[group]Configuring KVM
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1361384Z [command]/usr/bin/sudo rm -f /etc/udev/rules.d/99-determinate-nix-installer-kvm.rules
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1497965Z ##[endgroup]
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1499260Z KVM is not available.
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1501217Z ##[group]Installing Nix
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:52.1504333Z Fetching binary from https://install.determinate.systems/nix/nix-installer-x86_64-linux?ci=github&correlation=GH-cc60063f-c695-40bf-81c0-
33cbaaf6d95b
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:53.7755374Z [command]/runner/_work/_temp/5c79da76-e711-44c1-b2d3-425f8ef55409 install linux
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:53.7837472Z `nix-installer` needs to run as `root`, attempting to escalate now via `sudo`...
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:53.7994300Z  INFO Step: Create directory `/nix`
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:53.8016743Z  INFO Step: Provision Nix
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:56.1587105Z  INFO Step: Create build users (UID 30001-30032) and group (GID 30000)
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.0002951Z  INFO Step: Configure Nix
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.1275128Z  INFO Step: Create directory `/etc/tmpfiles.d`
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.1276616Z  INFO Step: Leave the Nix daemon unconfigured
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.1278257Z  INFO Step: Remove directory `/nix/temp-install-dir`
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.7742640Z Nix was installed successfully!
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.7746050Z To get started using Nix, open a new shell or run `. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh`
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.7747686Z
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.7767801Z ##[endgroup]
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.7770572Z ##[group]Configuring the Docker shim as the Nix Daemon's process supervisor
Nix-installer   Run DeterminateSystems/nix-installer-action@main        2024-01-31T08:47:57.8499036Z ##[error]Error: The process '/usr/local/bin/docker' failed with exit code 125
Nix-installer   Post Run DeterminateSystems/nix-installer-action@main   2024-01-31T08:47:57.8740941Z Post job cleanup.
Nix-installer   Post Run DeterminateSystems/nix-installer-action@main   2024-01-31T08:47:58.0345782Z ##[group]Enabling the Docker shim for running Nix on Linux in CI without Systemd.
Nix-installer   Post Run DeterminateSystems/nix-installer-action@main   2024-01-31T08:47:58.0347304Z Changing init from 'null' to 'none'
Nix-installer   Post Run DeterminateSystems/nix-installer-action@main   2024-01-31T08:47:58.0348239Z Changing planner from 'null' to 'linux'
Nix-installer   Post Run DeterminateSystems/nix-installer-action@main   2024-01-31T08:47:58.0349455Z ##[endgroup]
Nix-installer   Post Run DeterminateSystems/nix-installer-action@main   2024-01-31T08:47:58.0378552Z Added `/nix/var/nix/profiles/default/bin` and `/home/runner/.nix-profile/bin` to `$GITHUB_PATH`
Nix-installer   Post Run DeterminateSystems/nix-installer-action@main   2024-01-31T08:47:58.0380150Z Nix was already installed, using existing install

`experimental-features` is not considered but `extra-experimental-features` is?

I noticed that setting experimental-features in extra-conf has no effect, however, setting extra-experimental-features does. Is this expected behaviour? Could this be because by default it is set to include flakes?

name: "CI using nix"

on:
    push:
      branches:
        - develop
        - main

    pull_request:
      branches:
        - develop
        - main

jobs:
    check:
        runs-on: ubuntu-22.04
        steps:
        - uses: actions/checkout@v3
        - uses: DeterminateSystems/nix-installer-action@main
          with:
            extra-conf: |
              extra-experimental-features = nix-command flakes impure-derivations ca-derivations
        - uses: DeterminateSystems/magic-nix-cache-action@main
        - run: nix flake check

Action shouldn't require sudo

sudo is used to set up KVM (even when KVM isn't present, like with ACT, like on forgejo/gitea actions).

Installing it makes the action work, but folks on the Discord told me it shouldn't be required so, here's your issue to track it!

nix binary not on PATH within post-build-hook script (macos)

Tried this on: macos-12 and macos-13-xlarge with identical results

I'm using default installer configuration

    - uses: DeterminateSystems/nix-installer-action@main

In following step I set post-build-hook (which invokes nix copy) in /etc/nix/nix.conf and restart nix daemon with:

sudo launchctl stop org.nixos.nix-daemon
sudo launchctl start org.nixos.nix-daemon

I then build a package with nix-build and see the following:

post-build-hook: /Users/runner/.config/nix/upload-to-cache.sh: line 28: nix: command not found
error: program '/Users/runner/.config/nix/upload-to-cache.sh' failed with exit code 127

`max-jobs` is 1

nix show-config | grep max-jobs is set to 1 on github actions. Isn't this a cause for concern? Because that would limit the number of concurrent downloads to being 1, slowing down the CI job as a consequence.

https://github.com/srid/nix-health/actions/runs/5743692748/job/15568517152#step:4:79

Consider using tool-cache

We may be able to use https://github.com/actions/toolkit/tree/main/packages/tool-cache to use some github smart caching and simplify some code.

Currently the issue is that we can't easily know when to cachebust, since the action typically gets the latest installer. Unfortunately the tool cache doesn't seem to have expiry settings, so it's hard to properly judge when the user should get a new nix-installer binary.

Action should work under nektos/act, in the absence of systemd & docker

What main does at the time I'm opening this is: notice systemd isn't there, try to run docker info and immediately fail because I think either of "docker isn't in PATH" or "docker info" returned a non-zero exit code end up throwing instead of just returning from detectAndForceDockerShim.

On Discord, @grahamc suggested trying v8, which happened to be "after Act workarounds were added" but "before GHE (GitHub Enterprise) stuff was added" and that version does work under act, it's only affected by #62.

Retry fetching the installer

I'm seeing sporadic failures with this action: https://github.com/lovesegfault/nix-config/actions/runs/6520438910/job/17708001569?pr=3060

It appears to be due to stochastic failure to fetch the installer binary, and could be mitigated with a retry cycle.

Switching from cachix/install-nix-action to DS/nix-installer-action results in failing workflow

I'm trying to switch from cachix/install-nix-action to DeterminateSystems/nix-installer-action but as I do so, my github actions workflows start failing. The failure itself seems to revolve around a "NAR hash mismatch". It's unclear what's causing this and the workflow in the main branch (which uses cachix/install-nix-action) has no such problem.

See https://github.com/johnae/world/actions/runs/8108519078/job/22161884416 and johnae/world#720 for more.

Thanks.

Error starting Nix daemon through Docker inside `act`

From discord, heres the output when running nix-installer-action via act (on the fully-featured image):

[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   💬  ::debug::download complete
| Detected `$ACT` environment, assuming this is a https://github.com/nektos/act created container, set `NOT_ACT=true` to override this. This will change the setting of the `init` to be compatible with `act`
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   💬  ::debug::Execution environment: {%0A    "NIX_INSTALLER_NO_CONFIRM": "true",%0A    "NIX_INSTALLER_DIAGNOSTIC_ATTRIBUTION": "GH-c47505c2-696f-4673-90c7-c17aedf358eb",%0A    "NIX_INSTALLER_MODIFY_PROFILE": "true",%0A    "NIX_INSTALLER_DIAGNOSTIC_ENDPOINT": "https://install.determinate.systems/nix/diagnostic",%0A    "NIX_INSTALLER_INIT": "none",%0A    "NIX_INSTALLER_START_DAEMON": "true",%0A    "NIX_INSTALLER_EXTRA_CONF": "trusted-users = root root\n"%0A}
| [command]/tmp/0e573188-ff00-4f89-8af9-d52b236b2898 install linux
|  INFO Step: Create directory `/nix`
|  INFO Step: Provision Nix
|  INFO Step: Create build users (UID 30000-30032) and group (GID 30000)
|  INFO Step: Configure Nix
|  INFO Step: Create directory `/etc/tmpfiles.d`
|  INFO Step: Leave the Nix daemon unconfigured
|  INFO Step: Remove directory `/nix/temp-install-dir`
|  WARN SelfTest([ShellFailed { shell: Sh, command: "\"sh\" \"-lc\" \"nix build --no-link --expr \\'derivation { name = \\\"self-test-sh-1701955359511\\\"; system = \\\"x86_64-linux\\\"; builder = \\\"/bin/sh\\\"; args = [\\\"-c\\\" \\\"echo hello > \\\\$out\\\"]; }\\'\"", output: Output { status: ExitStatus(unix_wait_status(512)), stdout: "", stderr: "sh: 10: .: cannot open /etc/skel/.cargo/env: No such file\n" } }])
| Nix was installed successfully!
| To get started using Nix, open a new shell or run `. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh`
| 
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   ❓  ::endgroup::
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   ❓  ::group::Configuring the Docker shim as the Nix Daemon's process supervisor
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   💬  ::debug::Loading image: determinate-nix-shim:latest...
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   💬  ::debug::Loaded image: determinate-nix-shim:latest
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   💬  ::debug::Starting the Nix daemon through Docker...
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   💬  ::debug::07b80d704386e4f1b51c620ae47f21f2b165f49450c37c053b82dae2d663290f
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   💬  ::debug::docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "/nix/var/nix/profiles/default/bin/nix-daemon": stat /nix/var/nix/profiles/default/bin/nix-daemon: no such file or directory: unknown.
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   ❗  ::error::Error: The process '/usr/bin/docker' failed with exit code 127
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   ❌  Failure - Main DeterminateSystems/nix-installer-action@main
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   ⚙  ::set-env:: DETERMINATE_NIX_KVM=0
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   ⚙  ::add-path:: /nix/var/nix/profiles/default/bin
[nix_p4-fusion/Build p4-fusion x86_64-linux  ]   ⚙  ::add-path:: /home/runner/.nix-profile/bin
[nix_p4-fusion/Build p4-fusion x86_64-linux  ] exitcode '1': failure

Local machine is x86_64-linux NixOS. Issue happened on both v8 and v9 pin, and both rootless and rootful docker

`$HOME/.nix-profile/bin` not in PATH

This causes cachix-action to fail when using Nix 2.15: cachix/cachix-action#146

I think echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH" is warranted somewhere, though I am uncertain whether that should happen here or in the installer.

Nix daemon doesn't start in a specific GitHub Enterprise Server environment.

I am getting this error while using the nix installer action. I am really mystified by what is happening, because I am using this action in two different repositories. In one repository the action works fine, and I don't have any issues. In another repository I am getting the issue title as an error.

Here is the github action workflow yaml. I am sure this will be confusing, but I am on GitHub Enterprise Server, and my work has strict rules around which actions we use. I am using GitHub Actions Sync to bring public actions into GHES.

- name: Install Nix
   uses: redacted-actions/nix-installer-action@main
   with:
     init: none
     planner: linux
     
- uses: redacted-actions/magic-nix-cache-action@main

- name: Get all changed and modified yaml files
  id: changed_files
  uses: redacted-actions/changed-files@v38
  with:
    files: |
      **/*.yml
      **/*.yaml
    separator: " "

- name: Run yamllint
  run: |
    nix develop --command yamllint -c .yamllint.yaml ${{ steps.changed_files.outputs.all_changed_files }}

The workflow fails on the Run yamllint step, and throws the error error: could not set permissions on '/nix/var/nix/profiles/per-user' to 755: Operation not permitted

In the repository where things work, I am using a pretty similar invocation, but without the usage of nix develop. I added a test nix develop invocation, and that also fails with error: could not set permissions on '/nix/var/nix/profiles/per-user' to 755: Operation not permitted.

Any idea what could be going on?

Add instructions for self-hosted NixOS runners

I attempted the following:

Set up a self-hosted runner on a NixOS host: services/github-runner.nix
Changed by workflow to use that runner: https://github.com/lovesegfault/nix-config/pull/3052/files#diff-944291df2c9c06359d37cc8833d182d705c9e8c3108e7cfe132d61a06e9133ddR85-R86
Kicked off CI: https://github.com/lovesegfault/nix-config/actions/runs/6496771196

But this action failed: https://github.com/lovesegfault/nix-config/actions/runs/6496771196/job/17644474420

I could just guard the action with an if, and expose the host's Nix to the runner, but I wanted to keep things identical to the GitHub-hosted runners, if at all possible.

Error

Error: 
   0: Executing `nix-installer` as `root` via `sudo`
   1: ENOENT: No such file or directory

Metadata

key	value
version	0.13.1
os	linux
arch	x86_64

unversioned binary download, dependency on install.determinate.systems

Hi, thanks for creating this project and nix-installer. I managed to use the action successfully but have some concerns:

the hard dependency on install.determinate.systems (all workflows using this action would break if your server / hoster is unavailable)
the action is fetching unversioned binaries according to the log -> https://install.determinate.systems/nix/nix-installer-x86_64-linux?ci=github&correlation=GH-...
the action requires sudo, the v10 changelog has a point about not requiring sudo anymore but when using step-security/harden-runner to disable sudo the action fails

My intent was to disable telemetry, only use versioned resources and avoid additional dependencies unless absolutely necessary. There are a few options in the action + install script, so i tried the following:

- uses: DeterminateSystems/nix-installer-action@de22e16c4711fca50c816cc9081563429d1cf563 # v10
  env:
    NIX_INSTALLER_BINARY_ROOT: "https://github.com/DeterminateSystems/nix-installer/releases/download/v0.19.0"
    NIX_INSTALLER_OVERRIDE_URL: "https://github.com/DeterminateSystems/nix-installer/releases/download/v0.19.0/nix-installer-x86_64-linux"
  with:
    diagnostic-endpoint: "" # opt-out of telemetry
    source-url: "https://github.com/DeterminateSystems/nix-installer/releases/download/v0.19.0/nix-installer.sh"

Both NIX_INSTALLER_BINARY_ROOT and NIX_INSTALLER_OVERRIDE_URL didn't have any effect and the file is still downloaded from https://install.determinate.systems/nix/nix-installer-x86_64-linux?ci=github&correlation=GH-.... Is there anything else i can try?

CI Logs

Run DeterminateSystems/nix-installer-action@de22e16c4711fca50c816cc9081563429d1cf563
  with:
    source-url: https://github.com/DeterminateSystems/nix-installer/releases/download/v0.19.0/nix-installer.sh
    flakehub: false
    force-docker-shim: false
    github-token: ***
    github-server-url: https://github.com/
    kvm: true
    modify-profile: true
    reinstall: false
    start-daemon: true
    trust-runner-user: true
  env:
    NIX_INSTALLER_BINARY_ROOT: https://github.com/DeterminateSystems/nix-installer/releases/download/v0.19.0
    NIX_INSTALLER_OVERRIDE_URL: "https://github.com/DeterminateSystems/nix-installer/releases/download/v0.19.0/nix-installer-x86_64-linux"
...
Installing Nix
  Fetching binary from https://install.determinate.systems/nix/nix-installer-x86_64-linux?ci=github&correlation=GH-...
...

After running in `act`, host's nix-daemon is unusable

It appears that after #59 the action runs something like the following inside of the runner:

docker
          --log-level=debug
          run
          --detach
          --privileged
          --userns=host
          --pid=host
          --mount
          type=bind,src=/tmp,dst=/tmp
          --mount
          type=bind,src=/nix,dst=/nix
          --mount
          type=bind,src=/etc,dst=/etc,readonly
          --restart
          always
          --init
          --name
          determinate-nix-shim-${this.correlation}
          determinate-nix-shim:latest

I am not sure it was intended, but in the case of docker-in-docker systems (like act) this appears to mount the /nix of the docker host.

In act, is the the user's host machine.

This creates the rather unfortunate situation where the host's Nix is unavailable after running the action:

Create a tag/release?

Hey there!

This action (and project to make Nix easier to use/learn in general) is awesome!

How stable is this action at the moment? If it's pretty stable, it would be great to cut a release. I want to start using this on some work repository actions, but for stability it would be great to tie the action to a tag rather than main.

Is there any plan for this in the near future?

Update to `node20`

The action is still on node16, but by default configured runners on NixOS only come with node20, causing the action to fail.

It should probably be moved to node20, if there are no drawbacks?

nix-installer-action/action.yml

Lines 108 to 111 in 07ebb8d

 runs: 

 using: "node16" 

 main: 'dist/index.js' 

 post: 'dist/index.js'

`init: none` also requires `planner: Linux`

I am trying to use the action on a gitea-runner. The docker image is catthehacker/ubuntu:act-latest.

My job description is simple:

name: Nix build
on: [push]
run-name: Test and build flake
jobs:
  nix-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install Nix
        uses: https://github.com/DeterminateSystems/nix-installer-action@v4
        with:
          init: none

You can see the result here: https://code.maralorn.de/maralorn/runner-test/actions/runs/17/jobs/0

For your convenience the error message is:

info: downloading installer (https://install.determinate.systems/nix/tag/v0.10.0/nix-installer-x86_64-linux)
Error: 
   0: Planner error
   1: Error executing action
   2: Action `configure_init_service` errored
   3: Could not detect systemd; you may be able to get up and running without systemd with `nix-installer install linux --init none`.
      See https://github.com/DeterminateSystems/nix-installer#without-systemd-linux-only for documentation on usage and drawbacks.
location:
   src/cli/subcommand/install.rs:193
backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
Run with RUST_BACKTRACE=full to include source snippets.

This is surprising because before that it says:

Set NIX_INSTALLER_INIT=none

I might be holding it wrong. Please enlighten me!

`ETXTBSY` on `execute_install()`

Recently been getting run failures with an Error: spawn ETXTBSY error.

Tracking down the source appears to show

nix-installer-action/src/main.ts

Lines 268 to 270 in 721f94f

 const spawned = spawn(`${binary_path}`, args, { 

 env: merged_env, 

 });

failing and causing an uncaught exception to propagate through the action.

This specific failure reminds me of the race condition mentioned in the README of https://github.com/buildbarn/bb-remote-execution - requiring separate processes to handle downloading of an executable and executing that executable.

To work around golang/go#22315 that effectively prevents multi-threaded processes from writing executables to disk and spawning them. Through this decomposition, bb_worker writes executables to disk, while bb_runner spawns them.

Excerpt from workflow log:

2023-11-02T13:53:48.8844243Z ##[group]Run DeterminateSystems/nix-installer-action@v6
2023-11-02T13:53:48.8844899Z with:
2023-11-02T13:53:48.8845200Z   flakehub: false
2023-11-02T13:53:48.8845821Z   github-token: ***
2023-11-02T13:53:48.8846200Z   modify-profile: true
2023-11-02T13:53:48.8846748Z   reinstall: false
2023-11-02T13:53:48.8847092Z   start-daemon: true
2023-11-02T13:53:48.8847777Z   diagnostic-endpoint: https://install.determinate.systems/nix/diagnostic
2023-11-02T13:53:48.8848606Z   trust-runner-user: true
2023-11-02T13:53:48.8848997Z ##[endgroup]
2023-11-02T13:53:49.0060064Z Fetching binary from https://install.determinate.systems/nix/nix-installer-x86_64-linux?ci=github&correlation=GH-599763b2-1658-467b-abe6-984a90a66e96
2023-11-02T13:53:49.5869054Z Downloaded `nix-installer` to `/tmp/nix-installer-7iB0Nw/nix-installer-x86_64-linux`
2023-11-02T13:53:49.5897493Z Execution environment: {
2023-11-02T13:53:49.5903883Z     "NIX_INSTALLER_NO_CONFIRM": "true",
2023-11-02T13:53:49.5904829Z     "NIX_INSTALLER_DIAGNOSTIC_ATTRIBUTION": "GH-599763b2-1658-467b-abe6-984a90a66e96",
2023-11-02T13:53:49.5905559Z     "NIX_INSTALLER_MODIFY_PROFILE": "true",
2023-11-02T13:53:49.5906364Z     "NIX_INSTALLER_DIAGNOSTIC_ENDPOINT": "https://install.determinate.systems/nix/diagnostic",
2023-11-02T13:53:49.5907140Z     "NIX_INSTALLER_START_DAEMON": "true",
2023-11-02T13:53:49.5909417Z     "NIX_INSTALLER_EXTRA_CONF": "access-tokens = github.com=***\ntrusted-users = root runner\n"
2023-11-02T13:53:49.5910164Z }
2023-11-02T13:53:49.6049345Z ##[error]Error: spawn ETXTBSY
2023-11-02T13:53:49.6219046Z Post job cleanup.

Binary cache support?

It would be great if we could have some config options for setting extra binary caches in a structured way instead of just adding to extra-conf. I could potentially make a PR.

Better cache analytics trough custom User-Agent

As part of the work on the S3 cache GC, we discovered that most of our Fastly traffic is coming from North America. Could this be primarily GitHub traffic?

It would be interesting if this action could set the "user-agent-suffix" Nix setting with the following info:

the name of the action
which github org it's being used on

This would allow us to build a better understanding of the usage pattern of the cache.

I'm going to post this to the other Nix install actions as well.

	runs:
	using: "node16"
	main: 'dist/index.js'
	post: 'dist/index.js'

	const spawned = spawn(`${binary_path}`, args, {
	env: merged_env,
	});

determinatesystems / nix-installer-action Goto Github PK

nix-installer-action's Issues

Error

Metadata

Recommend Projects

Recommend Topics

Recommend Org