itzemoji/Aeroflare CI
Build Nix flake installables and push them to one or more OCI binary caches.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| builds | Newline- or comma-separated Nix flake installables to build, e.g. `.#default`. The entry `all` expands to every `packages.<system>.*`, `devShells.<system>.*` and `nixosConfigurations.<host>` the checked-out flake exposes for the runner's system. The entry `changed` expands to only those whose derivation differs from the base commit's. Either can be mixed with explicit installables. Configless mode. Mutually exclusive with `config`. | no | — |
| base | Ref that `changed` diffs against. Defaults to the base the CI event names — `before` for a push, the target branch's tip for a pull request — and falls back to `HEAD~1`. Needs enough history to reach it: set `fetch-depth: 0` on actions/checkout. Also readable from the config file as `base`. | no | — |
| on-missing-base | What `changed` does when no base commit is reachable — a shallow clone, a first push to a branch, a force-push. `all` (default) builds everything, `error` fails the run, `none` builds nothing and succeeds. Also readable from the config file as `on-missing-base`. | no | — |
| cache | Exactly one push target, as `<registry>;<repository>` (e.g. `ghcr.io;me/nix-cache`). Configless mode. Mutually exclusive with `config`. For several caches, use `config`. | no | — |
| config | Path to a `.aeroflare-ci.yaml` declaring `builds` and `caches`. Mutually exclusive with `builds` and `cache`. | no | — |
| compression | NAR compression: zstd (default), xz, gzip, or none. | no | — |
| workers | Concurrent upload workers. Defaults to 50. | no | — |
| upstream-cache | Upstream cache(s) used to skip already-cached paths, newline- or comma-separated. Defaults to https://cache.nixos.org. An explicit value replaces the default rather than extending it — list cache.nixos.org yourself if you still want it. Use `none` (alone) to disable filtering and upload the full closure. | no | — |
| signing-key | Path to a Nix signing key, or the NAME of an environment variable holding the key material. Unsigned when empty. | no | — |
| token | Token for the GitHub API (asset download and provenance verification), and the default push token for ghcr.io. | no | ${{ github.token }} |
| cache-token | Push token for the registry named in `cache`. Exported as AEROFLARE_TOKEN_<HOST>. Omit for ghcr.io, which falls back to `token`. In config mode, set job-level `env:` vars instead, one per registry. | no | — |
| release-repo | `owner/repo` to download the aeroflare-ci release asset from, for running a fork or a test build. Defaults to ItzEmoji/aeroflare. Also readable from the config file as `release-repo`. | no | — |
| release-version | Release to download: `1.11.0`, `v1.11.0`, or `latest` for the newest release in `release-repo`. Defaults to the version this action's ref pins. Also readable from the config file as `release-version`. | no | — |
| skip-attestation | Set to `true` to skip SLSA provenance verification of the downloaded asset. Only for repositories that publish no attestations — it disables a supply-chain check. Also readable from the config file as `skip-attestation`. | no | — |
Outputs
no outputs