cachix-action

The action supports two modes for pushing store paths to the cache, controlled by the useDaemon option.

Daemon mode (default)

Registers a post-build hook with Nix. Newly built store paths are pushed as they are built. Limitation: Nix does not trigger the hook for substituted paths. Security Note: Post-build hooks may run as root if the nix-daemon is root. Evaluate risks if running untrusted code.

Store scan mode

Looks for differences in the store at the file system level. It captures all store paths, including those substituted. Warning: This is not safe for multi-user stores as you may inadvertently upload and leak store paths built by other users. Prefer daemon mode for multi-user stores.

The action determines how to upload paths to Cachix based on your configuration. The available modes are:

• None: Pushing is disabled. Occurs if skipPush is true or if no authentication (authToken or signingKey) is provided.
• PushPaths: Only the specific paths provided in the pathsToPush input are uploaded.
• Daemon: The most efficient mode. It uses the Cachix Daemon to register a post-build hook with the Nix Daemon, allowing paths to be uploaded as they are built. Requires useDaemon: true, a cachix version $\ge$ 1.7.0, and a trusted user environment.
• StoreScan: The fallback mode. It scans the Nix store during pre- and post-build hooks and uploads the differences. It is simple but less efficient and may not be safe in multi-user environments.

To enable the Cachix Daemon mode, set useDaemon: true. This mode requires:

1. cachix version 1.7.0 or higher.
2. A trusted user environment (the user must be able to set Nix post-build hooks, typically meaning they are a trusted-user in nix.conf or have write access to /nix/store).

When enabled, the action spawns a background daemon process, sets up a Unix socket, and registers a post-build-hook via NIX_USER_CONF_FILES or NIX_CONF to ensure paths are pushed immediately upon build completion.

To use the action to pull (substitute) packages from a Cachix cache without pushing any new builds, provide the name of your cache. This is useful for CI jobs that only need to consume existing binaries.

- uses: cachix/cachix-action@v17
  with:
    name: mycache

To push newly built packages to a Cachix cache, you must provide an authToken. This token is required for private cache access or to push to any cache.

- uses: cachix/cachix-action@v17
  with:
    name: mycache
    authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

For self-signed caches, you must provide both the authToken and the signingKey. The signing key is used in addition to the auth token to sign store paths.

- uses: cachix/cachix-action@v17
  with:
    name: mycache
    authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
    signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"

Fine-grained control over the action's execution and the Cachix binary.

Use these options to define which caches to interact with.

Control how and what is pushed to your Cachix cache.

Use these options to provide credentials for private caches or for pushing builds.