Skip to content

Introduce development Nix binary cache #3911

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
timon-schelling wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Introduce development Nix binary cache #3911

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e30a995
Desktop: Introduce development Nix binary cache
timon-schelling Mar 18, 2026
a0791cb
Configure caches in CI
timon-schelling Mar 18, 2026
e09d0c0
Cache nix shell
timon-schelling Mar 18, 2026
3a21b26
Fix
timon-schelling Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 7 additions & 8 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,6 @@ on:
linux:
description: "Linux"
type: boolean
push_to_nix_cache:
description: "Linux: push to Nix cache"
type: boolean
debug:
description: "Debug build"
type: boolean
Expand All @@ -34,8 +31,6 @@ on:
type: boolean
linux:
type: boolean
push_to_nix_cache:
type: boolean
debug:
type: boolean
checkout_repo:
Expand Down Expand Up @@ -569,6 +564,10 @@ jobs:

- name: ❄ Install Nix
uses: DeterminateSystems/nix-installer-action@main
with:
extra-conf: |
extra-substituters = https://graphite.cachix.org https://graphite-dev.cachix.org
extra-trusted-public-keys = graphite.cachix.org-1:B7Il1yMpkquN/dXM+5GRmz+4Xmu2aaCS1GcWNfFhsOo= graphite-dev.cachix.org-1:RppXYpiV1qO2TYKTkXXGHsAEQDOB5G51b3VlrN9QmbI=

- name: 🗑 Free disk space
run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
Expand All @@ -577,12 +576,12 @@ jobs:
run: nix build .#graphite${{ inputs.debug && '-dev' || '' }} --no-link --print-out-paths

- name: 📤 Push to Nix cache
if: (github.event_name == 'push' || inputs.push_to_nix_cache) && !inputs.debug
env:
NIX_CACHE_AUTH_TOKEN: ${{ secrets.NIX_CACHE_AUTH_TOKEN }}
NIX_CACHE_AUTH_TOKEN: ${{ (!inputs.debug && github.ref == 'refs/heads/master') && secrets.NIX_CACHE_AUTH_TOKEN || secrets.NIX_CACHE_AUTH_TOKEN_DEV }}
NIX_CACHE_NAME: ${{ (!inputs.debug && github.ref == 'refs/heads/master') && 'graphite' || 'graphite-dev' }}
run: |
nix run nixpkgs#cachix -- authtoken $NIX_CACHE_AUTH_TOKEN
nix build --no-link --print-out-paths | nix run nixpkgs#cachix -- push graphite
nix build .#graphite${{ inputs.debug && '-dev' || '' }} --no-link --print-out-paths | nix run nixpkgs#cachix -- push $NIX_CACHE_NAME

- name: 🏗 Build Linux bundle
run: nix build .#graphite${{ inputs.debug && '-dev' || '' }}-bundle.tar.xz && cp ./result ./graphite-linux-bundle.tar.xz
Expand Down
51 changes: 51 additions & 0 deletions .github/workflows/nix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
name: "Nix Housekeeping"

on:
push:
branches:
- master
workflow_dispatch: {}

jobs:
cache-dev-shell:
runs-on: ubuntu-latest
permissions:
contents: read

steps:
- name: 📥 Clone repository
uses: actions/checkout@v6
with:
repository: ${{ inputs.checkout_repo || github.repository }}
ref: ${{ inputs.checkout_ref || '' }}

- name: ❄ Install Nix
uses: DeterminateSystems/nix-installer-action@main
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Pin this third-party action to an immutable commit SHA instead of @main to prevent supply-chain drift.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/nix.yml, line 23:

<comment>Pin this third-party action to an immutable commit SHA instead of `@main` to prevent supply-chain drift.</comment>

<file context>
@@ -0,0 +1,37 @@
+          ref: ${{ inputs.checkout_ref || '' }}
+
+      - name: ❄ Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
</file context>

with:
extra-conf: |
extra-substituters = https://graphite.cachix.org https://graphite-dev.cachix.org
extra-trusted-public-keys = graphite.cachix.org-1:B7Il1yMpkquN/dXM+5GRmz+4Xmu2aaCS1GcWNfFhsOo= graphite-dev.cachix.org-1:RppXYpiV1qO2TYKTkXXGHsAEQDOB5G51b3VlrN9QmbI=

- name: 🔎 Check whether development shell is already in binary cache
id: cache-check
run: |
out_path="$(nix eval --raw .#devShells.x86_64-linux.default.outPath)"
if nix path-info --store https://graphite-dev.cachix.org "$out_path" &>/dev/null; then
echo "cached=true" >> "$GITHUB_OUTPUT"
echo "Development shell is already cached at $out_path"
else
echo "cached=false" >> "$GITHUB_OUTPUT"
echo "Development shell is not cached"
fi

- name: 📦 Build Nix development shell
if: steps.cache-check.outputs.cached == 'false'
run: nix build .#devShells.x86_64-linux.default --no-link --print-out-paths

- name: 📤 Push Nix development shell to binary cache
if: steps.cache-check.outputs.cached == 'false'
env:
NIX_CACHE_AUTH_TOKEN: ${{ secrets.NIX_CACHE_AUTH_TOKEN_DEV }}
run: |
nix run nixpkgs#cachix -- authtoken $NIX_CACHE_AUTH_TOKEN
nix build .#devShells.x86_64-linux.default --no-link --print-out-paths | nix run nixpkgs#cachix -- push graphite-dev
7 changes: 4 additions & 3 deletions .github/workflows/provide-shaders.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,10 @@ jobs:

- name: ❄ Install Nix
uses: DeterminateSystems/nix-installer-action@main

- name: 💾 Set up Nix cache
uses: DeterminateSystems/magic-nix-cache-action@main
with:
extra-conf: |
extra-substituters = https://graphite.cachix.org https://graphite-dev.cachix.org
extra-trusted-public-keys = graphite.cachix.org-1:B7Il1yMpkquN/dXM+5GRmz+4Xmu2aaCS1GcWNfFhsOo= graphite-dev.cachix.org-1:RppXYpiV1qO2TYKTkXXGHsAEQDOB5G51b3VlrN9QmbI=

- name: 🏗 Build graphene raster nodes shaders
run: nix build .#graphite-raster-nodes-shaders && cp result raster_nodes_shaders_entrypoint.wgsl
Expand Down
Loading