From a91569992d845bedf8d554bc23c41e4cb84de87e Mon Sep 17 00:00:00 2001 From: Dario Lipicar Date: Tue, 18 Aug 2026 23:48:40 -0300 Subject: [PATCH] ci: use logos-co/setup-nix-cache-action for Nix setup and caching (#18) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the per-repo installer + cachix pair with the shared action, which installs Nix with the Logos Attic cache (cache.nix.logos.co) preconfigured and publishes what the job builds — master to the public cache, every other ref to ci. Each converted job also gains environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }} because ATTIC_TOKEN_PUBLIC only exists inside that environment. Without it the secret resolves empty on master and publishing is silently skipped — the job still passes, so the omission would not show up as a failure. The action installs Nix itself on every runner, macOS included. That is a deliberate reversal of the workaround these files carried: the comments here said cachix/install-nix-action collides with the runner's pre-existing _nixbld users (eDSRecordAlreadyExists), so DeterminateSystems' installer was used instead. It no longer reproduces — logos-delivery-module has already been converted the plain way and its `build-and-test (macos-latest)` leg passes. Keeping the workaround would have meant a second installer plus a duplicated substituter/key block in ten files, guarding against something two green runs say does not happen. If it ever recurs it fails loudly at install, which is recoverable; the silent-skip above is the failure mode worth engineering against. One property is deliberately NOT carried over: the old cachix step ran with `continue-on-error: true` so a failed cache push could not fail a job whose tests passed. The action exposes no equivalent, and adding one here would also swallow genuine setup failures now that the same step installs Nix rather than only publishing at the end. Co-authored-by: Claude Opus 5 --- .github/workflows/ci.yml | 44 ++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e10c908..e90eac7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,24 +24,27 @@ concurrency: jobs: build: + # ATTIC_TOKEN_PUBLIC only exists in the public-cache environment; master + # jobs must opt into it to publish to the public cache. + environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: cachix/install-nix-action@v27 + - uses: logos-co/setup-nix-cache-action@v1 with: - extra_nix_config: | + attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }} + attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }} + extra-nix-config: | experimental-features = nix-command flakes - - uses: cachix/cachix-action@v15 - with: - name: logos-co - authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' - - name: Build logos-dev-boost CLI run: nix build -L scaffold-tests: + # ATTIC_TOKEN_PUBLIC only exists in the public-cache environment; master + # jobs must opt into it to publish to the public cache. + environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }} runs-on: ubuntu-latest needs: build strategy: @@ -54,16 +57,13 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: cachix/install-nix-action@v27 + - uses: logos-co/setup-nix-cache-action@v1 with: - extra_nix_config: | + attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }} + attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }} + extra-nix-config: | experimental-features = nix-command flakes - - uses: cachix/cachix-action@v15 - with: - name: logos-co - authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' - # git is needed inside the scaffolded project so `nix build` can see # the files (flakes only consider git-tracked files). - name: Configure git identity for scaffold init @@ -80,6 +80,9 @@ jobs: # builds it, introspects it with lm, runs its unit tests, calls it through # logoscore, and asserts on the output. doctests: + # ATTIC_TOKEN_PUBLIC only exists in the public-cache environment; master + # jobs must opt into it to publish to the public cache. + environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }} name: dev-boost doc-tests (${{ matrix.os }}) needs: build strategy: @@ -91,17 +94,10 @@ jobs: steps: - uses: actions/checkout@v4 - # DeterminateSystems' installer (instead of cachix/install-nix-action) - # because the doc-tests run on macos-latest too, where the cachix installer - # collides with the runner's pre-existing _nixbld build users - # (eDSRecordAlreadyExists). This installer handles that and enables flakes - # by default, so no extra_nix_config is needed. - - uses: DeterminateSystems/nix-installer-action@main - - - uses: cachix/cachix-action@v15 + - uses: logos-co/setup-nix-cache-action@v1 with: - name: logos-co - authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' + attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }} + attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }} # git is needed inside the scaffolded project so `nix build` can see # the files (flakes only consider git-tracked files).