mic92/hestia-cache
Nix binary cache backed by the GitHub Actions cache (v2 API). Wires a substituter and post-build-hook into nix.conf.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| binary | Path to a pre-built hestia binary (e.g. the result of `nix build`). Takes precedence over `version`. | no | "" |
| version | Hestia release tag to download from GitHub releases (e.g. "v0.1.0-beta.1"), or "latest" to auto-resolve the newest release. The downloaded binary is verified against GitHub's build provenance attestations before it runs. | no | latest |
| github-token | Token for the attestation API lookup that verifies downloaded release binaries. | no | ${{ github.token }} |
| listen | Address the substituter HTTP server listens on. Defaults to 127.0.0.1 with a free port picked per invocation, so the action can run more than once in a job without the daemons colliding. | no | "" |
| socket | Unix socket path for the post-build-hook listener. Defaults to a per-invocation path under the runner's temp directory. | no | "" |
| drain-timeout | Maximum number of seconds the post-job step waits for the final upload (chunking, pack upload, manifest commit). | no | 300 |
| upstream-cache-filter | Skip paths signed by an upstream cache (cache.nixos.org by default) instead of caching them. Saves GHA cache quota for projects with big nixpkgs closures. | no | false |
| upstream-cache-key-names | Space-separated signing key names treated as upstream caches by `upstream-cache-filter`. | no | "" |
| no-closure | Cache built paths only, without their runtime closure (dependencies stay on upstream caches). | no | false |
| wait-manifest-version | Wait up to 60s at daemon startup until the cache manifest has at least this version. Matrix build jobs pass the eval job's `manifest-version` output so the just-uploaded drv closures are visible despite GHA cache lookup lag. | no | 0 |
Outputs
no outputs