cachix/install-nix-action

Nix runs in 'pure mode' by default, which prevents environment variables from being passed through. To use specific variables, use the --keep (or -k) flag to whitelist them, or use the --impure flag to disable pure mode entirely.

# Using --keep to whitelist a specific variable
nix develop --ignore-environment --keep MY_ENV_VAR --command echo $MY_ENV_VAR

# Disabling pure mode entirely
nix develop --impure

If you need Nix to access environment variables or secrets directly (e.g., proxy settings or AWS credentials) without configuring the daemon, you can install Nix in single-user mode by passing the --no-daemon flag to the installer via install_options.

Note: Single-user mode is supported on hosted Linux runners (like ubuntu-latest) but is not supported on macOS runners.

- uses: cachix/install-nix-action@v31
  with:
    install_options: --no-daemon

The action does not set up channels by default. To use a specific channel or pin nixpkgs, use the nix_path input to set the NIX_PATH environment variable.

- uses: cachix/install-nix-action@v31
  with:
    nix_path: nixpkgs=channel:nixos-unstable

In multi-user mode, the Nix daemon runs in a separate context and cannot access workflow environment variables. To pass AWS credentials to the daemon, you can configure a default profile using the AWS CLI within the workflow. This requires writing the credentials to ~/.aws/credentials using sudo -i so the daemon can access them.

- name: Make AWS Credentials accessible to nix-daemon
  run: |
    sudo -i aws configure set aws_access_key_id "${AWS_ACCESS_KEY_ID}"
    sudo -i aws configure set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"
    sudo -i aws configure set aws_session_token "${AWS_SESSION_TOKEN}"
    sudo -i aws configure set region "${AWS_REGION}"

Use cachix/install-nix-action to install Nix on Linux and macOS GitHub Actions runners. It supports multi-user installation with sandboxing enabled by default on Linux and provides optimized settings for CI environments (like enabling flakes and nix-command experimental features).

- uses: cachix/install-nix-action@v31

To run NixOS tests on Linux with full hardware acceleration, ensure enable_kvm is true and add the necessary system features to extra_nix_config.

- uses: cachix/install-nix-action@v31
  with:
    enable_kvm: true
    extra_nix_config: "system-features = nixos-test benchmark big-parallel kvm"

When using Flakes, it is recommended to provide a github_access_token to help avoid GitHub API rate limits when pulling from repositories.

- uses: actions/checkout@v5
- uses: cachix/install-nix-action@v31
  with:
    github_access_token: ${{ secrets.GITHUB_TOKEN }}
- run: nix build
- run: nix flake check

To add a binary cache that is not hosted on Cachix, use the extra_nix_config input to define substituters and trusted-public-keys in nix.conf.

- uses: cachix/install-nix-action@v31
  with:
    extra_nix_config: |
      trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
      substituters = https://hydra.iohk.io https://cache.nixos.org/

The action accepts several inputs to customize the Nix installation and environment:

• install_url: URL to install Nix from (e.g., for pinning a specific version).
• install_options: Additional flags passed to the Nix installer script (e.g., --no-daemon for single-user mode).
• extra_nix_config: Additional configuration to append to /etc/nix/nix.conf.
• nix_path: Value for the NIX_PATH environment variable (e.g., nixpkgs=channel:nixos-unstable).
• github_access_token: GitHub token for pulling from GitHub repositories to avoid rate limits.
• set_as_trusted_user: Whether to add the current user to the trusted-users list (defaults to true).
• enable_kvm: Enables KVM for hardware-accelerated virtualization on Linux (defaults to true).