Don't leak file handles

* Update `detsys-ts` for: `Ignore hyphen-sep'd diags (#83)` (`07c7fc924119a8d9879c1c164ae593049d47f648`)

* Wait for the socket to appear

* ...

---------

Co-authored-by: grahamc <76716+grahamc@users.noreply.github.com>
Co-authored-by: Graham Christensen <graham@grahamc.com>

.editorconfig

@@ -0,0 +1,10 @@
+# https://editorconfig.org
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.envrc

@@ -0,0 +1 @@
+use flake

.eslintrc.json

@@ -0,0 +1,74 @@
+{
+  "plugins": ["@typescript-eslint"],
+  "extends": ["plugin:github/recommended"],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 9,
+    "sourceType": "module",
+    "project": "./tsconfig.json"
+  },
+  "settings": {
+    "import/resolver": {
+      "typescript": {}
+    }
+  },
+  "rules": {
+    "i18n-text/no-en": "off",
+    "eslint-comments/no-use": "off",
+    "import/no-namespace": "off",
+    "no-unused-vars": "off",
+    "@typescript-eslint/no-unused-vars": [
+      "error",
+      {
+        "argsIgnorePattern": "^_"
+      }
+    ],
+    "@typescript-eslint/explicit-member-accessibility": [
+      "error",
+      {
+        "accessibility": "no-public"
+      }
+    ],
+    "@typescript-eslint/no-base-to-string": "error",
+    "@typescript-eslint/no-require-imports": "error",
+    "@typescript-eslint/array-type": "error",
+    "@typescript-eslint/await-thenable": "error",
+    "@typescript-eslint/ban-ts-comment": "error",
+    "camelcase": "error",
+    "@typescript-eslint/consistent-type-assertions": "error",
+    "@typescript-eslint/explicit-function-return-type": [
+      "error",
+      {
+        "allowExpressions": true
+      }
+    ],
+    "@typescript-eslint/func-call-spacing": ["error", "never"],
+    "@typescript-eslint/no-array-constructor": "error",
+    "@typescript-eslint/no-empty-interface": "error",
+    "@typescript-eslint/no-explicit-any": "error",
+    "@typescript-eslint/no-floating-promises": "error",
+    "@typescript-eslint/no-extraneous-class": "error",
+    "@typescript-eslint/no-for-in-array": "error",
+    "@typescript-eslint/no-inferrable-types": "error",
+    "@typescript-eslint/no-misused-new": "error",
+    "@typescript-eslint/no-namespace": "error",
+    "@typescript-eslint/no-non-null-assertion": "warn",
+    "@typescript-eslint/no-unnecessary-qualifier": "error",
+    "@typescript-eslint/no-unnecessary-type-assertion": "error",
+    "@typescript-eslint/no-useless-constructor": "error",
+    "@typescript-eslint/no-var-requires": "error",
+    "@typescript-eslint/prefer-for-of": "warn",
+    "@typescript-eslint/prefer-function-type": "warn",
+    "@typescript-eslint/prefer-includes": "error",
+    "@typescript-eslint/prefer-string-starts-ends-with": "error",
+    "@typescript-eslint/promise-function-async": "error",
+    "@typescript-eslint/require-array-sort-compare": "error",
+    "@typescript-eslint/restrict-plus-operands": "error",
+    "@typescript-eslint/type-annotation-spacing": "error",
+    "@typescript-eslint/unbound-method": "error"
+  },
+  "env": {
+    "node": true,
+    "es6": true
+  }
+}

.gitattributes

@@ -0,0 +1,2 @@
+dist/* linguist-generated=true
+

.github/verify-version.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# This script verifies that the version of Nix installed on the runner
+# matches the version supplied in the first argument.
+
+EXPECTED_VERSION="${1}"
+
+INSTALLED_NIX_VERSION_OUTPUT=$(nix --version)
+INSTALLED_NIX_VERSION=$(echo "${INSTALLED_NIX_VERSION_OUTPUT}" | awk '{print $NF}')
+EXPECTED_OUTPUT="nix (Nix) ${EXPECTED_VERSION}"
+
+if [ "${INSTALLED_NIX_VERSION_OUTPUT}" != "${EXPECTED_OUTPUT}" ]; then
+  echo "Nix version ${INSTALLED_NIX_VERSION} didn't match expected version ${EXPECTED_VERSION}"
+  exit 1
+else
+  echo "Success! Nix version ${INSTALLED_NIX_VERSION} installed as expected"
+  exit 0
+fi

.github/workflows/ci.yml

@@ -3,88 +3,69 @@ name: CI
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [main, curl-data]
+  workflow_dispatch:
 
 jobs:
-  run-x86_64-linux:
-    name: Run x86_64 Linux
+  check-dist-up-to-date:
+    name: Check the dist/ folder is up to date
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
-      - name: Install Nix
-        uses: ./
-        with:
-          logger: pretty
-          log-directives: nix_installer=trace
-          backtrace: full
-      - name: echo $PATH
-        run: echo $PATH
-      - name: Test `nix` with `$GITHUB_PATH`
-        if: success() || failure()
-        run: |
-          nix run nixpkgs#hello
-          nix profile install nixpkgs#hello
-          hello
-          nix store gc
-          nix run nixpkgs#hello
-      - name: Test bash
-        run: nix-instantiate -E 'builtins.currentTime' --eval
-        if: success() || failure()
-        shell: bash --login {0}
-      - name: Test sh
-        run: nix-instantiate -E 'builtins.currentTime' --eval
-        if: success() || failure()
-        shell: sh -l {0}
-      - name: Install Nix again (noop)
-        uses: ./
-        with:
-          logger: pretty
-          log-directives: nix_installer=trace
-          backtrace: full
-      - name: Test `nix` with `$GITHUB_PATH`
-        if: success() || failure()
-        run: |
-          nix run nixpkgs#hello
-          nix profile install nixpkgs#hello
-          hello
-          nix store gc
-          nix run nixpkgs#hello
-      - name: Reinstall Nix
-        uses: ./
-        with:
-          logger: pretty
-          log-directives: nix_installer=trace
-          backtrace: full
-          reinstall: true
-          extra-conf: |
-            use-sqlite-wal = true
-      - name: Test `nix` with `$GITHUB_PATH`
-        if: success() || failure()
-        run: |
-          nix run nixpkgs#hello
-          nix profile install nixpkgs#hello
-          hello
-          nix store gc
-          nix run nixpkgs#hello
-      - name: Verify the generated nix.conf
-        run: |
-          cat -n /etc/nix/nix.conf
-          grep -E "^trusted-users = .*$USER" /etc/nix/nix.conf
-          grep -E "^use-sqlite-wal = true" /etc/nix/nix.conf
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - name: pnpm install
+        run: nix develop --command pnpm install
+      - name: prettier format
+        run: nix develop --command pnpm run check-fmt
+      - name: ESLint
+        run: nix develop --command pnpm run lint
+      - name: tsup build
+        run: nix develop --command pnpm run build
+      - name: ncc package
+        run: nix develop --command pnpm run package
+      - name: Git status
+        run: git status --porcelain=v1
+      - name: Ensure no staged changes
+        run: git diff --exit-code
 
-  run-x86_64-darwin:
-    name: Run x86_64 Darwin
-    runs-on: macos-12
+  install-nix:
+    name: "Test: ${{ matrix.runner }}${{ matrix.determinate && ' with determinate' || '' }}"
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - ubuntu-latest
+        determinate:
+          - true
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install Nix
         uses: ./
         with:
           logger: pretty
           log-directives: nix_installer=trace
           backtrace: full
+          _internal-strict-mode: true
+          determinate: ${{ matrix.determinate }}
+        # - name: Breakpoint if tests failed
+        #   uses: namespacelabs/breakpoint-action@v0
+        #   with:
+        #     duration: 30m
+        #     authorized-users: grahamc
+
       - name: echo $PATH
         run: echo $PATH
+
+      - name: Render the devshell
+        if: success() || failure()
+        run: |
+          nix develop --command date
+
       - name: Test `nix` with `$GITHUB_PATH`
         if: success() || failure()
         run: |
@@ -93,6 +74,7 @@ jobs:
           hello
           nix store gc
           nix run nixpkgs#hello
+
       - name: Test bash
         run: nix-instantiate -E 'builtins.currentTime' --eval
         if: success() || failure()
@@ -102,15 +84,16 @@ jobs:
         if: success() || failure()
         shell: sh -l {0}
       - name: Test zsh
-        run: nix-instantiate -E 'builtins.currentTime' --eval
+        run: if (zsh --help > /dev/null); then zsh --login --interactive -c "nix-instantiate -E 'builtins.currentTime' --eval"; fi
         if: success() || failure()
-        shell: zsh --login --interactive {0}
       - name: Install Nix again (noop)
         uses: ./
         with:
           logger: pretty
           log-directives: nix_installer=trace
           backtrace: full
+          _internal-strict-mode: true
+          determinate: ${{ matrix.determinate }}
       - name: Test `nix` with `$GITHUB_PATH`
         if: success() || failure()
         run: |
@@ -128,6 +111,8 @@ jobs:
           reinstall: true
           extra-conf: |
             use-sqlite-wal = true
+          _internal-strict-mode: true
+          determinate: ${{ matrix.determinate }}
       - name: Test `nix` with `$GITHUB_PATH`
         if: success() || failure()
         run: |
@@ -138,6 +123,7 @@ jobs:
           nix run nixpkgs#hello
       - name: Verify the generated nix.conf
         run: |
+          nix config show
           cat -n /etc/nix/nix.conf
-          grep -E "^trusted-users = .*$USER" /etc/nix/nix.conf
-          grep -E "^use-sqlite-wal = true" /etc/nix/nix.conf
+          nix config show | grep -E "^trusted-users = .*$USER"
+          nix config show | grep -E "^use-sqlite-wal = true"

.gitignore

@@ -0,0 +1,101 @@
+# Dependency directory
+node_modules
+
+# Rest pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+jspm_packages/
+
+# TypeScript v1 declaration files
+typings/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variables file
+.env
+.env.test
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+
+# next.js build output
+.next
+
+# nuxt.js build output
+.nuxt
+
+# vuepress build output
+.vuepress/dist
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# OS metadata
+.DS_Store
+Thumbs.db
+
+# Ignore built ts files
+__tests__/runner/*
+lib/**/*
+
+.direnv

.prettierignore

@@ -0,0 +1,3 @@
+dist/
+lib/
+node_modules/

.prettierrc.json

@@ -0,0 +1 @@
+{}

CONTRIBUTING.md

@@ -0,0 +1,3 @@
+# Submitting Pull Requests
+
+This action is based off https://github.com/actions/javascript-action. As part of your contributing flow you **must** run `npm run all` before we can merge.

README.md

@@ -1,6 +1,20 @@
-# Nix Installer Action
+# The Determinate Nix Installer Action
 
-You can use [`nix-installer`](https://github.com/DeterminateSystems/nix-installer) as a Github action like so:
+Based on the [Determinate Nix Installer](https://github.com/DeterminateSystems/nix-installer), responsible for over tens of thousands of Nix installs daily.
+The fast, friendly, and reliable GitHub Action to install Nix with Flakes.
+
+## Supports
+
+- ✅ **Accelerated KVM** on open source projects and larger runners. See [GitHub's announcement](https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners/) for more info.
+- ✅ Linux, x86_64, aarch64, and i686
+- ✅ macOS, x86_64 and aarch64
+- ✅ WSL2, x86_64 and aarch64
+- ✅ Containers
+- ✅ Valve's SteamOS
+- ✅ GitHub Enterprise Server
+- ✅ GitHub Hosted, self-hosted, and long running Actions Runners
+
+## Usage
 
 ```yaml
 on:
@@ -11,52 +25,101 @@ on:
 jobs:
   lints:
     name: Build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v3
-      - name: Run `nix build`
-        run: nix build .
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - run: nix build .
+```
+
+### With FlakeHub
+
+To fetch private flakes from FlakeHub and Nix builds from FlakeHub Cache, update the `permissions` block and pass `determinate: true`:
+
+```yaml
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  lints:
+    name: Build
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - run: nix build .
 ```
 
 See [`.github/workflows/ci.yml`](.github/workflows/ci.yml) for a full example.
 
+### Advanced Usage
+
+- If KVM is available, the installer sets up KVM so that Nix can use it ,and exports the `DETERMINATE_NIX_KVM` environment variable set to 1.
+  If KVM is not available, `DETERMINATE_NIX_KVM` is set to 0.
+  This can be used in combination with GitHub Actions' `if` syntax for turning on and off steps.
+
+## Installation Differences
+
+Differing from the upstream [Nix](https://github.com/NixOS/nix) installer scripts:
+
+- In `nix.conf`:
+  - the `nix-command` and `flakes` features are enabled
+  - `bash-prompt-prefix` is set
+  - `auto-optimise-store` is set to `true` (On Linux only)
+  * `extra-nix-path` is set to `nixpkgs=flake:nixpkgs`
+  * `max-jobs` is set to `auto`
+- KVM is enabled by default.
+- an installation receipt (for uninstalling) is stored at `/nix/receipt.json` as well as a copy of the install binary at `/nix/nix-installer`
+- `nix-channel --update` is not run, `~/.nix-channels` is not provisioned
+- `ssl-cert-file` is set in `/etc/nix/nix.conf` if the `ssl-cert-file` argument is used.
+
 ## Configuration
 
-| Parameter                | Description                                                                                                                                                                                           | Type                                       | Default                                              |
-| :----------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------- | :--------------------------------------------------- |
-| `backtrace`              | The setting for [`RUST_BACKTRACE`][backtrace]                                                                                                                                                         | string                                     |                                                      |
-| `extra-args`             | Extra arguments to pass to the planner (prefer using structured `with:` arguments unless using a custom [planner]!)                                                                                   | string                                     |                                                      |
-| `extra-conf`             | Extra configuration lines for `/etc/nix/nix.conf` (includes `access-tokens` with `secrets.GITHUB_TOKEN` automatically if `github-token` is set)                                                       | string                                     |                                                      |
-| `github-token`           | A [GitHub token] for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests)                                                                               | string                                     | `${{ github.token }}`                                |
-| `init`                   | The init system to configure (requires `planner: linux-multi`)                                                                                                                                        | enum (`none` or `systemd`)                 |                                                      |
-| `local-root`             | A local `nix-installer` binary root. Overrides the `nix-installer-url` setting (a `nix-installer.sh` should exist, binaries should be named `nix-installer-$ARCH`, eg. `nix-installer-x86_64-linux`). | Boolean                                    | `false`                                              |
-| `log-directives`         | A list of [tracing directives], comma separated with `-`s replaced with `_` (eg. `nix_installer=trace`)                                                                                               | string                                     |                                                      |
-| `logger`                 | The logger to use during installation                                                                                                                                                                 | enum (`pretty`, `json`, `full`, `compact`) |                                                      |
-| `mac-case-sensitive`     | Use a case-sensitive volume (`planner: macos` only)                                                                                                                                                   | Boolean                                    | `false`                                              |
-| `mac-encrypt`            | Force encryption on the volume (`planner: macos` only)                                                                                                                                                | Boolean                                    | `false`                                              |
-| `mac-root-disk`          | The root disk of the target (`planner: macos` only)                                                                                                                                                   | string                                     |                                                      |
-| `mac-volume-label`       | The label for the created [APFS] volume (`planner: macos` only)                                                                                                                                       | string                                     |                                                      |
-| `modify-profile`         | Modify the user [profile] to automatically load Nix                                                                                                                                                   | Boolean                                    | `false`                                              |
-| `nix-build-group-id`     | The Nix build group GID                                                                                                                                                                               | integer                                    |                                                      |
-| `nix-build-group-name`   | The Nix build group name                                                                                                                                                                              | string                                     |                                                      |
-| `nix-build-user-base`    | The Nix build user base UID (ascending)                                                                                                                                                               | integer                                    |                                                      |
-| `nix-build-user-count`   | The number of build users to create                                                                                                                                                                   | integer                                    | 32                                                   |
-| `nix-build-user-prefix`  | The Nix build user prefix (user numbers will be postfixed)                                                                                                                                            | string                                     |                                                      |
-| `nix-installer-branch`   | The branch of `nix-installer` to use (conflicts with the `nix-installer-tag`, `nix-installer-revision`, and `nix-installer-branch`)                                                                   | string                                     |                                                      |
-| `nix-installer-pr`       | The pull request of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, and `nix-installer-branch`)                                                                 | integer                                    |                                                      |
-| `nix-installer-revision` | The revision of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-branch`, and `nix-installer-pr`)                                                                           | string                                     |                                                      |
-| `nix-installer-tag`      | The tag of `nix-installer` to use (conflicts with `nix-installer-revision`, `nix-installer-branch`, `nix-installer-pr`)                                                                               | string                                     |                                                      |
-| `nix-installer-url`      | A URL pointing to a `nix-installer.sh` script                                                                                                                                                         | URL                                        | `https://install.determinate.systems/nix`            |
-| `nix-package-url`        | The Nix package URL                                                                                                                                                                                   | URL                                        |                                                      |
-| `planner`                | The installation [planner] to use                                                                                                                                                                     | enum (`linux` or `macos`)                  |                                                      |
-| `reinstall`              | Force a reinstall if an existing installation is detected (consider backing up `/nix/store`)                                                                                                          | Boolean                                    | `false`                                              |
-| `start-daemon`           | If the daemon should be started, requires `planner: linux-multi`                                                                                                                                      | Boolean                                    | `false`                                              |
-| `trust-runner-user`      | Whether to make the runner user trusted by the Nix daemon                                                                                                                                             | Boolean                                    | `true`                                               |
-| `diagnostic-endpoint`    | Diagnostic endpoint url where the installer sends install [diagnostic reports](https://github.com/DeterminateSystems/nix-installer#diagnostics) to, to disable set this to an empty string            | string                                     | `https://install.determinate.systems/nix/diagnostic` |
-| `proxy`                  | The proxy to use (if any), valid proxy bases are `https://$URL`, `http://$URL` and `socks5://$URL`                                                                                                    | string                                     |                                                      |
-| `ssl-cert-file`          | An SSL cert to use (if any), used for fetching Nix and sets `NIX_SSL_CERT_FILE` for Nix                                                                                                               | string                                     |                                                      |
+| Parameter               | Description                                                                                                                                                                                                                                                                    | Type                                       | Default                                                        |
+| :---------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------- | :------------------------------------------------------------- |
+| `backtrace`             | The setting for [`RUST_BACKTRACE`][backtrace]                                                                                                                                                                                                                                  | string                                     |                                                                |
+| `determinate`           | Whether to install [Determinate Nix](https://determinate.systems/enterprise) and log in to FlakeHub for private Flakes and binary caches.                                                                                                                                      | Boolean                                    | `false`                                                        |
+| `extra-args`            | Extra arguments to pass to the planner (prefer using structured `with:` arguments unless using a custom [planner]!)                                                                                                                                                            | string                                     |                                                                |
+| `extra-conf`            | Extra configuration lines for `/etc/nix/nix.conf` (includes `access-tokens` with `secrets.GITHUB_TOKEN` automatically if `github-token` is set)                                                                                                                                | string                                     |                                                                |
+| `flakehub`              | Deprecated. Implies `determinate`.                                                                                                                                                                                                                                             | Boolean                                    | `false`                                                        |
+| `force-docker-shim`     | Force the use of Docker as a process supervisor. This setting is automatically enabled when necessary.                                                                                                                                                                         | Boolean                                    | `false`                                                        |
+| `github-token`          | A [GitHub token] for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests)                                                                                                                                                        | string                                     | `${{ github.token }}`                                          |
+| `github-server-url`     | The URL for the GitHub server, to use with the `github-token` token. Defaults to the current GitHub server, supporting GitHub Enterprise Server automatically. Only change this value if the provided `github-token` is for a different GitHub server than the current server. | string                                     | `${{ github.server }}`                                         |
+| `init`                  | The init system to configure (requires `planner: linux-multi`)                                                                                                                                                                                                                 | enum (`none` or `systemd`)                 |                                                                |
+| `kvm`                   | Automatically configure the GitHub Actions Runner for NixOS test support, if the host supports it.                                                                                                                                                                             | Boolean                                    | `true`                                                         |
+| `local-root`            | A local `nix-installer` binary root. Overrides the `nix-installer-url` setting (a `nix-installer.sh` should exist, binaries should be named `nix-installer-$ARCH`, eg. `nix-installer-x86_64-linux`).                                                                          | Boolean                                    | `false`                                                        |
+| `log-directives`        | A list of [tracing directives], comma separated with `-`s replaced with `_` (eg. `nix_installer=trace`)                                                                                                                                                                        | string                                     |                                                                |
+| `logger`                | The logger to use during installation                                                                                                                                                                                                                                          | enum (`pretty`, `json`, `full`, `compact`) |                                                                |
+| `mac-case-sensitive`    | Use a case-sensitive volume (`planner: macos` only)                                                                                                                                                                                                                            | Boolean                                    | `false`                                                        |
+| `mac-encrypt`           | Force encryption on the volume (`planner: macos` only)                                                                                                                                                                                                                         | Boolean                                    | `false`                                                        |
+| `mac-root-disk`         | The root disk of the target (`planner: macos` only)                                                                                                                                                                                                                            | string                                     |                                                                |
+| `mac-volume-label`      | The label for the created [APFS] volume (`planner: macos` only)                                                                                                                                                                                                                | string                                     |                                                                |
+| `modify-profile`        | Modify the user [profile] to automatically load Nix                                                                                                                                                                                                                            | Boolean                                    | `false`                                                        |
+| `nix-build-group-id`    | The Nix build group GID                                                                                                                                                                                                                                                        | integer                                    |                                                                |
+| `nix-build-group-name`  | The Nix build group name                                                                                                                                                                                                                                                       | string                                     |                                                                |
+| `nix-build-user-base`   | The Nix build user base UID (ascending)                                                                                                                                                                                                                                        | integer                                    |                                                                |
+| `nix-build-user-count`  | The number of build users to create                                                                                                                                                                                                                                            | integer                                    | 32                                                             |
+| `nix-build-user-prefix` | The Nix build user prefix (user numbers will be postfixed)                                                                                                                                                                                                                     | string                                     |                                                                |
+| `source-branch`         | The branch of `nix-installer` to use (conflicts with the `source-tag`, `source-revision`, and `source-branch`)                                                                                                                                                                 | string                                     |                                                                |
+| `source-pr`             | The pull request of `nix-installer` to use (conflicts with `source-tag`, `source-revision`, and `source-branch`)                                                                                                                                                               | integer                                    |                                                                |
+| `source-revision`       | The revision of `nix-installer` to use (conflicts with `source-tag`, `source-branch`, and `source-pr`)                                                                                                                                                                         | string                                     |                                                                |
+| `source-tag`            | The tag of `nix-installer` to use (conflicts with `source-revision`, `source-branch`, `source-pr`)                                                                                                                                                                             | string                                     |                                                                |
+| `source-url`            | A URL pointing to the `nix-installer` binary                                                                                                                                                                                                                                   | URL                                        | n/a (calculated)                                               |
+| `nix-package-url`       | The Nix package URL                                                                                                                                                                                                                                                            | URL                                        |                                                                |
+| `planner`               | The installation [planner] to use                                                                                                                                                                                                                                              | enum (`linux` or `macos`)                  |                                                                |
+| `reinstall`             | Force a reinstall if an existing installation is detected (consider backing up `/nix/store`)                                                                                                                                                                                   | Boolean                                    | `false`                                                        |
+| `start-daemon`          | If the daemon should be started, requires `planner: linux-multi`                                                                                                                                                                                                               | Boolean                                    | `false`                                                        |
+| `trust-runner-user`     | Whether to make the runner user trusted by the Nix daemon                                                                                                                                                                                                                      | Boolean                                    | `true`                                                         |
+| `diagnostic-endpoint`   | Diagnostic endpoint url where the installer sends install [diagnostic reports](https://github.com/DeterminateSystems/nix-installer#diagnostics) to, to disable set this to an empty string                                                                                     | string                                     | `https://install.determinate.systems/nix-installer/diagnostic` |
+| `proxy`                 | The proxy to use (if any), valid proxy bases are `https://$URL`, `http://$URL` and `socks5://$URL`                                                                                                                                                                             | string                                     |                                                                |
+| `ssl-cert-file`         | An SSL cert to use (if any), used for fetching Nix and sets `NIX_SSL_CERT_FILE` for Nix                                                                                                                                                                                        | string                                     |                                                                |
 
 [apfs]: https://en.wikipedia.org/wiki/Apple_File_System
 [backtrace]: https://doc.rust-lang.org/std/backtrace/index.html#environment-variables

action.yml

@@ -7,20 +7,42 @@ inputs:
   backtrace:
     description: The setting for `RUST_BACKTRACE` (see https://doc.rust-lang.org/std/backtrace/index.html#environment-variables)
     required: false
+  determinate:
+    description: |
+      Whether to install [Determinate Nix](https://determinate.systems/enterprise) and log in to FlakeHub for private Flakes and binary caches.
+    default: false
   extra-args:
     description: Extra args to pass to the planner (prefer using structured `with:` arguments unless using a custom planner!)
     required: false
   extra-conf:
     description: Extra configuration lines for `/etc/nix/nix.conf` (includes `access-tokens` with `secrets.GITHUB_TOKEN` automatically if `github-token` is set)
     required: false
+  flakehub:
+    description: Deprecated. Implies `determinate`.
+    required: false
+    default: false
+  force-docker-shim:
+    description: Force the use of Docker as a process supervisor. This setting is automatically enabled when necessary.
+    required: false
+    default: false
   github-token:
     description: A GitHub token for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests)
     default: ${{ github.token }}
+  github-server-url:
+    description: The URL for the GitHub server, to use with the `github-token` token. Defaults to the current GitHub server, supporting GitHub Enterprise Server automatically. Only change this value if the provided `github-token` is for a different GitHub server than the current server.
+    default: ${{ github.server_url }}
   init:
     description: "The init system to configure, requires `planner: linux-multi` (allowing the choice between `none` or `systemd`)"
     required: false
+  job-status:
+    description: The overall status of the job. Set automatically, for aggregate analysis of Nix stability.
+    default: ${{ job.status }}
+  kvm:
+    description: Automatically configure the GitHub Actions Runner for NixOS test supports, if the host supports it.
+    required: false
+    default: true
   local-root:
-    description: A local `nix-installer` binary root, overrides the `nix-installer-url` setting (a `nix-installer.sh` script should exist, binaries should be named `nix-installer-$ARCH`, eg. `nix-installer-x86_64-linux`)
+    description: A local `nix-installer` binary root, overrides any settings which change the `nix-installer` used (binaries should be named `nix-installer-$ARCH-$OS`, eg. `nix-installer-x86_64-linux`)
     required: false
   log-directives:
     description: A list of Tracing directives, comma separated, `-`s replaced with `_` (eg. `nix_installer=trace`, see https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#directives)
@@ -31,7 +53,7 @@ inputs:
   ssl-cert-file:
     description: "An SSL cert to use (if any), used for fetching Nix and sets `NIX_SSL_CERT_FILE` for Nix"
     required: false
-  pproxy:
+  proxy:
     description: "The proxy to use (if any), valid proxy bases are `https://$URL`, `http://$URL` and `socks5://$URL`"
     required: false
   mac-case-sensitive:
@@ -49,6 +71,7 @@ inputs:
   modify-profile:
     description: Modify the user profile to automatically load nix
     required: false
+    default: true
   nix-build-group-id:
     description: The Nix build group GID
     required: false
@@ -64,20 +87,23 @@ inputs:
   nix-build-user-prefix:
     description: The Nix build user prefix (user numbers will be postfixed)
     required: false
-  nix-installer-branch:
-    description: The branch of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, `nix-installer-pr`)
+  source-binary:
+    description: Run a version of the nix-installer binary from somewhere already on disk. Conflicts with all other `source-*` options. Intended only for testing this Action.
     required: false
-  nix-installer-pr:
-    description: The PR of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, `nix-installer-branch`)
+  source-branch:
+    description: The branch of `nix-installer` to use (conflicts with `source-tag`, `source-revision`, `source-pr`)
     required: false
-  nix-installer-revision:
-    description: The revision of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-branch`, `nix-installer-pr`)
+  source-pr:
+    description: The PR of `nix-installer` to use (conflicts with `source-tag`, `source-revision`, `source-branch`)
     required: false
-  nix-installer-tag:
-    description: The tag of `nix-installer` to use (conflicts with `nix-installer-revision`, `nix-installer-branch`, `nix-installer-pr`)
+  source-revision:
+    description: The revision of `nix-installer` to use (conflicts with `source-tag`, `source-branch`, `source-pr`)
     required: false
-  nix-installer-url:
-    description: A URL pointing to a `nix-installer.sh` script
+  source-tag:
+    description: The tag of `nix-installer` to use (conflicts with `source-revision`, `source-branch`, `source-pr`)
+    required: false
+  source-url:
+    description: A URL pointing to a `nix-installer` executable
     required: false
   nix-package-url:
     description: The Nix package URL
@@ -88,225 +114,39 @@ inputs:
   reinstall:
     description: Force a reinstall if an existing installation is detected (consider backing up `/nix/store`)
     required: false
+    default: false
   start-daemon:
-    description: "If the daemon should be started, requires `planner: linux-multi`"
+    description: "If the daemon should be started, requires `planner: linux`"
     required: false
+    default: true
   diagnostic-endpoint:
     description: "Diagnostic endpoint url where the installer sends data to. To disable set this to an empty string."
-    default: "https://install.determinate.systems/nix/diagnostic"
+    required: false
+    default: "-"
   trust-runner-user:
     description: Whether to make the runner user trusted by the Nix daemon
-    default: "true"
+    default: true
+  nix-installer-branch:
+    description: (deprecated) The branch of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, `nix-installer-pr`)
+    required: false
+  nix-installer-pr:
+    description: (deprecated) The PR of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, `nix-installer-branch`)
+    required: false
+  nix-installer-revision:
+    description: (deprecated) The revision of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-branch`, `nix-installer-pr`)
+    required: false
+  nix-installer-tag:
+    description: (deprecated) The tag of `nix-installer` to use (conflicts with `nix-installer-revision`, `nix-installer-branch`, `nix-installer-pr`)
+    required: false
+  nix-installer-url:
+    description: (deprecated) A URL pointing to a `nix-installer.sh` script
+    required: false
+  _internal-strict-mode:
+    description: Whether to fail when any errors are thrown. Used only to test the Action; do not set this in your own workflows.
+    required: false
+    default: false
 
 runs:
-  using: composite
-  steps:
-    - name: Install Nix
-      shell: bash
-      run: |
-        if [ -f "/nix/receipt.json" ] && [ -f "/nix/nix-installer" ]; then
-          if ([ -n "${{ inputs.nix-installer-revision }}" ] || [ -n "${{ inputs.nix-installer-branch }}" ]) && [ "${{ inputs.reinstall }}" != "true" ]; then
-            echo "Detection of existing installation versions isn't supported when `nix-installer-revision` or `nix-installer-branch` are set, `reinstall: true` should also be set"
-          fi
-
-          if [ -n "${{ inputs.reinstall }}" ] && [ "${{ inputs.reinstall }}" == "true" ]; then
-            /nix/nix-installer uninstall --no-confirm
-          else
-            EXISTING_VERSION=$(/nix/nix-installer --version | awk '{ print $2 }')
-            if [ -n "${{ inputs.nix-installer-tag }}" ] && [ "${{ inputs.nix-installer-tag }}" != "$EXISTING_VERSION" ]; then
-              echo "`nix-installer` version mismatch, use `reinstall: true` to reinstall Nix using the new `nix-installer` version (consider backing up `/nix/store`)"
-              exit 1
-            fi
-            echo "Nix was already installed, using existing install"
-            echo "/nix/var/nix/profiles/default/bin" >> $GITHUB_PATH
-            echo "$HOME/.nix-profile/bin" >> $GITHUB_PATH
-            exit 0
-          fi
-        fi
-
-        if [ -n "${{ inputs.modify-profile }}" ]; then
-          export NIX_INSTALLER_MODIFY_PROFILE=${{ inputs.modify-profile }}
-          echo "Set NIX_INSTALLER_MODIFY_PROFILE=$NIX_INSTALLER_MODIFY_PROFILE"
-        fi
-
-        if [ -n "${{ inputs.nix-build-user-count }}" ]; then
-          export NIX_INSTALLER_NIX_BUILD_USER_COUNT=${{ inputs.nix-build-user-count }}
-          echo "Set NIX_INSTALLER_NIX_BUILD_USER_COUNT=$NIX_INSTALLER_NIX_BUILD_USER_COUNT"
-        fi
-
-        if [ -n "${{ inputs.nix-build-group-name }}" ]; then
-          export NIX_INSTALLER_NIX_BUILD_GROUP_NAME=${{ inputs.nix-build-group-name }}
-          echo "Set NIX_INSTALLER_NIX_BUILD_GROUP_NAME=$NIX_INSTALLER_NIX_BUILD_GROUP_NAME"
-        fi
-
-        if [ -n "${{ inputs.nix-build-group-id }}" ]; then
-          export NIX_INSTALLER_NIX_BUILD_GROUP_ID=${{ inputs.nix-build-group-id }}
-          echo "Set NIX_INSTALLER_NIX_BUILD_GROUP_ID=$NIX_INSTALLER_NIX_BUILD_GROUP_ID"
-        fi
-
-        if [ -n "${{ inputs.nix-build-user-prefix }}" ]; then
-          export NIX_INSTALLER_NIX_BUILD_USER_ID_BASE=${{ inputs.nix-build-user-prefix }}
-          echo "Set NIX_INSTALLER_NIX_BUILD_USER_ID_BASE=$NIX_INSTALLER_NIX_BUILD_USER_ID_BASE"
-        fi
-
-        if [ -n "${{ inputs.nix-build-user-base }}" ]; then
-          export NIX_INSTALLER_NIX_BUILD_USER_PREFIX=${{ inputs.nix-build-user-base }}
-          echo "Set NIX_INSTALLER_NIX_BUILD_USER_PREFIX=$NIX_INSTALLER_NIX_BUILD_USER_PREFIX"
-        fi
-
-        if [ -n "${{ inputs.nix-package-url }}" ]; then
-          export NIX_INSTALLER_NIX_PACKAGE_URL=${{ inputs.nix-package-url }}
-          echo "Set NIX_INSTALLER_NIX_PACKAGE_URL=$NIX_INSTALLER_NIX_PACKAGE_URL"
-        fi
-
-        NIX_EXTRA_CONF=""
-        NEWLINE='
-        '
-        if [ -n "${{ inputs.extra-conf }}" ]; then
-          NIX_EXTRA_CONF="${{ inputs.extra-conf }}"
-        fi
-        if [ -n "${{ inputs.github-token }}" ]; then
-          NIX_EXTRA_CONF="${NIX_EXTRA_CONF:+$NIX_EXTRA_CONF$NEWLINE}access-tokens = github.com=${{ inputs.github-token }}"
-        fi
-        if [ "${{ inputs.trust-runner-user }}" == "true" ]; then
-          NIX_EXTRA_CONF="${NIX_EXTRA_CONF:+$NIX_EXTRA_CONF$NEWLINE}trusted-users = root $USER"
-        fi
-        if [ -n "$NIX_EXTRA_CONF" ]; then
-          export NIX_INSTALLER_EXTRA_CONF="$NIX_EXTRA_CONF"
-          echo "Set NIX_INSTALLER_EXTRA_CONF=$NIX_INSTALLER_EXTRA_CONF"
-        fi
-
-        if [ -n "${{ inputs.mac-encrypt }}" ]; then
-          export NIX_INSTALLER_ENCRYPT=${{ inputs.mac-encrypt }}
-          echo "Set NIX_INSTALLER_ENCRYPT=$NIX_INSTALLER_ENCRYPT"
-        fi
-
-        if [ -n "${{ inputs.mac-case-sensitive }}" ]; then
-          export NIX_INSTALLER_CASE_SENSITIVE=${{ inputs.mac-case-sensitive }}
-          echo "Set NIX_INSTALLER_CASE_SENSITIVE=$NIX_INSTALLER_CASE_SENSITIVE"
-        fi
-
-        if [ -n "${{ inputs.mac-volume-label }}" ]; then
-          export NIX_INSTALLER_VOLUME_LABEL=${{ inputs.mac-volume-label }}
-          echo "Set NIX_INSTALLER_VOLUME_LABEL=$NIX_INSTALLER_VOLUME_LABEL"
-        fi
-
-        if [ -n "${{ inputs.mac-root-disk }}" ]; then
-          export NIX_INSTALLER_ROOT_DISK=${{ inputs.mac-root-disk }}
-          echo "Set NIX_INSTALLER_ROOT_DISK=$NIX_INSTALLER_ROOT_DISK"
-        fi
-
-        if [ -n "${{ inputs.nix-installer-pr }}" ] && [ -n "${{ inputs.nix-installer-tag }}" ]; then
-          echo "The nix-installer-pr and nix-installer-tag options conflict, please choose one"
-          exit 1
-        fi
-        if [ -n "${{ inputs.nix-installer-pr }}" ] && [ -n "${{ inputs.nix-installer-revision }}" ]; then
-          echo "The nix-installer-pr and nix-installer-revision options conflict, please choose one"
-          exit 1
-        fi
-        if [ -n "${{ inputs.nix-installer-pr }}" ] && [ -n "${{ inputs.nix-installer-branch }}" ]; then
-          echo "The nix-installer-pr and nix-installer-branch options conflict, please choose one"
-          exit 1
-        fi
-        if [ -n "${{ inputs.nix-installer-tag }}" ] && [ -n "${{ inputs.nix-installer-revision }}" ]; then
-          echo "The nix-installer-tag and nix-installer-revision options conflict, please choose one"
-          exit 1
-        fi
-        if [ -n "${{ inputs.nix-installer-branch }}" ] && [ -n "${{ inputs.nix-installer-revision }}" ]; then
-          echo "The nix-installer-branch and nix-installer-revision options conflict, please choose one"
-          exit 1
-        fi
-        if [ -n "${{ inputs.nix-installer-tag }}" ] && [ -n "${{ inputs.nix-installer-branch }}" ]; then
-          echo "The nix-installer-tag and nix-installer-branch options conflict, please choose one"
-          exit 1
-        fi
-        if [ -n "${{ inputs.nix-installer-url }}" ] && [ -n "${{ inputs.nix-installer-pr }}" ]; then
-          echo "The nix-installer-url and nix-installer-pr options conflict, please choose one"
-          exit 1
-        fi
-        if [ -n "${{ inputs.nix-installer-url }}" ] && [ -n "${{ inputs.nix-installer-tag }}" ]; then
-          echo "The nix-installer-url and nix-installer-tag options conflict, please choose one"
-          exit 1
-        fi
-        if [ -n "${{ inputs.nix-installer-url }}" ] && [ -n "${{ inputs.nix-installer-branch }}" ]; then
-          echo "The nix-installer-url and nix-installer-branch options conflict, please choose one"
-          exit 1
-        fi
-
-        if [ -n "${{ inputs.local-root }}" ]; then
-          if [ "$RUNNER_OS" == "macOS" ]; then
-            export PYTHON="python3"
-          else
-            export PYTHON="python"
-          fi
-          $PYTHON -m http.server --directory ${{ inputs.local-root }} --bind 0.0.0.0 8000 &
-          export HTTP_PID=$!
-          echo "Started simple http server for ${{ inputs.local-root }} on 0.0.0.0:8000"
-          while (! (: </dev/tcp/localhost/8000) &> /dev/null); do
-            sleep 1
-          done
-          export NIX_INSTALLER_FORCE_ALLOW_HTTP="1"
-          echo "Set NIX_INSTALLER_FORCE_ALLOW_HTTP=$NIX_INSTALLER_FORCE_ALLOW_HTTP"
-          export NIX_INSTALLER_URL=0.0.0.0:8000/nix-installer.sh
-          echo "Set NIX_INSTALLER_URL=$NIX_INSTALLER_URL"
-          export NIX_INSTALLER_BINARY_ROOT=http://0.0.0.0:8000/
-          echo "Set NIX_INSTALLER_BINARY_ROOT=$NIX_INSTALLER_BINARY_ROOT"
-          export NIX_INSTALLER_FORCE_ALLOW_HTTP=1
-          echo "Set NIX_INSTALLER_FORCE_ALLOW_HTTP=$NIX_INSTALLER_FORCE_ALLOW_HTTP"
-        else
-          if [ -n "${{ inputs.nix-installer-url }}" ]; then
-            export NIX_INSTALLER_URL="${{ inputs.nix-installer-url }}"
-          else
-            if [ -n "${{ inputs.nix-installer-pr }}" ]; then
-              export NIX_INSTALLER_URL="https://install.determinate.systems/nix/pr/${{ inputs.nix-installer-pr }}?ci=github"
-            elif [ -n "${{ inputs.nix-installer-tag }}" ]; then
-              export NIX_INSTALLER_URL="https://install.determinate.systems/nix/tag/${{ inputs.nix-installer-tag }}?ci=github"
-            elif [ -n "${{ inputs.nix-installer-revision }}" ]; then
-              export NIX_INSTALLER_URL="https://install.determinate.systems/nix/rev/${{ inputs.nix-installer-revision }}?ci=github"
-            elif [ -n "${{ inputs.nix-installer-branch }}" ]; then
-              export NIX_INSTALLER_URL="https://install.determinate.systems/nix/branch/${{ inputs.nix-installer-branch }}?ci=github"
-            else
-              export NIX_INSTALLER_URL="https://install.determinate.systems/nix?ci=github"
-            fi
-          fi
-          echo "Set NIX_INSTALLER_URL=$NIX_INSTALLER_URL"
-        fi
-
-        if [ -n "${{ inputs.logger }}" ]; then
-          export NIX_INSTALLER_LOGGER=${{ inputs.logger }}
-          echo "Set NIX_INSTALLER_LOGGER=$NIX_INSTALLER_LOGGER"
-        fi
-
-        if [ -n "${{ inputs.init }}" ]; then
-          export NIX_INSTALLER_INIT=${{ inputs.init }}
-          echo "Set NIX_INSTALLER_INIT=$NIX_INSTALLER_INIT"
-        fi
-
-        if [ -n "${{ inputs.start-daemon }}" ]; then
-          export NIX_INSTALLER_START_DAEMON=${{ inputs.start-daemon }}
-          echo "Set NIX_INSTALLER_START_DAEMON=$NIX_INSTALLER_START_DAEMON"
-        fi
-
-        if [ -n "${{ inputs.log-directives }}" ]; then
-          export NIX_INSTALLER_LOG_DIRECTIVES=${{ inputs.log-directives }}
-          echo "Set NIX_INSTALLER_LOG_DIRECTIVES=$NIX_INSTALLER_LOG_DIRECTIVES"
-        fi
-
-        if [ -n "${{ inputs.backtrace }}" ]; then
-          export RUST_BACKTRACE=${{ inputs.backtrace }}
-          echo "Set RUST_BACKTRACE=$RUST_BACKTRACE"
-        fi
-
-        if [ -n "${{ inputs.diagnostic-endpoint }}" ]; then
-          export NIX_INSTALLER_DIAGNOSTIC_ENDPOINT="${{ inputs.diagnostic-endpoint }}"
-          echo "Set NIX_INSTALLER_DIAGNOSTIC_ENDPOINT=$NIX_INSTALLER_DIAGNOSTIC_ENDPOINT"
-        fi
-
-        export NIX_INSTALLER_NO_CONFIRM=true
-        echo "Set NIX_INSTALLER_NO_CONFIRM=$NIX_INSTALLER_NO_CONFIRM"
-
-        curl --retry 20 -L $NIX_INSTALLER_URL | sh -s -- install ${{ inputs.planner }} ${{ inputs.extra-args }}
-
-        if [ -n "$HTTP_PID" ]; then
-          kill $HTTP_PID
-        fi
+  using: "node20"
+  main: "dist/index.js"
+  post: "dist/index.js"

dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

docker-shim/Dockerfile

@@ -0,0 +1,19 @@
+# Determinate Nix Installer: Docker Shim
+#
+# This empty image exists to lean on Docker as a process supervisor when
+# systemd isn't available. Specifically intended for self-hosted GitHub
+# Actions runners using Docker-in-Docker.
+#
+# See: https://github.com/DeterminateSystems/nix-installer-action 
+
+FROM scratch
+
+ENTRYPOINT [ "/nix/var/nix/profiles/default/bin/nix-daemon"]
+CMD []
+
+HEALTHCHECK \
+    --interval=5m \
+    --timeout=3s \
+    CMD ["/nix/var/nix/profiles/default/bin/nix", "store", "ping", "--store", "daemon"]
+
+COPY ./Dockerfile /README.md

docker-shim/README.md

@@ -0,0 +1,52 @@
+# Determinate Nix Installer Action: Docker Shim
+
+The image in this repository is a product of the contained Dockerfile.
+It is an otherwise empty image with a configuration layer.
+
+This image is to be used in GitHub Actions runners which don't have systemd available, like self-hosted ARC runners.
+
+The image would have no layers / content at all, however Docker has a bug and refuses to export those images.
+This isn't a technical limitation preventing us from creating and distributing that image, but an ease-of-use limitation.
+Since some of Docker's inspection tools break on an empty image, the image contains a single layer containing a README.
+
+To build:
+
+```shell
+docker build . --tag determinate-nix-shim:latest
+docker image save determinate-nix-shim:latest | gzip --best > amd64.tar
+```
+
+Then, extract the tarball:
+
+```
+mkdir extract
+cd extract
+tar -xf ../amd64.tar
+```
+
+It'll look like this, though the hashes will be different.
+
+```
+.
+├── 771204abb853cdde06bbbc680001a02642050a1db1a7b0a48cf5f20efa8bdc5d.json
+├── c4088111818e553e834adfc81bda8fe6da281afa9a40012eaa82796fb5476e98
+│   ├── VERSION
+│   ├── json
+│   └── layer.tar
+├── manifest.json
+└── repositories
+```
+
+Ignore `manifest.json`, and edit the other two JSON documents to replace `amd64` with `arm64`, both in a key named "architecture:
+
+```
+"architecture":"amd64"
+```
+
+Then re-create the tar, from within the `extract` directory:
+
+```
+tar --options gzip:compression-level=9 -zcf ../arm64.tar.gz .
+```
+
+Then `git add` the two .tar.gz's and you're done.

flake.lock

@@ -0,0 +1,40 @@
+{
+  "nodes": {
+    "flake-schemas": {
+      "locked": {
+        "lastModified": 1693491534,
+        "narHash": "sha256-ifw8Td8kD08J8DxFbYjeIx5naHcDLz7s2IFP3X42I/U=",
+        "rev": "c702cbb663d6d70bbb716584a2ee3aeb35017279",
+        "revCount": 21,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.1.1/018a4c59-80e1-708a-bb4d-854930c20f72/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/flake-schemas/%2A.tar.gz"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1696879762,
+        "narHash": "sha256-Ud6bH4DMcYHUDKavNMxAhcIpDGgHMyL/yaDEAVSImQY=",
+        "rev": "f99e5f03cc0aa231ab5950a15ed02afec45ed51a",
+        "revCount": 534224,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.534224%2Brev-f99e5f03cc0aa231ab5950a15ed02afec45ed51a/018b1d3c-12f0-76a5-b796-7668d7633f08/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1.0.tar.gz"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-schemas": "flake-schemas",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,31 @@
+# This flake was initially generated by fh, the CLI for FlakeHub (version 0.1.5)
+{
+  description = "Development environment for the Nix Installer action for GitHub.";
+
+  inputs = {
+    flake-schemas.url = "https://flakehub.com/f/DeterminateSystems/flake-schemas/*.tar.gz";
+    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1.0.tar.gz";
+  };
+
+  outputs = { self, flake-schemas, nixpkgs }:
+    let
+      supportedSystems = [ "x86_64-linux" "aarch64-darwin" "aarch64-linux" "x86_64-darwin" ];
+      forEachSupportedSystem = f: nixpkgs.lib.genAttrs supportedSystems (system: f {
+        pkgs = import nixpkgs { inherit system; };
+      });
+    in
+    {
+      schemas = flake-schemas.schemas;
+
+      devShells = forEachSupportedSystem ({ pkgs }: {
+        default = pkgs.mkShell {
+          packages = with pkgs; [
+            nodejs_latest
+            nixpkgs-fmt
+            nodePackages_latest.pnpm
+            nodePackages_latest.typescript-language-server
+          ];
+        };
+      });
+    };
+}

package.json

@@ -0,0 +1,50 @@
+{
+  "name": "nix-installer-action",
+  "version": "1.0.0",
+  "description": "You can use [`nix-installer`](https://github.com/DeterminateSystems/nix-installer) as a Github Action:",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "type": "module",
+  "scripts": {
+    "build": "tsup",
+    "format": "prettier --write .",
+    "check-fmt": "prettier --check .",
+    "lint": "eslint src/**/*.ts",
+    "package": "ncc build",
+    "all": "pnpm run format && pnpm run lint && pnpm run build && pnpm run package"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DeterminateSystems/nix-installer-action.git"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/DeterminateSystems/nix-installer-action/issues"
+  },
+  "homepage": "https://github.com/DeterminateSystems/nix-installer-action#readme",
+  "dependencies": {
+    "@actions/core": "^1.11.1",
+    "@actions/exec": "^1.1.1",
+    "@actions/github": "^6.0.0",
+    "detsys-ts": "github:DeterminateSystems/detsys-ts",
+    "got": "^14.4.6",
+    "string-argv": "^0.3.2"
+  },
+  "devDependencies": {
+    "@trivago/prettier-plugin-sort-imports": "^4.3.0",
+    "@types/node": "^20.17.28",
+    "@types/uuid": "^9.0.8",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@vercel/ncc": "^0.38.3",
+    "eslint": "^8.57.1",
+    "eslint-import-resolver-typescript": "^3.10.0",
+    "eslint-plugin-github": "^4.10.2",
+    "eslint-plugin-import": "^2.31.0",
+    "eslint-plugin-prettier": "^5.2.5",
+    "prettier": "^3.5.3",
+    "tsup": "^8.4.0",
+    "typescript": "^5.8.2"
+  }
+}

tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2020" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "module": "Node16",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true /* Enable all strict type-checking options. */,
+    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
+    "resolveJsonModule": true,
+    "declaration": true
+  },
+  "exclude": ["node_modules", "**/*.test.ts", "dist"]
+}

tsup.config.ts

@@ -0,0 +1,15 @@
+import { defineConfig } from "tsup";
+import { name } from "./package.json";
+
+export default defineConfig({
+  name,
+  entry: ["src/index.ts"],
+  format: ["esm"],
+  target: "node20",
+  bundle: true,
+  splitting: false,
+  clean: true,
+  dts: {
+    resolve: true,
+  },
+});