ci: replace jetify-com/devbox-install-action with our own action

.github/actions/devbox-artifactory-cache/action.yml → .github/actions/install-devbox/action.yml

@@ -1,27 +1,36 @@
-name: 'Devbox Artifactory Nix Cache'
-description: 'Route devbox/Nix package resolution through Artifactory instead of cache.nixos.org'
+name: 'Install Devbox (Artifactory-routed)'
+description: 'Install Nix + a patched devbox that resolves packages through Artifactory instead of cache.nixos.org/get.jetify.com'
 
 runs:
   using: 'composite'
   steps:
+    # jetify-com/devbox-install-action is blocked by org policy (third-party
+    # action) - this replaces it. Single-user, no-daemon install: fine for an
+    # ephemeral CI runner, matches how ajs-renderer's devbox CI image runs Nix
+    # too (no systemd for a nix-daemon in either environment).
+    - name: Install Nix
+      shell: bash
+      run: |
+        set -euo pipefail
+        sh <(curl -L https://nixos.org/nix/install) --no-daemon
+        echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
+
     - name: Configure Nix substituter
       shell: bash
       run: |
         set -euo pipefail
 
         NIX_CACHE_URL="https://otk.artifactory.twilio.com/artifactory/remote-nix-cache-nixos"
 
-        # User-level nix.conf (merged with any system config) - no sudo needed,
-        # works regardless of how the Nix install in the previous step laid
-        # out its system config.
         mkdir -p "$HOME/.config/nix"
         {
           echo "substituters = https://cache.nixos.org ${NIX_CACHE_URL}"
           echo "trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
         } >> "$HOME/.config/nix/nix.conf"
 
-        # Read by our patched devbox binary (see below) as the fromStore for
-        # fetchClosure - stock devbox hardcodes cache.nixos.org and ignores this.
+        # Read by our patched devbox binary (built below) as the fromStore
+        # for fetchClosure - stock devbox hardcodes cache.nixos.org and
+        # ignores this.
         echo "DEVBOX_NIX_BINARY_CACHE=${NIX_CACHE_URL}" >> "$GITHUB_ENV"
 
     # Upstream devbox always fetches package outputs from cache.nixos.org
@@ -30,15 +39,13 @@ runs:
     # build a patched binary from the exact devbox version this repo's
     # devbox.lock nixpkgs pin already provides (0.16.0 @ nixpkgs-unstable
     # afce96367b2e37fc29afb5543573cd49db3357b7), same patch already in use by
-    # segmentio/ajs-renderer - and overwrite whatever devbox-install-action
-    # just put on PATH, so every later `devbox run` call picks it up
-    # regardless of PATH ordering.
+    # segmentio/ajs-renderer.
     - name: Build and install patched devbox
       shell: bash
       run: |
         set -euo pipefail
 
-        STOCK_DEVBOX="$(command -v devbox)"
+        export PATH="$HOME/.nix-profile/bin:$PATH"
 
         nix --extra-experimental-features 'nix-command flakes' profile install \
           --impure --expr '
@@ -50,5 +57,4 @@ runs:
             })
           '
 
-        cp -f "$(command -v devbox)" "$STOCK_DEVBOX"
         devbox version

.github/workflows/ci.yml

@@ -17,9 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0
-      - name: Route Nix/devbox packages through Artifactory
-        uses: ./.github/actions/devbox-artifactory-cache
+        uses: ./.github/actions/install-devbox
       - name: Install dependencies
         run: devbox run ci:install
       - name: Lint (eslint)
@@ -40,9 +38,7 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0
-      - name: Route Nix/devbox packages through Artifactory
-        uses: ./.github/actions/devbox-artifactory-cache
+        uses: ./.github/actions/install-devbox
       - name: Install dependencies
         run: devbox run ci:install
       - name: Validate PR title

.github/workflows/release.yml

@@ -31,9 +31,7 @@ jobs:
       - name: Artifactory OIDC Auth
         uses: ./.github/actions/artifactory-oidc
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0
-      - name: Route Nix/devbox packages through Artifactory
-        uses: ./.github/actions/devbox-artifactory-cache
+        uses: ./.github/actions/install-devbox
       - name: Install dependencies
         run: devbox run ci:install
       - name: Lint (eslint)
@@ -67,9 +65,7 @@ jobs:
         uses: ./.github/actions/artifactory-oidc
 
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0
-      - name: Route Nix/devbox packages through Artifactory
-        uses: ./.github/actions/devbox-artifactory-cache
+        uses: ./.github/actions/install-devbox
 
       - name: Release (dry-run)
         run: devbox run release-dry-run
@@ -97,9 +93,7 @@ jobs:
         uses: ./.github/actions/artifactory-oidc
 
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0
-      - name: Route Nix/devbox packages through Artifactory
-        uses: ./.github/actions/devbox-artifactory-cache
+        uses: ./.github/actions/install-devbox
 
       - name: Release (beta)
         run: |
@@ -130,9 +124,7 @@ jobs:
         uses: ./.github/actions/artifactory-oidc
 
       - name: Install devbox
-        uses: jetify-com/devbox-install-action@a0d2d53632934ae004f878c840055956d9f741b0 # v0.14.0
-      - name: Route Nix/devbox packages through Artifactory
-        uses: ./.github/actions/devbox-artifactory-cache
+        uses: ./.github/actions/install-devbox
 
       - name: Release (production)
         run: devbox run release