ci: skip nix cache push when credentials aren't configured - #2396
Open
brainrake wants to merge 1 commit into
Open
ci: skip nix cache push when credentials aren't configured#2396brainrake wants to merge 1 commit into
brainrake wants to merge 1 commit into
Conversation
push-to-cache: true previously hard-failed the whole job if nix-signing-key/role-to-assume were empty. Cache reads are public and unauthenticated; only the write-back needs credentials, and it's an optimization, not something that should block a build. Now resolves push-to-cache once, downgrading to false (with a notice) when requested but the credentials aren't actually present, instead of aborting. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mmlb
reviewed
Aug 24, 2026
| NIX_SIGNING_KEY: ${{ inputs.nix-signing-key }} | ||
| ROLE_TO_ASSUME: ${{ inputs.role-to-assume }} | ||
| VALUE=false | ||
| if [[ "${{ inputs.push-to-cache }}" == true && -n "${{ inputs.nix-signing-key }}" && -n "${{ inputs.role-to-assume }}" ]]; then |
Collaborator
There was a problem hiding this comment.
fyi I went through env and the :+ok as a defense in depth in case github ships a bug and fails to mask the signing-key (previously would have thought not a chance that would happen, but these days...)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
`push-to-cache: true` previously hard-failed the whole job if `nix-signing-key`/`role-to-assume` were empty. Now it resolves once whether push-to-cache is actually possible (requested and credentials present), and downgrades to skipping the cache push (with a `::notice::`) instead of aborting when they're not.
Why
Cache reads (`extra-substituters`) are public and unauthenticated — only the write-back needs credentials. That write is an optimization, not something that should block an otherwise-successful build. This also means any repo whose flake re-exports this one, and doesn't have (or want) its own AWS/nix-cache credentials configured, gets a fully green CI without needing to provision anything — it just never gets the cache-write optimization.
Behavior when both credentials are present: unchanged.
🤖 Generated with Claude Code