From a51d0e72d1fdd93b8cf9c074dd834ac6965cd3f9 Mon Sep 17 00:00:00 2001 From: Andrea Bueide Date: Tue, 21 Jul 2026 13:15:54 -0500 Subject: [PATCH] ci: replace jetify-com/devbox-install-action with our own action Org policy blocks it outright - all actions must come from a GitHub-owned or enterprise-owned repository, and this is neither. Consolidates the previous two-step "Install devbox" + "Route Nix/devbox packages through Artifactory" sequence into one composite action (install-devbox) that does the whole bootstrap: installs Nix via the official single-user installer script (a plain run: step, not a third-party uses: - the same distinction that made the earlier codecov/codecov-action fix work), configures the Artifactory substituter, then builds/installs the patched devbox directly, rather than installing a stock binary first and overwriting it afterward. No other workflow in this repo references a non-GitHub-owned action - checked ci.yml, release.yml, e2e-tests.yml, and publish-e2e-cli.yml; everything else is already actions/* and SHA-pinned. --- .../action.yml | 30 +++++++++++-------- .../configurable-nix-binary-cache.patch | 0 .github/workflows/ci.yml | 8 ++--- .github/workflows/release.yml | 16 +++------- 4 files changed, 24 insertions(+), 30 deletions(-) rename .github/actions/{devbox-artifactory-cache => install-devbox}/action.yml (63%) rename .github/actions/{devbox-artifactory-cache => install-devbox}/configurable-nix-binary-cache.patch (100%) diff --git a/.github/actions/devbox-artifactory-cache/action.yml b/.github/actions/install-devbox/action.yml similarity index 63% rename from .github/actions/devbox-artifactory-cache/action.yml rename to .github/actions/install-devbox/action.yml index edb292cc2..9ec7c7a8f 100644 --- a/.github/actions/devbox-artifactory-cache/action.yml +++ b/.github/actions/install-devbox/action.yml @@ -1,9 +1,20 @@ -name: 'Devbox Artifactory Nix Cache' -description: 'Route devbox/Nix package resolution through Artifactory instead of cache.nixos.org' +name: 'Install Devbox (Artifactory-routed)' +description: 'Install Nix + a patched devbox that resolves packages through Artifactory instead of cache.nixos.org/get.jetify.com' runs: using: 'composite' steps: + # jetify-com/devbox-install-action is blocked by org policy (third-party + # action) - this replaces it. Single-user, no-daemon install: fine for an + # ephemeral CI runner, matches how ajs-renderer's devbox CI image runs Nix + # too (no systemd for a nix-daemon in either environment). + - name: Install Nix + shell: bash + run: | + set -euo pipefail + sh <(curl -L https://nixos.org/nix/install) --no-daemon + echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH" + - name: Configure Nix substituter shell: bash run: | @@ -11,17 +22,15 @@ runs: NIX_CACHE_URL="https://otk.artifactory.twilio.com/artifactory/remote-nix-cache-nixos" - # User-level nix.conf (merged with any system config) - no sudo needed, - # works regardless of how the Nix install in the previous step laid - # out its system config. mkdir -p "$HOME/.config/nix" { echo "substituters = https://cache.nixos.org ${NIX_CACHE_URL}" echo "trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" } >> "$HOME/.config/nix/nix.conf" - # Read by our patched devbox binary (see below) as the fromStore for - # fetchClosure - stock devbox hardcodes cache.nixos.org and ignores this. + # Read by our patched devbox binary (built below) as the fromStore + # for fetchClosure - stock devbox hardcodes cache.nixos.org and + # ignores this. echo "DEVBOX_NIX_BINARY_CACHE=${NIX_CACHE_URL}" >> "$GITHUB_ENV" # Upstream devbox always fetches package outputs from cache.nixos.org @@ -30,15 +39,13 @@ runs: # build a patched binary from the exact devbox version this repo's # devbox.lock nixpkgs pin already provides (0.16.0 @ nixpkgs-unstable # afce96367b2e37fc29afb5543573cd49db3357b7), same patch already in use by - # segmentio/ajs-renderer - and overwrite whatever devbox-install-action - # just put on PATH, so every later `devbox run` call picks it up - # regardless of PATH ordering. + # segmentio/ajs-renderer. - name: Build and install patched devbox shell: bash run: | set -euo pipefail - STOCK_DEVBOX="$(command -v devbox)" + export PATH="$HOME/.nix-profile/bin:$PATH" nix --extra-experimental-features 'nix-command flakes' profile install \ --impure --expr ' @@ -50,5 +57,4 @@ runs: }) ' - cp -f "$(command -v devbox)" "$STOCK_DEVBOX" devbox version diff --git a/.github/actions/devbox-artifactory-cache/configurable-nix-binary-cache.patch b/.github/actions/install-devbox/configurable-nix-binary-cache.patch similarity index 100% rename from .github/actions/devbox-artifactory-cache/configurable-nix-binary-cache.patch rename to .github/actions/install-devbox/configurable-nix-binary-cache.patch diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dbc50221d..13647d321 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,9 +17,7 @@ jobs: steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Install devbox - uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0 - - name: Route Nix/devbox packages through Artifactory - uses: ./.github/actions/devbox-artifactory-cache + uses: ./.github/actions/install-devbox - name: Install dependencies run: devbox run ci:install - name: Lint (eslint) @@ -40,9 +38,7 @@ jobs: steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Install devbox - uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0 - - name: Route Nix/devbox packages through Artifactory - uses: ./.github/actions/devbox-artifactory-cache + uses: ./.github/actions/install-devbox - name: Install dependencies run: devbox run ci:install - name: Validate PR title diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ee7221fed..08615b2d6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,9 +31,7 @@ jobs: - name: Artifactory OIDC Auth uses: ./.github/actions/artifactory-oidc - name: Install devbox - uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0 - - name: Route Nix/devbox packages through Artifactory - uses: ./.github/actions/devbox-artifactory-cache + uses: ./.github/actions/install-devbox - name: Install dependencies run: devbox run ci:install - name: Lint (eslint) @@ -67,9 +65,7 @@ jobs: uses: ./.github/actions/artifactory-oidc - name: Install devbox - uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0 - - name: Route Nix/devbox packages through Artifactory - uses: ./.github/actions/devbox-artifactory-cache + uses: ./.github/actions/install-devbox - name: Release (dry-run) run: devbox run release-dry-run @@ -97,9 +93,7 @@ jobs: uses: ./.github/actions/artifactory-oidc - name: Install devbox - uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0 - - name: Route Nix/devbox packages through Artifactory - uses: ./.github/actions/devbox-artifactory-cache + uses: ./.github/actions/install-devbox - name: Release (beta) run: | @@ -130,9 +124,7 @@ jobs: uses: ./.github/actions/artifactory-oidc - name: Install devbox - uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0 - - name: Route Nix/devbox packages through Artifactory - uses: ./.github/actions/devbox-artifactory-cache + uses: ./.github/actions/install-devbox - name: Release (production) run: devbox run release