ossystems/OSSystems Nix Actions

Run nix flake check and nix build (checks, hosts, dev shells) for a Nix flake, as a step inside your own job.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 6, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: ossystems/nix-actions@11c1ec2b18ccecfc13bef2255b2d32c24942ca4b # v1.0.5

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
token-owner	Org to scope a GitHub App token to (for private flake inputs). Empty disables the token (public flakes).	no	""
client-id	GitHub App Client ID. Preferred over app-id. Required when token-owner is set (unless app-id is given).	no	""
app-id	GitHub App ID. Deprecated: pass client-id instead. Used only when token-owner is set and client-id is empty.	no	""
app-private-key	GitHub App private key. Required when token-owner is set.	no	""
install-nix	"true" to install Nix + restore the store cache (hosted runners without Nix). "false" for self-hosted runners that already have Nix.	no	false
checkout	"true" to checkout the repo first. Set "false" if the job already did.	no	true
fetch-depth	Checkout fetch-depth (when checkout is true).	no	1
ref	Git ref to checkout (when checkout is true). Empty uses the ref that triggered the run.	no	""
flake-check	"true" to run `nix flake check`.	no	true
flake-check-args	Extra args for `nix flake check`.	no	""
trust-flake	"true" to honor the flake's own nixConfig (extra-substituters, extra-trusted-public-keys, etc.) on every nix command by setting `accept-flake-config = true` in NIX_CONFIG. Needed for the flake's binary caches to be used. "false" to ignore the flake's config.	no	true
build-attrs	Installables to `nix build` (e.g. '.#foo .#bar'). The special value "matrix" builds every attr from `.#githubActions.<matrix-name>` in this one job. Empty skips the build.	no	""
build-args	Args passed to `nix build` before the attrs.	no	-L --keep-going
matrix-name	When build-attrs is "matrix", the `.#githubActions.<name>` attribute to read the build list from (the flake's nix-github-actions output).	no	matrix
build-hosts	"true" (default) to build the `config.system.build.toplevel` of every `.#nixosConfigurations` entry in this one job, with no githubActions matrix to maintain. Each build is labelled by the host name (use with checks). Combines with build-attrs. "false" to skip (e.g. a flake with no hosts to build). When the flake exposes no `nixosConfigurations`, nothing is built.	no	true
build-devshells	"true" (default) to build every `.#devShells.<system>.<name>` in this one job, warming the dev environment cache with no githubActions matrix to maintain. Builds the runner's native `system` plus only the platforms explicitly listed in `emulate-systems` (not the daemon's global `extra-platforms`, which a self-hosted runner may set for unrelated cross-builds). Each build is labelled `devshell-<name>-<system>` (use with checks). Combines with build-attrs and build-hosts. "false" to skip. When the flake exposes no `devShells`, nothing is built.	no	true
build-packages	"true" (default) to build every `.#packages.<system>.<name>` in this one job, with no githubActions matrix to maintain. Builds the runner's native `system` plus only the platforms explicitly listed in `emulate-systems` (not the daemon's global `extra-platforms`, which a self-hosted runner may set for unrelated cross-builds). Each build is labelled `package-<name>-<system>` (use with checks). Combines with build-attrs, build-hosts and build-devshells. "false" to skip. When the flake exposes no `packages`, nothing is built.	no	true
emulate-systems	Space-separated extra Nix platforms to build under QEMU emulation (e.g. "aarch64-linux"). Registers binfmt via the tonistiigi/binfmt container and adds the systems to `extra-platforms`, so one runner can build cross-arch Linux derivations with no remote builder. Linux arches only (not Darwin); emulated builds are slow. Needs privileged docker (hosted runners have it). Empty disables emulation.	no	""
checks	"true" to report each built attribute as its own GitHub check run (one status entry per build in the PR Checks tab / merge box), instead of a single combined build. Requires the token to have checks:write. Serializes the builds (loses Nix's cross-attr parallelism). "false" keeps the single combined nix build.	no	false
run	Command to run inside a dev shell (`nix develop --command`). Empty skips it. The shell is `devshell`, defaulting to the flake's default dev shell.	no	""
devshell	Installable for the dev shell (e.g. '.#ci'). Empty uses the flake's default dev shell. Used by `run` and by `export-devshell`.	no	""
export-devshell	"true" to load the dev shell (`devshell`) into the job environment, so every later step in your job runs inside it (env-export via nicknovitski/nix-develop). In this mode the action does setup only (token, NIX_CONFIG, SSH, checkout, Nix) and SKIPS its own flake-check, build and run, so you add your own steps (west update, test, publish) after it. "false" disables env-export.	no	false
ssh-private-key	SSH private key to install at ~/.ssh/id_rsa, for tools that clone private repos over SSH (e.g. `west update`). Empty installs no key.	no	""
ssh-known-hosts	Space-separated hosts to add to ~/.ssh/known_hosts via ssh-keyscan when ssh-private-key is set.	no	github.com

Outputs

name	description
token	The minted GitHub App token, or empty when token-owner is unset.