.editorconfig

@@ -1,15 +0,0 @@
-# EditorConfig is awesome: https://EditorConfig.org
-
-# top-most EditorConfig file
-root = true
-
-# Unix-style newlines with a newline ending every file
-[*]
-charset = utf-8
-end_of_line = lf
-indent_size = 2
-indent_style = space
-insert_final_newline = true
-
-[LICENSE]
-indent_size = unset

.github/dependabot.yml

@@ -1,13 +0,0 @@
-version: 2
-updates:
-
-- package-ecosystem: github-actions
-  directory: "/"
-  schedule:
-    interval: daily
-    time: '00:00'
-    timezone: UTC
-  open-pull-requests-limit: 10
-  commit-message:
-      prefix: "chore"
-      include: "scope"

.github/workflows/test-per-system.yml

@@ -1,98 +0,0 @@
-name: Test Runner
-
-on:
-  workflow_call:
-    inputs:
-      runs-on:
-        description: 'GitHub Actions runner to use (e.g., ubuntu-latest, macos-latest)'
-        required: true
-        type: string
-      system:
-        description: 'Target system architecture (e.g., x86_64-linux, aarch64-darwin)'
-        required: true
-        type: string
-      oldest_installer_version:
-        description: 'Oldest supported Nix installer version to test (e.g., nix-2.8.0)'
-        required: false
-        default: 'nix-2.8.0'
-        type: string
-
-env:
-  nixpkgs_channel: nixpkgs=channel:nixos-25.05
-
-jobs:
-  simple-build:
-    runs-on: ${{ inputs.runs-on }}
-    steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-    - name: Install Nix
-      uses: ./
-      with:
-        nix_path: ${{ env.nixpkgs_channel }}
-    - name: Test environment variables
-      run: ./tests/test-env.sh
-    - run: nix-env -iA cachix -f https://cachix.org/api/v1/install
-    - run: cat /etc/nix/nix.conf
-    # cachix should be available and be able to configure a cache
-    - run: cachix use cachix
-    - run: nix-build tests/test-build.nix
-
-  custom-nix-path:
-    runs-on: ${{ inputs.runs-on }}
-    steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-    - name: Install Nix
-      uses: ./
-      with:
-        nix_path: ${{ env.nixpkgs_channel }}
-    - run: test $NIX_PATH == '${{ env.nixpkgs_channel }}'
-    - run: nix-build tests/test-build.nix
-
-  extra-nix-config:
-    runs-on: ${{ inputs.runs-on }}
-    steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-    - name: Install Nix
-      uses: ./
-      with:
-        nix_path: ${{ env.nixpkgs_channel }}
-        extra_nix_config: |
-          sandbox = relaxed
-    - run: cat /etc/nix/nix.conf
-    - run: nix-build tests/test-build.nix --arg noChroot true
-
-  flakes:
-    runs-on: ${{ inputs.runs-on }}
-    steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-    - name: Install Nix
-      uses: ./
-    - run: nix flake show github:NixOS/nixpkgs
-
-  latest-installer:
-    runs-on: ${{ inputs.runs-on }}
-    steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-    - name: Run NAR server
-      run: |
-        curl --location https://github.com/cachix/nar-toolbox/releases/download/v0.1.0/nar-toolbox-${{ inputs.system }} -O
-        chmod +x ./nar-toolbox-${{ inputs.system }}
-        ./nar-toolbox-${{ inputs.system }} serve https://cache.nixos.org &
-    - name: Install Nix
-      uses: ./
-      with:
-        nix_path: ${{ env.nixpkgs_channel }}
-        install_url: https://hydra.nixos.org/job/nix/master/installerScript/latest-finished/download/1/install
-        install_options: "--tarball-url-prefix http://localhost:8080"
-    - run: nix-build tests/test-build.nix
-
-  oldest-supported-installer:
-    runs-on: ${{ inputs.runs-on }}
-    steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-    - name: Install Nix
-      uses: ./
-      with:
-        nix_path: ${{ env.nixpkgs_channel }}
-        install_url: https://releases.nixos.org/nix/${{ inputs.oldest_installer_version }}/install
-    - run: nix-build tests/test-build.nix

.github/workflows/test.yml

@@ -2,64 +2,53 @@ name: "install-nix-action test"
 on:
   pull_request:
   push:
-    branches:
-      - master
-  workflow_dispatch:
-
-env:
-  nixpkgs_channel: nixpkgs=channel:nixos-25.05
 
 jobs:
-  test:
+  simple-build:
     strategy:
-      fail-fast: false
-      # For the list of available images:
-      #   GitHub images: https://github.com/actions/runner-images?tab=readme-ov-file#available-images
-      #   Partner images: https://github.com/actions/partner-runner-images?tab=readme-ov-file#available-images
       matrix:
-        include:
+        os: [ubuntu-latest, macos-latest]
-          - runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
-            system: x86_64-linux
-            oldest_installer_version: nix-2.8.0
-          - runs-on: ubuntu-22.04
-            system: x86_64-linux
-            oldest_installer_version: nix-2.8.0
-          - runs-on: ubuntu-24.04-arm
-            system: aarch64-linux
-            oldest_installer_version: nix-2.8.0
-          - runs-on: ubuntu-22.04-arm
-            system: aarch64-linux
-            oldest_installer_version: nix-2.8.0
-          - runs-on: macos-latest
-            system: aarch64-darwin
-            oldest_installer_version: nix-2.18.6
-          - runs-on: macos-26
-            system: aarch64-darwin
-            oldest_installer_version: nix-2.18.6
-          - runs-on: macos-15
-            system: aarch64-darwin
-            oldest_installer_version: nix-2.18.6
-          - runs-on: macos-14
-            system: aarch64-darwin
-            oldest_installer_version: nix-2.8.0
-          - runs-on: macos-15-intel
-            system: x86_64-darwin
-            oldest_installer_version: nix-2.18.6
-    uses: ./.github/workflows/test-per-system.yml
-    with:
-      runs-on: ${{ matrix.runs-on }}
-      system: ${{ matrix.system }}
-      oldest_installer_version: ${{ matrix.oldest_installer_version }}
-
-  act-support:
-    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@v2
-    - run: curl https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash
+    - run: yarn install --frozen-lockfile
-    - run: docker pull ghcr.io/catthehacker/ubuntu:js-24.04
+    - run: yarn build
-    - run: |
+    - name: Install Nix
-        ./bin/act push \
+      uses: ./
-          -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:js-24.04 \
+    - run: nix-env -iA cachix -f https://cachix.org/api/v1/install
-          -j simple-build \
+    - run: cat /etc/nix/nix.conf
-          --matrix runs-on:ubuntu-latest \
+    # cachix should be available and be able to configure a cache
-          --matrix system:x86_64-linux
+    - run: cachix use cachix
+    - run: nix-build test.nix
+
+  no-channel:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v2
+    - run: yarn install --frozen-lockfile
+    - run: yarn build
+    - name: Install Nix
+      uses: ./
+      with:
+        skip_adding_nixpkgs_channel: true
+    - run: nix-build test.nix && exit 1 || echo "OK"
+    - run: NIX_PATH=nixpkgs=https://github.com/NixOS/nixpkgs/tarball/ab5863afada3c1b50fc43bf774b75ea71b287cde nix-build test.nix
+
+  custom-nix-path:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v2
+    - run: yarn install --frozen-lockfile
+    - run: yarn build
+    - name: Install Nix
+      uses: ./
+      with:
+        nix_path: nixpkgs=channel:nixos-20.03
+    - run: test $NIX_PATH == "nixpkgs=channel:nixos-20.03"
+    - run: nix-build test.nix

.github/workflows/update-nix.yml

@@ -1,52 +0,0 @@
-name: "Update nix"
-on:
-  repository_dispatch:
-  workflow_dispatch:
-  schedule:
-    - cron: "31 2 * * *"
-jobs:
-  update-nix-releases:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Update nix releases
-        env:
-         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          latest_nix=$(
-            gh api repos/NixOS/nix/tags --paginate --jq '.[].name' |
-            grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' |
-            sort -V |
-            tail -n 1
-          )
-          if [ -z "$latest_nix" ]; then
-            echo "Failed to determine latest Nix version." >&2
-            exit 1
-          fi
-          current_nix=$(grep -oE 'nix_version=[0-9.]+' ./install-nix.sh | cut -d= -f2)
-          echo "Current Nix version: ${current_nix}"
-          echo "Latest Nix version: ${latest_nix}"
-          echo "CURRENT_NIX=${current_nix}" >> $GITHUB_ENV
-          echo "LATEST_NIX=${latest_nix}" >> $GITHUB_ENV
-          sed -i -E "s/nix_version=[0-9.]+/nix_version=${latest_nix}/" ./install-nix.sh
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
-        with:
-          title: "nix: ${{ env.CURRENT_NIX }} -> ${{ env.LATEST_NIX }}"
-          commit-message: "nix: ${{ env.CURRENT_NIX }} -> ${{ env.LATEST_NIX }}"
-          body: |
-            This PR updates the Nix version from ${{ env.CURRENT_NIX }} to ${{ env.LATEST_NIX }}.
-
-            **To trigger the CI:**
-
-            1. Checkout the PR branch:
-               ```bash
-               gh pr checkout <pr-number>
-               ```
-
-            2. Amend and force push:
-               ```bash
-               git commit --amend --no-edit
-               git push --force-with-lease
-               ```
-          labels: dependencies

.gitignore

@@ -1,2 +1,93 @@
+__tests__/runner/*
+
+# comment out in distribution branches
+node_modules/
+
+# Rest pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+jspm_packages/
+
+# TypeScript v1 declaration files
+typings/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
 # dotenv environment variables file
-.env*
+.env
+.env.test
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+
+# next.js build output
+.next
+
+# nuxt.js build output
+.nuxt
+
+# vuepress build output
+.vuepress/dist
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/

README.md

@@ -1,19 +1,8 @@
 # install-nix-action
 
-[![Tests](https://github.com/cachix/install-nix-action/actions/workflows/test.yml/badge.svg)](https://github.com/cachix/install-nix-action/actions/workflows/test.yml)
+![github actions badge](https://github.com/cachix/install-nix-action/workflows/install-nix-action%20test/badge.svg)
 
-Installs [Nix](https://nixos.org/nix/) on GitHub Actions runners for Linux and macOS.
+Installs [Nix](https://nixos.org/nix/) on GitHub Actions for the supported platforms: Linux and macOS.
-
-# Features
-
-- Quick installation (~4s on Linux / ~20s on macOS)
-- Multi-user installation with sandboxing enabled by default on Linux
-- Support for [self-hosted GitHub runners](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners)
-- Allows specifying Nix installation URL via `install_url` (the oldest supported Nix version is 2.3.5)
-- Allows specifying extra Nix configuration options via `extra_nix_config`
-- Allows specifying `$NIX_PATH` and channels via `nix_path`
-- Enables KVM on supported machines: run VMs and NixOS tests with full hardware-acceleration
-- Pair with a binary cache from [cachix-action](https://github.com/cachix/cachix-action) to speed up re-builds and share binaries across your team
 
 ## Usage
 
@@ -28,221 +17,40 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v2
-    - uses: cachix/install-nix-action@v31
+    - uses: cachix/install-nix-action@v9
       with:
         nix_path: nixpkgs=channel:nixos-unstable
     - run: nix-build
 ```
 
-## Usage with Flakes
+See also [cachix-action](https://github.com/cachix/cachix-action) for
+simple binary cache setup to speed up your builds and share binaries
+with developers.
 
-```yaml
+## Options `with: ...`
-name: "Test"
-on:
-  pull_request:
-  push:
-jobs:
-  tests:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v5
-    - uses: cachix/install-nix-action@v31
-      with:
-        github_access_token: ${{ secrets.GITHUB_TOKEN }}
-    - run: nix build
-    - run: nix flake check
-```
 
-## Inputs
+- `install_url`: specify URL to install Nix from (mostly useful for testing non-stable releases)
 
-| Name | Description | Default |
+- `nix_path`: set `NIX_PATH` environment variable (if set `skip_adding_nixpkgs_channel` will be implicitly enabled)
-|------|-------------|---------|
-| `install_url` | URL to install Nix from. Useful for testing non-stable releases or pinning a specific Nix version (e.g., <https://releases.nixos.org/nix/nix-2.3.7/install>) | `""` |
-| `install_options` | Additional flags to pass to the Nix installer script | `""` |
-| `extra_nix_config` | Additional configuration to append to `/etc/nix/nix.conf` | `""` |
-| `nix_path` | Value to set for the `NIX_PATH` environment variable (e.g., `nixpkgs=channel:nixos-unstable`) | `""` |
-| `github_access_token` | GitHub token for Nix to use when pulling from GitHub repositories. Helps work around rate limit issues. Has no effect when `access-tokens` is specified in `extra_nix_config`. | `$GITHUB_TOKEN` if available |
-| `set_as_trusted_user` | Add the current user to the `trusted-users` list | `true` |
-| `enable_kvm` | Enable KVM for hardware-accelerated virtualization on Linux | `true` |
 
-## Differences from the default Nix installer
+- `skip_adding_nixpkgs_channel`: set to `true` to skip adding nixpkgs-unstable channel (and save ~5s for each job build)
-
-Some settings have been optimised for use in CI environments:
-
-- `nix.conf` settings. Override these defaults with `extra_nix_config`:
-
-  - The experimental `flakes` and `nix-command` features are enabled. Disable by overriding `experimental-features` in `extra_nix_config`.
-
-  - `max-jobs` is set to `auto`.
-
-  - `show-trace` is set to `true`.
-
-  - `$USER` is added to `trusted-users`.
-
-  - `$GITHUB_TOKEN` is added to `access_tokens` if no other `github_access_token` is provided.
-
-  - `always-allow-substitutes` is set to `true`.
-
-  - `ssl-cert-file` is set to `/etc/ssl/cert.pem` on macOS.
-
-- KVM is enabled on Linux if available. Disable by setting `enable_kvm: false`.
-
-- `$TMPDIR` is set to `$RUNNER_TEMP` if empty.
 
 ---
 
-## FAQ
+## Hacking
 
-### How do I print the nixpkgs version I've configured?
+Install the dependencies
-
+```bash
-```yaml
+$ yarn install
-- name: Print nixpkgs version
-  run: nix-instantiate --eval -E '(import <nixpkgs> {}).lib.version'
 ```
 
-### How do I add a nixpkgs channel?
+Build the typescript
-
+```bash
-This action doesn't set up any channels by default.
+$ yarn build
-Use `nix_path` to configure optional channels by [picking a channel](https://status.nixos.org/) or [pinning nixpkgs](https://nix.dev/reference/pinning-nixpkgs) to a specific commit.
-
-```yaml
-- uses: cachix/install-nix-action@v31
-  with:
-    nix_path: nixpkgs=channel:nixos-unstable
 ```
 
-See also the [tutorial on pinning on nix.dev](https://nix.dev/tutorials/towards-reproducibility-pinning-nixpkgs).
+Run the tests :heavy_check_mark:
-
+```bash
-### How do I run NixOS tests on Linux?
+$ yarn test
-
-```yaml
-- uses: cachix/install-nix-action@v31
-  with:
-    enable_kvm: true
-    extra_nix_config: "system-features = nixos-test benchmark big-parallel kvm"
-```
-
-### How do I install packages via nix-env from the specified `nix_path`?
-
-```
-nix-env -i mypackage -f '<nixpkgs>'
-```
-
-### How do I add a binary cache?
-
-If the binary cache you want to add is hosted on [Cachix](https://cachix.org/) and you are
-using [cachix-action](https://github.com/cachix/cachix-action), you
-should use their `extraPullNames` input like this:
-
-```yaml
-- uses: cachix/cachix-action@v31
-   with:
-     name: mycache
-     authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-     extraPullNames: nix-community
-```
-
-Otherwise, you can add any binary cache to nix.conf using
-install-nix-action's own `extra_nix_config` input:
-
-```yaml
-- uses: cachix/install-nix-action@v31
-  with:
-    extra_nix_config: |
-      trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-      substituters = https://hydra.iohk.io https://cache.nixos.org/
-```
-
-### How do I configure steps to use my flake's development environment?
-
-You can configure [`jobs.<job_id>.steps[*].shell`](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepsshell)
-to use `nix develop`.
-
-```yaml
-  # (optional) pre-build the shell separately to avoid skewing the run time of the next
-  #            step and have clear point of failure should the shell fail to build
-- name: Pre-build devShell
-  run: nix build --no-link .#devShells.$(nix eval --impure --raw --expr 'builtins.currentSystem').default
-
-- name: Run a command with nix develop
-  shell: 'nix develop -c bash -e {0}'
-  run: echo "hello, pure world!"
-```
-
-### How do I pass environment variables to commands run with `nix develop` or `nix shell`?
-
-Nix runs commands in a restricted environment by default, called `pure mode`.
-In pure mode, environment variables are not passed through to improve the reproducibility of the shell.
-
-You can use the `--keep / -k` flag to keep certain environment variables:
-
-```yaml
-- name: Run a command with nix develop
-  run: nix develop --ignore-environment --keep MY_ENV_VAR --command echo $MY_ENV_VAR
-  env:
-    MY_ENV_VAR: "hello world"
-```
-
-Or you can disable pure mode entirely with the `--impure` flag:
-
-```
-nix develop --impure
-```
-
-### How do I pass AWS credentials to the Nix daemon?
-
-In multi-user mode, Nix commands that operate on the Nix store are forwarded to a privileged daemon. This daemon runs in a separate context from your GitHub Actions workflow and cannot access the workflow's environment variables. Consequently, any secrets or credentials defined in your workflow environment will not be available to Nix operations that require store access.
-
-There are two ways to pass AWS credentials to the Nix daemon:
-
-- Configure a default profile using the AWS CLI
-- Install Nix in single-user mode
-
-#### Configure a default profile using the AWS CLI
-
-The Nix daemon supports reading AWS credentials from the `~/.aws/credentials` file.
-
-We can use the AWS CLI to configure a default profile using short-lived credentials fetched using OIDC:
-
-```yaml
-job:
-  build:
-    runs-on: ubuntu-latest
-    # Required permissions to request AWS credentials
-    permissions:
-      id-token: write
-      contents: read
-    steps:
-      - uses: actions/checkout@v5
-      - uses: cachix/install-nix-action@v31
-      - name: Assume AWS Role
-        uses: aws-actions/configure-aws-credentials@v5.0.0
-        with:
-          aws-region: us-east-1
-          role-to-assume: arn:aws-cn:iam::123456789100:role/my-github-actions-role
-      - name: Make AWS Credentials accessible to nix-daemon
-        run: |
-          sudo -i aws configure set aws_access_key_id "${AWS_ACCESS_KEY_ID}"
-          sudo -i aws configure set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"
-          sudo -i aws configure set aws_session_token "${AWS_SESSION_TOKEN}"
-          sudo -i aws configure set region "${AWS_REGION}"
-```
-
-#### Install Nix in single-user mode
-
-In some environments it may be possible to install Nix in single-user mode by passing the `--no-daemon` flag to the installer.
-This mode is normally used on platforms without an init system, like systemd, and in containerized environments with a single user that can own the entire Nix store.
-
-This approach is more generic as it allows passing environment variables directly to Nix, including secrets, proxy settings, and other configuration options.
-
-However, it may not be suitable for all environments. [Consult the Nix manual](https://nix.dev/manual/nix/latest/installation/nix-security) for the latest restrictions and differences between the two modes.
-
-For example, single-user mode is currently supported on hosted Linux GitHub runners, like `ubuntu-latest`.
-It is not supported on macOS runners, like `macos-latest`.
-
-```yaml
-- uses: cachix/install-nix-action@v31
-  with:
-    install_options: --no-daemon
 ```

RELEASE.md

@@ -1,44 +0,0 @@
-# Release
-
-As of v31, releases of this action follow Semantic Versioning.
-
-### Publishing a new release
-
-#### Publish the release
-
-Draft [a new release on GitHub](https://github.com/cachix/install-nix-action/releases):
-
-- In `Choose a tag`, create a new tag, like `v31.2.1`, following semver.
-- Click `Generate release notes`.
-- `Set as the latest release` should be selected automatically.
-- Publish release
-
-#### Update the major tag
-
-The major tag, like `v31`, allows downstream users to opt-in to automatic non-breaking updates.
-
-This process follows GitHub's own guidelines:
-https://github.com/actions/toolkit/blob/main/docs/action-versioning.md
-
-##### Fetch the latest tags
-
-```
-git pull --tags --force
-```
-
-##### Move the tag
-
-```
-git tag -fa v31
-```
-```
-git push origin v31 --force
-```
-
-#### Update the release notes for the major tag
-
-Find the release on GitHub: https://github.com/cachix/install-nix-action/releases
-
-Edit the release and click `Generate release notes`.
-Edit the formatting and publish.
-

__tests__/main.test.ts

@@ -0,0 +1,4 @@
+test('nothing', async() => {
+});
+
+// TODO: hopefully github actions will support integration tests

action.yml

@@ -2,38 +2,15 @@ name: 'Install Nix'
 description: 'Installs Nix on GitHub Actions for the supported platforms: Linux and macOS.'
 author: 'Domen Kožar'
 inputs:
-  extra_nix_config:
-    description: 'Gets appended to `/etc/nix/nix.conf` if passed.'
-  github_access_token:
-    description: 'Configure Nix to pull from GitHub using the given GitHub token.'
   install_url:
-    description: 'Installation URL that will contain a script to install Nix.'
+    description: 'Installation URL that will contain a script to install Nix'
-  install_options:
-    description: 'Additional installer flags passed to the installer script.'
   nix_path:
-    description: 'Set NIX_PATH environment variable.'
+    description: 'Set NIX_PATH environment variable. If set "skip_adding_nixpkgs_channel" will be implicitly enabled'
-  enable_kvm:
+  skip_adding_nixpkgs_channel:
-    description: 'Enable KVM for hardware-accelerated virtualization on Linux, if available.'
+    description: 'Skip adding nixpkgs-unstable channel'
-    required: false
-    default: true
-  set_as_trusted_user:
-    description: 'Add current user to `trusted-users`.'
-    required: false
-    default: true
 branding:
   color: 'blue'
   icon: 'sun'
 runs:
-  using: 'composite'
+  using: 'node12'
-  steps:
+  main: 'lib/main.js'
-    - run : ${GITHUB_ACTION_PATH}/install-nix.sh
-      shell: bash
-      env:
-        INPUT_EXTRA_NIX_CONFIG: ${{ inputs.extra_nix_config }}
-        INPUT_GITHUB_ACCESS_TOKEN: ${{ inputs.github_access_token }}
-        INPUT_INSTALL_OPTIONS: ${{ inputs.install_options }}
-        INPUT_INSTALL_URL: ${{ inputs.install_url }}
-        INPUT_NIX_PATH: ${{ inputs.nix_path }}
-        INPUT_ENABLE_KVM: ${{ inputs.enable_kvm }}
-        INPUT_SET_AS_TRUSTED_USER: ${{ inputs.set_as_trusted_user }}
-        GITHUB_TOKEN: ${{ github.token }}

install-nix.sh

@@ -1,185 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if nix_path="$(type -p nix)"; then
-  echo "Aborting: Nix is already installed at ${nix_path}"
-  exit
-fi
-
-if [[ ($OSTYPE =~ linux) && ($INPUT_ENABLE_KVM == 'true') ]]; then
-  enable_kvm() {
-    echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-install-nix-action-kvm.rules
-    sudo udevadm control --reload-rules && sudo udevadm trigger --name-match=kvm
-  }
-
-  echo '::group::Enabling KVM support'
-  enable_kvm && echo 'Enabled KVM' || echo 'KVM is not available'
-  echo '::endgroup::'
-fi
-
-# GitHub command to put the following log messages into a group which is collapsed by default
-echo "::group::Installing Nix"
-
-# Create a temporary workdir
-workdir=$(mktemp -d)
-trap 'rm -rf "$workdir"' EXIT
-
-# Configure Nix
-add_config() {
-  echo "$1" >>"$workdir/nix.conf"
-}
-add_config "show-trace = true"
-# Set jobs to number of cores
-add_config "max-jobs = auto"
-# Configure the nix-daemon to use certificates.
-# In multi-user installs, NIX_SSL_CERT_FILE only works if set in the daemon's service file.
-if [[ $OSTYPE =~ darwin ]]; then
-  add_config "ssl-cert-file = /etc/ssl/cert.pem"
-fi
-# Allow binary caches specified at user level
-if [[ $INPUT_SET_AS_TRUSTED_USER == 'true' ]]; then
-  add_config "trusted-users = root ${USER:-}"
-fi
-# Add a GitHub access token.
-# Token-less access is subject to lower rate limits.
-if [[ -n "${INPUT_GITHUB_ACCESS_TOKEN:-}" ]]; then
-  echo "::debug::Using the provided github_access_token for github.com"
-  add_config "access-tokens = github.com=$INPUT_GITHUB_ACCESS_TOKEN"
-# Use the default GitHub token if available.
-# Skip this step if running an Enterprise instance. The default token there does not work for github.com.
-elif [[ -n "${GITHUB_TOKEN:-}" && $GITHUB_SERVER_URL == "https://github.com" ]]; then
-  echo "::debug::Using the default GITHUB_TOKEN for github.com"
-  add_config "access-tokens = github.com=$GITHUB_TOKEN"
-else
-  echo "::debug::Continuing without a GitHub access token"
-fi
-# Append extra nix configuration if provided
-if [[ -n "${INPUT_EXTRA_NIX_CONFIG:-}" ]]; then
-  add_config "$INPUT_EXTRA_NIX_CONFIG"
-fi
-if [[ ! $INPUT_EXTRA_NIX_CONFIG =~ "experimental-features" ]]; then
-  add_config "experimental-features = nix-command flakes"
-fi
-# Always allow substituting from the cache, even if the derivation has `allowSubstitutes = false`.
-# This is a CI optimisation to avoid having to download the inputs for already-cached derivations to rebuild trivial text files.
-if [[ ! $INPUT_EXTRA_NIX_CONFIG =~ "always-allow-substitutes" ]]; then
-  add_config "always-allow-substitutes = true"
-fi
-
-# Nix installer flags
-installer_options=(
-  --no-channel-add
-  --nix-extra-conf-file "$workdir/nix.conf"
-)
-
-# Enable daemon on macOS and Linux systems with systemd, unless --no-daemon is specified
-if [[ (! $INPUT_INSTALL_OPTIONS =~ "--no-daemon") && ($OSTYPE =~ darwin || -e /run/systemd/system) ]]; then
-  use_daemon() { true; }
-else
-  use_daemon() { false; }
-fi
-
-if use_daemon; then
-  installer_options+=(
-    --daemon
-    --daemon-user-count "$(python3 -c 'import multiprocessing as mp; print(mp.cpu_count() * 2)')"
-  )
-else
-  # "fix" the following error when running nix*
-  # error: the group 'nixbld' specified in 'build-users-group' does not exist
-  add_config "build-users-group ="
-  sudo mkdir -p /etc/nix
-  sudo chmod 0755 /etc/nix
-  sudo cp "$workdir/nix.conf" /etc/nix/nix.conf
-fi
-
-if [[ -n "${INPUT_INSTALL_OPTIONS:-}" ]]; then
-  IFS=' ' read -r -a extra_installer_options <<<"$INPUT_INSTALL_OPTIONS"
-  installer_options=("${extra_installer_options[@]}" "${installer_options[@]}")
-fi
-
-echo "installer options: ${installer_options[*]}"
-
-# There is --retry-on-errors, but only newer curl versions support that
-curl_retries=5
-nix_version=2.33.0
-while ! curl -sS -o "$workdir/install" -v --fail -L "${INPUT_INSTALL_URL:-https://releases.nixos.org/nix/nix-${nix_version}/install}"; do
-  sleep 1
-  ((curl_retries--))
-  if [[ $curl_retries -le 0 ]]; then
-    echo "curl retries failed" >&2
-    exit 1
-  fi
-done
-
-sh "$workdir/install" "${installer_options[@]}"
-
-# Configure the environment
-#
-# Adapted from the single- and multi-user scripts:
-#   single-user: https://github.com/NixOS/nix/blob/master/scripts/nix-profile-daemon.sh.in
-#   multi-user: https://github.com/NixOS/nix/blob/master/scripts/nix-profile-daemon.sh.in
-#
-# These scripts would normally be evaluated as part of the user's shell profile.
-# GitHub doesn't evaluate profiles or rc scripts by default, so we set up the environment manually.
-echo "::debug::Nix installed, setting up environment"
-
-# Export the path to Nix
-if [[ -n "${INPUT_NIX_PATH:-}" ]]; then
-  echo "NIX_PATH=${INPUT_NIX_PATH}" >>"$GITHUB_ENV"
-fi
-
-# Set temporary directory if not already set
-# Fixes https://github.com/cachix/install-nix-action/issues/197
-if [[ -z "${TMPDIR:-}" ]]; then
-  echo "TMPDIR=${RUNNER_TEMP}" >>"$GITHUB_ENV"
-fi
-
-# Determine the profile path.
-#
-# Different versions of Nix support (from newest to oldest):
-#   - NIX_STATE_HOME to fully control the location of home files
-#   - XDG_STATE_HOME, defaulting to .local/state/nix/profile
-#   - $HOME/.nix-profile
-#
-# These directories are created by calling `nix profile`, so they don't exist at this point.
-# Without parsing the Nix version, our best bet is the legacy-ish ~/.nix-profile.
-if [[ -n "${NIX_STATE_HOME:-}" ]]; then
-  NIX_LINK="$NIX_STATE_HOME/profile"
-else
-  NIX_LINK="$HOME/.nix-profile"
-fi
-
-# Set Nix profiles
-echo "NIX_PROFILES=/nix/var/nix/profiles/default $NIX_LINK" >>"$GITHUB_ENV"
-
-# Set NIX_SSL_CERT_FILE if not already configured
-if [[ -z "${NIX_SSL_CERT_FILE:-}" ]]; then
-  # Check common SSL certificate file locations
-  if [[ -e "/etc/ssl/certs/ca-certificates.crt" ]]; then # NixOS, Ubuntu, Debian, Gentoo, Arch
-    echo "NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt" >>"$GITHUB_ENV"
-  elif [[ $OSTYPE =~ darwin && -e "/etc/ssl/cert.pem" ]]; then # macOS
-    echo "NIX_SSL_CERT_FILE=/etc/ssl/cert.pem" >>"$GITHUB_ENV"
-  elif [[ -e "/etc/ssl/ca-bundle.pem" ]]; then # openSUSE Tumbleweed
-    echo "NIX_SSL_CERT_FILE=/etc/ssl/ca-bundle.pem" >>"$GITHUB_ENV"
-  elif [[ -e "/etc/ssl/certs/ca-bundle.crt" ]]; then # Old NixOS
-    echo "NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt" >>"$GITHUB_ENV"
-  elif [[ -e "/etc/pki/tls/certs/ca-bundle.crt" ]]; then # Fedora, CentOS
-    echo "NIX_SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt" >>"$GITHUB_ENV"
-  elif [[ -e "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" ]]; then # fall back to cacert in default Nix profile
-    echo "NIX_SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" >>"$GITHUB_ENV"
-  elif [[ -e "$NIX_LINK/etc/ssl/certs/ca-bundle.crt" ]]; then # fall back to cacert in user Nix profile
-    echo "NIX_SSL_CERT_FILE=$NIX_LINK/etc/ssl/certs/ca-bundle.crt" >>"$GITHUB_ENV"
-  fi
-fi
-
-# Set paths based on the installation type
-if use_daemon; then
-  # Multi-user daemon install - add both paths
-  echo "/nix/var/nix/profiles/default/bin" >>"$GITHUB_PATH"
-fi
-# Always add the user profile path
-echo "$NIX_LINK/bin" >>"$GITHUB_PATH"
-
-# Close the log message group which was opened above
-echo "::endgroup::"

jest.config.js

@@ -0,0 +1,11 @@
+module.exports = {
+  clearMocks: true,
+  moduleFileExtensions: ['js', 'ts'],
+  testEnvironment: 'node',
+  testMatch: ['**/*.test.ts'],
+  testRunner: 'jest-circus/runner',
+  transform: {
+    '^.+\\.ts$': 'ts-jest'
+  },
+  verbose: true
+}

lib/README.md

@@ -0,0 +1,5 @@
+
+# Generated Code
+
+The files in this directory are generated.
+See [src](../src)

lib/install-nix.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Set jobs to number of cores
+sudo sh -c 'echo max-jobs = auto >> /tmp/nix.conf'
+# Allow binary caches for runner user
+sudo sh -c 'echo trusted-users = root runner >> /tmp/nix.conf'
+
+if [[ $INPUT_SKIP_ADDING_NIXPKGS_CHANNEL = "true" || $INPUT_NIX_PATH != "" ]]; then
+  extra_cmd=--no-channel-add
+else
+  extra_cmd=
+  INPUT_NIX_PATH="/nix/var/nix/profiles/per-user/root/channels"
+fi
+
+sh <(curl -L ${INPUT_INSTALL_URL:-https://nixos.org/nix/install}) \
+  --daemon --daemon-user-count 4 --nix-extra-conf-file /tmp/nix.conf --darwin-use-unencrypted-nix-store-volume $extra_cmd
+
+if [[ $OSTYPE =~ darwin ]]; then
+  # Disable spotlight indexing of /nix to speed up performance
+  sudo mdutil -i off /nix
+
+  # macOS needs certificates hints
+  cert_file=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt
+  echo "::set-env name=NIX_SSL_CERT_FILE::$cert_file"
+  export NIX_SSL_CERT_FILE=$cert_file
+  sudo launchctl setenv NIX_SSL_CERT_FILE "$cert_file"
+fi
+
+# Set paths
+echo "::add-path::/nix/var/nix/profiles/per-user/runner/profile/bin"
+echo "::add-path::/nix/var/nix/profiles/default/bin"
+
+if [[ $INPUT_NIX_PATH != "" ]]; then
+  echo "::set-env name=NIX_PATH::${INPUT_NIX_PATH}"
+fi

lib/main.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+child_process_1.execFileSync(`${__dirname}/install-nix.sh`, { stdio: 'inherit' });

package.json

@@ -0,0 +1,36 @@
+{
+  "name": "install-nix-action",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Installs Nix on GitHub Actions for the supported platforms: Linux and macOS.",
+  "main": "lib/main.js",
+  "scripts": {
+    "build": "tsc",
+    "test": "jest"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cachix/install-nix-action.git"
+  },
+  "keywords": [
+    "actions",
+    "node",
+    "setup"
+  ],
+  "author": "Domen Kožar",
+  "license": "ASL2",
+  "dependencies": {
+    "@actions/core": "^1.1.0",
+    "@actions/exec": "^1.0.1",
+    "@actions/tool-cache": "^1.1.2"
+  },
+  "devDependencies": {
+    "ts-node": "^8.4.1",
+    "@types/jest": "^24.0.13",
+    "@types/node": "^12.0.4",
+    "jest": "^24.8.0",
+    "jest-circus": "^24.7.1",
+    "ts-jest": "^24.0.2",
+    "typescript": "^3.5.1"
+  }
+}

shell.nix

@@ -0,0 +1,8 @@
+{ pkgs ? import <nixpkgs> {}
+}:
+
+pkgs.mkShell {
+  name = "install-nix-action-shell";
+
+  buildInputs = [ pkgs.yarn ];
+}

src/main.ts

@@ -0,0 +1,3 @@
+import { execFileSync } from 'child_process';
+
+execFileSync(`${__dirname}/install-nix.sh`, { stdio: 'inherit' });

test.nix

@@ -2,17 +2,14 @@
 { size ? 1 # MB
 , num ? 10 # count 
 , currentTime ? builtins.currentTime
-, noChroot ? false
 }:
 
 with import <nixpkgs> {};
 
 let
-  drv = i: runCommand "${toString currentTime}-${toString i}" {
+  drv = i: runCommand "${toString currentTime}-${toString i}" {} ''
-    __noChroot = noChroot;
-  } ''
     dd if=/dev/zero of=$out bs=${toString size}MB count=1
   '';
 in writeText "empty-${toString num}-${toString size}MB" ''
   ${lib.concatMapStringsSep "" drv (lib.range 1 num)}
-''
+''

tests/test-env.sh

@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-echo "=== Testing Nix Environment Variables ==="
-echo
-
-# Test NIX_PROFILES
-echo "NIX_PROFILES: ${NIX_PROFILES:-<not set>}"
-if [[ -n "${NIX_PROFILES:-}" ]]; then
-  echo "✓ NIX_PROFILES is set"
-else
-  echo "✗ NIX_PROFILES is not set"
-  exit 1
-fi
-
-# Test NIX_SSL_CERT_FILE
-echo "NIX_SSL_CERT_FILE: ${NIX_SSL_CERT_FILE:-<not set>}"
-if [[ -n "${NIX_SSL_CERT_FILE:-}" ]]; then
-  if [[ -f "$NIX_SSL_CERT_FILE" ]]; then
-    echo "✓ NIX_SSL_CERT_FILE is set and file exists"
-  else
-    echo "✗ NIX_SSL_CERT_FILE is set but file does not exist: $NIX_SSL_CERT_FILE"
-    exit 1
-  fi
-else
-  echo "✗ NIX_SSL_CERT_FILE is not set"
-  exit 1
-fi
-
-# Test PATH contains Nix paths
-echo "PATH: $PATH"
-if echo "$PATH" | grep -E -q "(\.nix-profile|nix/profile)"; then
-  echo "✓ PATH contains Nix paths"
-else
-  echo "✗ PATH does not contain Nix paths"
-  exit 1
-fi
-
-# Test NIX_PATH if set
-if [[ -n "${NIX_PATH:-}" ]]; then
-  echo "NIX_PATH: $NIX_PATH"
-  echo "✓ NIX_PATH is set"
-else
-  echo "NIX_PATH: <not set>"
-  exit 1
-fi
-
-# Test TMPDIR
-echo "TMPDIR: ${TMPDIR:-<not set>}"
-if [[ -n "${TMPDIR:-}" ]]; then
-  echo "✓ TMPDIR is set"
-else
-  echo "⚠ TMPDIR is not set"
-  exit 1
-fi
-
-echo
-echo "=== Testing Nix Command ==="
-if command -v nix >/dev/null 2>&1; then
-  echo "✓ nix command is available"
-  echo "Nix version: $(nix --version)"
-else
-  echo "✗ nix command is not available"
-  exit 1
-fi
-
-echo
-echo "=== Environment Setup Test Complete ==="

tsconfig.json

@@ -0,0 +1,63 @@
+{
+  "compilerOptions": {
+    /* Basic Options */
+    // "incremental": true,                   /* Enable incremental compilation */
+    "target": "es6",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
+    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
+    // "allowJs": true,                       /* Allow javascript files to be compiled. */
+    // "checkJs": true,                       /* Report errors in .js files. */
+    // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
+    // "declaration": true,                   /* Generates corresponding '.d.ts' file. */
+    // "declarationMap": true,                /* Generates a sourcemap for each corresponding '.d.ts' file. */
+    // "sourceMap": true,                     /* Generates corresponding '.map' file. */
+    // "outFile": "./",                       /* Concatenate and emit output to single file. */
+    "outDir": "./lib",                        /* Redirect output structure to the directory. */
+    "rootDir": "./src",                       /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
+    // "composite": true,                     /* Enable project compilation */
+    // "tsBuildInfoFile": "./",               /* Specify file to store incremental compilation information */
+    // "removeComments": true,                /* Do not emit comments to output. */
+    // "noEmit": true,                        /* Do not emit outputs. */
+    // "importHelpers": true,                 /* Import emit helpers from 'tslib'. */
+    // "downlevelIteration": true,            /* Provide full support for iterables in 'for-of', spread, and destructuring when targeting 'ES5' or 'ES3'. */
+    // "isolatedModules": true,               /* Transpile each file as a separate module (similar to 'ts.transpileModule'). */
+
+    /* Strict Type-Checking Options */
+    "strict": true,                           /* Enable all strict type-checking options. */
+    "noImplicitAny": false,                 /* Raise error on expressions and declarations with an implied 'any' type. */
+    // "strictNullChecks": true,              /* Enable strict null checks. */
+    // "strictFunctionTypes": true,           /* Enable strict checking of function types. */
+    // "strictBindCallApply": true,           /* Enable strict 'bind', 'call', and 'apply' methods on functions. */
+    // "strictPropertyInitialization": true,  /* Enable strict checking of property initialization in classes. */
+    // "noImplicitThis": true,                /* Raise error on 'this' expressions with an implied 'any' type. */
+    // "alwaysStrict": true,                  /* Parse in strict mode and emit "use strict" for each source file. */
+
+    /* Additional Checks */
+    // "noUnusedLocals": true,                /* Report errors on unused locals. */
+    // "noUnusedParameters": true,            /* Report errors on unused parameters. */
+    // "noImplicitReturns": true,             /* Report error when not all code paths in function return a value. */
+    // "noFallthroughCasesInSwitch": true,    /* Report errors for fallthrough cases in switch statement. */
+
+    /* Module Resolution Options */
+    // "moduleResolution": "node",            /* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
+    // "baseUrl": "./",                       /* Base directory to resolve non-absolute module names. */
+    // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
+    // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */
+    // "typeRoots": [],                       /* List of folders to include type definitions from. */
+    // "types": [],                           /* Type declaration files to be included in compilation. */
+    // "allowSyntheticDefaultImports": true,  /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
+    "esModuleInterop": true                   /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    // "preserveSymlinks": true,              /* Do not resolve the real path of symlinks. */
+    // "allowUmdGlobalAccess": true,          /* Allow accessing UMD globals from modules. */
+
+    /* Source Map Options */
+    // "sourceRoot": "",                      /* Specify the location where debugger should locate TypeScript files instead of source locations. */
+    // "mapRoot": "",                         /* Specify the location where debugger should locate map files instead of generated locations. */
+    // "inlineSourceMap": true,               /* Emit a single file with source maps instead of having a separate file. */
+    // "inlineSources": true,                 /* Emit the source alongside the sourcemaps within a single file; requires '--inlineSourceMap' or '--sourceMap' to be set. */
+
+    /* Experimental Options */
+    // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
+    // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
+  },
+  "exclude": ["node_modules", "**/*.test.ts"]
+}