From 45b876c42ecbe59353d1cd2b130c934acae30ad9 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Wed, 5 Aug 2026 17:55:30 -0400 Subject: [PATCH 1/2] ci/nix-install-ephemeral: Use envvars instead of inputs for secrecy Using the inputs in the run uses github workflow templating ends up printing the secret in bash, we don't have a leak because GITHUB masks it with `*` but thats a bug away from being a problem so lets do better. --- .github/actions/nix-install-ephemeral/action.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index 9ed0af704..cbbf5e9eb 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -23,8 +23,11 @@ runs: shell: bash run: | abort() { echo "$@" >&2; exit 1; } - [[ -z "${{ inputs.nix-signing-key}}" ]] && abort "nix-signing-key is required when push-to-cache is true" - [[ -z "${{ inputs.role-to-assume}}" ]] && abort "role-to-assume is required when push-to-cache is true" + [[ -n ${NIX_SIGNING_KEY:+ok} ]] || abort "nix-signing-key is required when push-to-cache is true" + [[ -n ${ROLE_TO_ASSUME:+ok} ]] || abort "role-to-assume is required when push-to-cache is true" + env: + NIX_SIGNING_KEY: ${{ inputs.nix-signing-key }} + ROLE_TO_ASSUME: ${{ inputs.role-to-assume }} - name: configure aws credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 From 072e34981a5c658ef57d88a076a12eae35faed2b Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Wed, 5 Aug 2026 17:26:19 -0400 Subject: [PATCH 2/2] ci/nix-install-ephemeral: Fix broken push-to-cache Whoops, github is comparing the input which is a string to _true_ which is false, need to stringify true instead. --- .github/actions/nix-install-ephemeral/action.yml | 6 +++--- .github/actions/nix-install-ephemeral/setup-push.sh | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index cbbf5e9eb..0fee0372d 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -19,7 +19,7 @@ runs: using: composite steps: - name: validate push-to-cache required inputs - if: inputs.push-to-cache == true + if: inputs.push-to-cache == 'true' shell: bash run: | abort() { echo "$@" >&2; exit 1; } @@ -31,7 +31,7 @@ runs: - name: configure aws credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 - if: inputs.push-to-cache == true + if: inputs.push-to-cache == 'true' with: role-to-assume: ${{ inputs.role-to-assume }} aws-region: ${{ inputs.aws-region }} @@ -45,7 +45,7 @@ runs: AWS_REGION: ${{ inputs.aws-region }} GITHUB_TOKEN: ${{ github.token }} NIX_SIGN_SECRET_KEY: ${{ inputs.nix-signing-key }} - PUSH_TO_CACHE: ${{ inputs.push-to-cache == true }} + PUSH_TO_CACHE: ${{ inputs.push-to-cache == 'true' }} - name: verify nix in path shell: bash diff --git a/.github/actions/nix-install-ephemeral/setup-push.sh b/.github/actions/nix-install-ephemeral/setup-push.sh index f1d779fbd..27ff10476 100755 --- a/.github/actions/nix-install-ephemeral/setup-push.sh +++ b/.github/actions/nix-install-ephemeral/setup-push.sh @@ -30,6 +30,6 @@ cat >"$NIXCONFDIR/upload-to-cache.sh" <<-EOF export IFS=' ' echo $NIXBINDIR/nix copy --max-jobs 5 --to 's3://nix-postgres-artifacts?secret-key=$NIXCONFDIR/nix-secret-key' \$OUT_PATHS EOF -chmod o+x "$NIXCONFDIR/upload-to-cache.sh" +chmod 755 "$NIXCONFDIR/upload-to-cache.sh" echo "post-build-hook = $NIXCONFDIR/upload-to-cache.sh"