actions

Forgejo actions for git.jingus.dev, built for the nix runner image (see jingus/runner-images). Each action is a directory with an action.yml, consumed by pointing uses: at main. Both actions self-test in CI on every push.

attic-cache

Attach a post-build-hook that pushes every locally built nix store path to an Attic binary cache. Substituted paths never trigger the hook, so public caches (cache.nixos.org) are never duplicated. Every nix command in later steps of the job is cached automatically — no per-command plumbing.

• Requires: the nix runner image (attic + jq preinstalled)
• Config: server / cache / token inputs, falling back to the user-level ATTIC_SERVER / ATTIC_CACHE variables and ATTIC_TOKEN secret — incomplete config (e.g. fork PRs) degrades to a warning, not a failure

- uses: https://git.jingus.dev/jingus/actions/attic-cache@main
  with:
    server: ${{ vars.ATTIC_SERVER || secrets.ATTIC_SERVER }}
    cache: ${{ vars.ATTIC_CACHE || secrets.ATTIC_CACHE }}
    token: ${{ secrets.ATTIC_TOKEN }}
- run: nix flake check # everything built here is pushed

publish-nix-image

Publish a deterministic nix-built container image under an identity tag (the image's output store path hash, computed by pure eval) plus :latest. If the identity tag already exists in the registry, the build is skipped entirely — at most :latest is re-pointed with a manifest-only copy. Superseded identity tags are pruned, keeping the current image and (by default) the previous one as a rollback tag.

• Requires: the nix runner image and a deterministic image derivation (dockerTools.buildImage without created = now) — identity-tag skipping is only sound for reproducible builds
• Auth: token input (fallback: REGISTRY_TOKEN secret) and user input (fallback: GITHUB_REPOSITORY_OWNER); only the publish path needs credentials — checks and re-points of public packages are anonymous
• Outputs: skipped, published, changed, image-id, digest, out-path

- uses: https://git.jingus.dev/jingus/actions/publish-nix-image@main
  with:
    image: git.jingus.dev/jingus/nix-runner
    attribute: .#nix-runner-image
    token: ${{ secrets.REGISTRY_TOKEN }}