From b90ea10c24a9936f3401780687cb6a2b49e067ca Mon Sep 17 00:00:00 2001 From: Yann Hodique Date: Mon, 7 Sep 2026 10:48:51 +0200 Subject: [PATCH] ci: install Nix with nix-quick-install-action in the docs job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docs.yml's build job spent more time installing Nix than doing its work: 23-26s on DeterminateSystems/nix-installer-action against 8-9s of `nix eval` and ~3s of pip, in a 40-47s job. It builds nothing at all, so the multi-user daemon and 32 nixbld users it stands up are pure overhead. nixbuild/nix-quick-install-action unpacks a single-user Nix in ~1s. check.yml and cachix.yml deliberately keep the Determinate installer, for two different reasons, both now recorded in the workflows. check.yml was swapped too and measured worse, so it is reverted here. nix-installer-action installs *Determinate* Nix, whose parallel evaluator this flake's cross-system forcing exercises directly. Upstream Nix 2.34.7 from the fast installer took `nix flake check` from ~30s to 60s: 7s saved on install, 30s lost on evaluation, 67s against a 42-48s baseline. docs.yml wins the same trade because its evaluation is 8-9s rather than 30s, so doubling it still costs less than the install saves. cachix.yml is the only job that genuinely builds. Single-user Nix cannot set up the build sandbox on ubuntu-24.04, where unprivileged user namespaces are AppArmor-restricted, and Nix's sandbox-fallback defaults to true — it would disable the sandbox and retry rather than fail, silently publishing unsandboxed builds to a public binary cache. --- .github/workflows/cachix.yml | 8 ++++++++ .github/workflows/check.yml | 8 ++++++++ .github/workflows/docs.yml | 10 +++++++++- 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cachix.yml b/.github/workflows/cachix.yml index df944e2..be0717d 100644 --- a/.github/workflows/cachix.yml +++ b/.github/workflows/cachix.yml @@ -15,6 +15,14 @@ jobs: steps: - uses: actions/checkout@v7 + # Kept on the Determinate installer while check.yml and docs.yml moved to + # nixbuild/nix-quick-install-action. This is the only job that genuinely + # builds, and the fast installer gives single-user Nix: no daemon, no + # nixbld users, and no build sandbox on ubuntu-24.04, where unprivileged + # user namespaces are AppArmor-restricted. Nix's `sandbox-fallback` + # defaults to true, so it would disable the sandbox and retry rather than + # fail — silently publishing unsandboxed builds to a public cache. The + # ~20s is also only ~14% of a run dominated by the network anyway. - uses: DeterminateSystems/nix-installer-action@v22 - uses: cachix/cachix-action@v17 diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 6e84a2c..9ad32f0 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -11,6 +11,14 @@ jobs: steps: - uses: actions/checkout@v7 + # Stays on the Determinate installer even though this job only evaluates, + # because nix-installer-action installs *Determinate* Nix and its parallel + # evaluator is worth more here than the slower install. Measured on this + # job: nixbuild/nix-quick-install-action (upstream Nix 2.34.7) cut the + # install from 8s to 1s but pushed `nix flake check` from ~30s to 60s, + # for a job total of 67s against 42-48s. The forcing below is exactly the + # cross-system evaluation that parallelises, so the trade is lopsided. + # docs.yml has the opposite shape and does use the fast installer. - uses: DeterminateSystems/nix-installer-action@v22 # The registry check forces every system the flake advertises, not just diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index b289791..b197403 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -40,7 +40,15 @@ jobs: with: python-version: "3.12" - - uses: DeterminateSystems/nix-installer-action@v22 + # `nix eval` builds nothing at all, so this job has no use for a daemon or + # build users. Here the installer dominated: 23-26s to install against + # 8-9s of actual evaluation, more than half the job. The single-user + # installer unpacks in ~1s. It gives upstream Nix rather than Determinate + # Nix, so the manifest evaluation loses parallel eval and gets slower — + # but from 8-9s, which the install saving more than covers. check.yml and + # cachix.yml keep the Determinate installer, for different reasons; see + # the notes there. + - uses: nixbuild/nix-quick-install-action@v35 # The registry publishes what it knows about itself here, so the # generator does not have to re-derive it by walking packages/*/data.json.