Update to determinate by default (#208)

* Update to determinate by default

Implements https://github.com/DeterminateSystems/nix-src/issues/201

* Fixup the version verification script

.editorconfig

@@ -0,0 +1,10 @@
+# https://editorconfig.org
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.eslintrc.json

@@ -1,74 +1,74 @@
 {
-    "plugins": [
-        "@typescript-eslint"
-    ],
-    "extends": [
-        "plugin:github/recommended"
-    ],
-    "parser": "@typescript-eslint/parser",
-    "parserOptions": {
-        "ecmaVersion": 9,
-        "sourceType": "module",
-        "project": "./tsconfig.json"
-    },
-    "rules": {
-        "i18n-text/no-en": "off",
-        "eslint-comments/no-use": "off",
-        "import/no-namespace": "off",
-        "no-unused-vars": "off",
-        "@typescript-eslint/no-unused-vars": [
-            "error",
-            {
-                "argsIgnorePattern": "^_"
-            }
-        ],
-        "@typescript-eslint/explicit-member-accessibility": [
-            "error",
-            {
-                "accessibility": "no-public"
-            }
-        ],
-        "@typescript-eslint/no-require-imports": "error",
-        "@typescript-eslint/array-type": "error",
-        "@typescript-eslint/await-thenable": "error",
-        "@typescript-eslint/ban-ts-comment": "error",
-        "camelcase": "off",
-        "@typescript-eslint/consistent-type-assertions": "error",
-        "@typescript-eslint/explicit-function-return-type": [
-            "error",
-            {
-                "allowExpressions": true
-            }
-        ],
-        "@typescript-eslint/func-call-spacing": [
-            "error",
-            "never"
-        ],
-        "@typescript-eslint/no-array-constructor": "error",
-        "@typescript-eslint/no-empty-interface": "error",
-        "@typescript-eslint/no-explicit-any": "error",
-        "@typescript-eslint/no-extraneous-class": "error",
-        "@typescript-eslint/no-for-in-array": "error",
-        "@typescript-eslint/no-inferrable-types": "error",
-        "@typescript-eslint/no-misused-new": "error",
-        "@typescript-eslint/no-namespace": "error",
-        "@typescript-eslint/no-non-null-assertion": "warn",
-        "@typescript-eslint/no-unnecessary-qualifier": "error",
-        "@typescript-eslint/no-unnecessary-type-assertion": "error",
-        "@typescript-eslint/no-useless-constructor": "error",
-        "@typescript-eslint/no-var-requires": "error",
-        "@typescript-eslint/prefer-for-of": "warn",
-        "@typescript-eslint/prefer-function-type": "warn",
-        "@typescript-eslint/prefer-includes": "error",
-        "@typescript-eslint/prefer-string-starts-ends-with": "error",
-        "@typescript-eslint/promise-function-async": "error",
-        "@typescript-eslint/require-array-sort-compare": "error",
-        "@typescript-eslint/restrict-plus-operands": "error",
-        "@typescript-eslint/type-annotation-spacing": "error",
-        "@typescript-eslint/unbound-method": "error"
-    },
-    "env": {
-        "node": true,
-        "es6": true
+  "plugins": ["@typescript-eslint"],
+  "extends": ["plugin:github/recommended"],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 9,
+    "sourceType": "module",
+    "project": "./tsconfig.json"
+  },
+  "settings": {
+    "import/resolver": {
+      "typescript": {}
     }
-}
+  },
+  "rules": {
+    "i18n-text/no-en": "off",
+    "eslint-comments/no-use": "off",
+    "import/no-namespace": "off",
+    "no-unused-vars": "off",
+    "@typescript-eslint/no-unused-vars": [
+      "error",
+      {
+        "argsIgnorePattern": "^_"
+      }
+    ],
+    "@typescript-eslint/explicit-member-accessibility": [
+      "error",
+      {
+        "accessibility": "no-public"
+      }
+    ],
+    "@typescript-eslint/no-base-to-string": "error",
+    "@typescript-eslint/no-require-imports": "error",
+    "@typescript-eslint/array-type": "error",
+    "@typescript-eslint/await-thenable": "error",
+    "@typescript-eslint/ban-ts-comment": "error",
+    "camelcase": "error",
+    "@typescript-eslint/consistent-type-assertions": "error",
+    "@typescript-eslint/explicit-function-return-type": [
+      "error",
+      {
+        "allowExpressions": true
+      }
+    ],
+    "@typescript-eslint/func-call-spacing": ["error", "never"],
+    "@typescript-eslint/no-array-constructor": "error",
+    "@typescript-eslint/no-empty-interface": "error",
+    "@typescript-eslint/no-explicit-any": "error",
+    "@typescript-eslint/no-floating-promises": "error",
+    "@typescript-eslint/no-extraneous-class": "error",
+    "@typescript-eslint/no-for-in-array": "error",
+    "@typescript-eslint/no-inferrable-types": "error",
+    "@typescript-eslint/no-misused-new": "error",
+    "@typescript-eslint/no-namespace": "error",
+    "@typescript-eslint/no-non-null-assertion": "warn",
+    "@typescript-eslint/no-unnecessary-qualifier": "error",
+    "@typescript-eslint/no-unnecessary-type-assertion": "error",
+    "@typescript-eslint/no-useless-constructor": "error",
+    "@typescript-eslint/no-var-requires": "error",
+    "@typescript-eslint/prefer-for-of": "warn",
+    "@typescript-eslint/prefer-function-type": "warn",
+    "@typescript-eslint/prefer-includes": "error",
+    "@typescript-eslint/prefer-string-starts-ends-with": "error",
+    "@typescript-eslint/promise-function-async": "error",
+    "@typescript-eslint/require-array-sort-compare": "error",
+    "@typescript-eslint/restrict-plus-operands": "error",
+    "@typescript-eslint/type-annotation-spacing": "error",
+    "@typescript-eslint/unbound-method": "error"
+  },
+  "env": {
+    "node": true,
+    "es6": true
+  }
+}

.gitattributes

@@ -0,0 +1,2 @@
+dist/* linguist-generated=true
+

.github/verify-version.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+# This script verifies that the version of Nix installed on the runner
+# matches the version supplied in the first argument.
+
+EXPECTED_VERSION="${1}"
+
+INSTALLED_NIX_VERSION_OUTPUT=$(nix --version)
+INSTALLED_NIX_VERSION=$(echo "${INSTALLED_NIX_VERSION_OUTPUT}" | awk '{print $NF}')
+
+if [ "${INSTALLED_NIX_VERSION}" != "${EXPECTED_VERSION}" ]; then
+  echo "Nix version ${INSTALLED_NIX_VERSION} didn't match expected version ${EXPECTED_VERSION}"
+  exit 1
+else
+  echo "Success! Nix version ${INSTALLED_NIX_VERSION} installed as expected"
+  exit 0
+fi

.github/workflows/ci.yml

@@ -4,87 +4,84 @@ on:
   pull_request:
   push:
     branches: [main]
+  workflow_dispatch:
 
 jobs:
-  run-x86_64-linux:
-    name: Run x86_64 Linux
+  tests:
+    runs-on: ubuntu-22.04
+    needs:
+      - check-dist-up-to-date
+      - install-nix
+      - install-with-non-default-source-inputs
+      - install-no-id-token
+    # NOTE(cole-h): GitHub treats "skipped" as "OK" for the purposes of required checks on branch
+    # protection, so we take advantage of this fact and fail if any of the dependent actions failed,
+    # or "skip" (which is a success for GHA's purposes) if none of them did.
+    if: failure()
+    steps:
+      - name: Dependent checks failed
+        run: exit 1
+
+  check-dist-up-to-date:
+    name: Check the dist/ folder is up to date
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
-      - name: Install Nix
-        uses: ./
-        with:
-          logger: pretty
-          log-directives: nix_installer=trace
-          backtrace: full
-      - name: echo $PATH
-        run: echo $PATH
-      - name: Test `nix` with `$GITHUB_PATH`
-        if: success() || failure()
-        run: |
-          nix run nixpkgs#hello
-          nix profile install nixpkgs#hello
-          hello
-          nix store gc
-          nix run nixpkgs#hello
-      - name: Test bash
-        run: nix-instantiate -E 'builtins.currentTime' --eval
-        if: success() || failure()
-        shell: bash --login {0}
-      - name: Test sh
-        run: nix-instantiate -E 'builtins.currentTime' --eval
-        if: success() || failure()
-        shell: sh -l {0}
-      - name: Install Nix again (noop)
-        uses: ./
-        with:
-          logger: pretty
-          log-directives: nix_installer=trace
-          backtrace: full
-      - name: Test `nix` with `$GITHUB_PATH`
-        if: success() || failure()
-        run: |
-          nix run nixpkgs#hello
-          nix profile install nixpkgs#hello
-          hello
-          nix store gc
-          nix run nixpkgs#hello
-      - name: Reinstall Nix
-        uses: ./
-        with:
-          logger: pretty
-          log-directives: nix_installer=trace
-          backtrace: full
-          reinstall: true
-          extra-conf: |
-            use-sqlite-wal = true
-      - name: Test `nix` with `$GITHUB_PATH`
-        if: success() || failure()
-        run: |
-          nix run nixpkgs#hello
-          nix profile install nixpkgs#hello
-          hello
-          nix store gc
-          nix run nixpkgs#hello
-      - name: Verify the generated nix.conf
-        run: |
-          cat -n /etc/nix/nix.conf
-          grep -E "^trusted-users = .*$USER" /etc/nix/nix.conf
-          grep -E "^use-sqlite-wal = true" /etc/nix/nix.conf
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/flakehub-cache-action@main
+      - name: pnpm install
+        run: nix develop --command pnpm install
+      - name: prettier format
+        run: nix develop --command pnpm run check-fmt
+      - name: ESLint
+        run: nix develop --command pnpm run lint
+      - name: tsup build
+        run: nix develop --command pnpm run build
+      - name: ncc package
+        run: nix develop --command pnpm run package
+      - name: Git status
+        run: git status --porcelain=v1
+      - name: Ensure no staged changes
+        run: git diff --exit-code
 
-  run-x86_64-darwin:
-    name: Run x86_64 Darwin
-    runs-on: macos-12
+  install-nix:
+    name: "Test: ${{ matrix.runner }}${{ matrix.determinate && ' with determinate' || '' }}"
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - ubuntu-latest
+          - nscloud-ubuntu-22.04-amd64-4x16
+          - namespace-profile-default-arm64
+          # - macos-12-large # determinate-nixd is broken on macos-12
+          - macos-13-large
+          - macos-14-large
+          - macos-14-xlarge # arm64
+        determinate:
+          - true
+          - false
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install Nix
         uses: ./
         with:
           logger: pretty
           log-directives: nix_installer=trace
           backtrace: full
+          _internal-strict-mode: true
+          determinate: ${{ matrix.determinate }}
       - name: echo $PATH
         run: echo $PATH
+
+      - name: Render the devshell
+        if: (success() || failure()) && matrix.runner != 'macos-13-large' && matrix.runner != 'macos-14-large'
+        run: |
+          nix develop --command date
+
       - name: Test `nix` with `$GITHUB_PATH`
         if: success() || failure()
         run: |
@@ -93,6 +90,7 @@ jobs:
           hello
           nix store gc
           nix run nixpkgs#hello
+
       - name: Test bash
         run: nix-instantiate -E 'builtins.currentTime' --eval
         if: success() || failure()
@@ -102,15 +100,16 @@ jobs:
         if: success() || failure()
         shell: sh -l {0}
       - name: Test zsh
-        run: nix-instantiate -E 'builtins.currentTime' --eval
+        run: if (zsh --help > /dev/null); then zsh --login --interactive -c "nix-instantiate -E 'builtins.currentTime' --eval"; fi
         if: success() || failure()
-        shell: zsh --login --interactive {0}
       - name: Install Nix again (noop)
         uses: ./
         with:
           logger: pretty
           log-directives: nix_installer=trace
           backtrace: full
+          _internal-strict-mode: true
+          determinate: ${{ matrix.determinate }}
       - name: Test `nix` with `$GITHUB_PATH`
         if: success() || failure()
         run: |
@@ -128,6 +127,8 @@ jobs:
           reinstall: true
           extra-conf: |
             use-sqlite-wal = true
+          _internal-strict-mode: true
+          determinate: ${{ matrix.determinate }}
       - name: Test `nix` with `$GITHUB_PATH`
         if: success() || failure()
         run: |
@@ -138,6 +139,38 @@ jobs:
           nix run nixpkgs#hello
       - name: Verify the generated nix.conf
         run: |
-          cat /etc/nix/nix.conf
-          grep -E "^trusted-users = .*$USER" /etc/nix/nix.conf
-          grep -E "^use-sqlite-wal = true" /etc/nix/nix.conf
+          nix config show
+          cat -n /etc/nix/nix.conf
+          nix config show | grep -E "^trusted-users = .*$USER"
+          nix config show | grep -E "^use-sqlite-wal = true"
+
+  install-with-non-default-source-inputs:
+    name: Install Nix using non-default source-${{ matrix.inputs.key }}
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        inputs:
+          # https://github.com/DeterminateSystems/nix-installer/blob/v3.11.3
+          - key: url
+            value: https://github.com/DeterminateSystems/nix-installer/releases/download/v3.11.3/nix-installer-x86_64-linux
+            nix-version: "2.31.2" # 3.11.3 is based on 2.31.2
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install with alternative source-${{ matrix.inputs.key }}
+        uses: ./
+        with:
+          source-${{ matrix.inputs.key }}: ${{ matrix.inputs.value }}
+          _internal-strict-mode: true
+      - name: Ensure that the expected Nix version ${{ matrix.inputs.nix-version }} is installed via alternative source-${{ matrix.inputs.key }}
+        run: .github/verify-version.sh ${{ matrix.inputs.nix-version }}
+
+  install-no-id-token:
+    name: Install Nix without an ID token
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./
+        with:
+          _internal-strict-mode: true
+          determinate: true

.prettierrc.json

@@ -1 +1 @@
-{}
+{}

CONTRIBUTING.md

@@ -0,0 +1,5 @@
+# Submitting Pull Requests
+
+Run `pnpm install` to install necessary JS tools.
+
+This action is based off https://github.com/actions/javascript-action. As part of your contributing flow you **must** run `npm run all` before we can merge.

README.md

@@ -1,6 +1,20 @@
-# Nix Installer Action
+# The Determinate Nix Installer Action
 
-You can use [`nix-installer`](https://github.com/DeterminateSystems/nix-installer) as a Github action like so:
+Based on the [Determinate Nix Installer](https://github.com/DeterminateSystems/nix-installer), responsible for over tens of thousands of Nix installs daily.
+The fast, friendly, and reliable GitHub Action to install Nix with Flakes.
+
+## Supports
+
+- ✅ **Accelerated KVM** on open source projects and larger runners. See [GitHub's announcement](https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners/) for more info.
+- ✅ Linux, x86_64, aarch64, and i686
+- ✅ macOS, x86_64 and aarch64
+- ✅ WSL2, x86_64 and aarch64
+- ✅ Containers
+- ✅ Valve's SteamOS
+- ✅ GitHub Enterprise Server
+- ✅ GitHub Hosted, self-hosted, and long running Actions Runners
+
+## Usage
 
 ```yaml
 on:
@@ -11,18 +25,16 @@ on:
 jobs:
   lints:
     name: Build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-      - name: Run `nix build`
-        run: nix build .
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - run: nix build .
 ```
 
-See [`.github/workflows/ci.yml`](.github/workflows/ci.yml) for a full example.
+### With FlakeHub
 
-To use private flakes from FlakeHub, use a configuration like this:
+To fetch private flakes from FlakeHub and Nix builds from FlakeHub Cache, update the `permissions` block and use [`determinate-nix-action`][determinate-nix-action]:
 
 ```yaml
 on:
@@ -33,59 +45,97 @@ on:
 jobs:
   lints:
     name: Build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     permissions:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v3
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-        with:
-          flakehub: true
-      - name: Run `nix build`
-        run: nix build .
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/determinate-nix-action@v3
+      - run: nix build .
 ```
 
+See [`.github/workflows/ci.yml`](.github/workflows/ci.yml) for a full example.
+
+### Pinning the version
+
+This GitHub Action uses the most recent version of the Determinate Nix Installer, even when the Action itself is pinned.
+If you wish to pin your CI workflows to a specific version, use the [`determinate-nix-action`][determinate-nix-action].
+That Action is updated and tagged for every Determinate release.
+
+The `DeterminateSystems/determinate-nix-action@v3.5.2` reference, for example, always installs Determinate Nix v3.5.2.
+
+Additionally, an extra tag on the major version is kept up to date with the current release.
+The `DeterminateSystems/determinate-nix-action@v3` reference, for example, installs the most recent release in the `v3.x.y` series.
+
+If you do tag to a specific version, please [use Dependabot to update your actions][dependabot-actions].
+
+### Advanced Usage
+
+- If KVM is available, the installer sets up KVM so that Nix can use it ,and exports the `DETERMINATE_NIX_KVM` environment variable set to 1.
+  If KVM is not available, `DETERMINATE_NIX_KVM` is set to 0.
+  This can be used in combination with GitHub Actions' `if` syntax for turning on and off steps.
+
+## Installation Differences
+
+Differing from the upstream [Nix](https://github.com/NixOS/nix) installer scripts:
+
+- In `nix.conf`:
+  - the `nix-command` and `flakes` features are enabled
+  - `bash-prompt-prefix` is set
+  - `auto-optimise-store` is set to `true` (On Linux only)
+  * `extra-nix-path` is set to `nixpkgs=flake:nixpkgs`
+  * `max-jobs` is set to `auto`
+- KVM is enabled by default.
+- an installation receipt (for uninstalling) is stored at `/nix/receipt.json` as well as a copy of the install binary at `/nix/nix-installer`
+- `nix-channel --update` is not run, `~/.nix-channels` is not provisioned
+- `ssl-cert-file` is set in `/etc/nix/nix.conf` if the `ssl-cert-file` argument is used.
+
 ## Configuration
 
-| Parameter                | Description                                                                                                                                                                                           | Type                                       | Default                                              |
-| :----------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------- | :--------------------------------------------------- |
-| `backtrace`              | The setting for [`RUST_BACKTRACE`][backtrace]                                                                                                                                                         | string                                     |                                                      |
-| `extra-args`             | Extra arguments to pass to the planner (prefer using structured `with:` arguments unless using a custom [planner]!)                                                                                   | string                                     |                                                      |
-| `extra-conf`             | Extra configuration lines for `/etc/nix/nix.conf` (includes `access-tokens` with `secrets.GITHUB_TOKEN` automatically if `github-token` is set)                                                       | string                                     |                                                      |
-| `flakehub`               | Log in to FlakeHub to pull private flakes using the GitHub Actions [JSON Web Token](https://jwt.io) (JWT), which is bound to the `api.flakehub.com` audience.                                         | Boolean                                    | `false`                                              |
-| `github-token`           | A [GitHub token] for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests)                                                                               | string                                     | `${{ github.token }}`                                |
-| `init`                   | The init system to configure (requires `planner: linux-multi`)                                                                                                                                        | enum (`none` or `systemd`)                 |                                                      |
-| `local-root`             | A local `nix-installer` binary root. Overrides the `nix-installer-url` setting (a `nix-installer.sh` should exist, binaries should be named `nix-installer-$ARCH`, eg. `nix-installer-x86_64-linux`). | Boolean                                    | `false`                                              |
-| `log-directives`         | A list of [tracing directives], comma separated with `-`s replaced with `_` (eg. `nix_installer=trace`)                                                                                               | string                                     |                                                      |
-| `logger`                 | The logger to use during installation                                                                                                                                                                 | enum (`pretty`, `json`, `full`, `compact`) |                                                      |
-| `mac-case-sensitive`     | Use a case-sensitive volume (`planner: macos` only)                                                                                                                                                   | Boolean                                    | `false`                                              |
-| `mac-encrypt`            | Force encryption on the volume (`planner: macos` only)                                                                                                                                                | Boolean                                    | `false`                                              |
-| `mac-root-disk`          | The root disk of the target (`planner: macos` only)                                                                                                                                                   | string                                     |                                                      |
-| `mac-volume-label`       | The label for the created [APFS] volume (`planner: macos` only)                                                                                                                                       | string                                     |                                                      |
-| `modify-profile`         | Modify the user [profile] to automatically load Nix                                                                                                                                                   | Boolean                                    | `false`                                              |
-| `nix-build-group-id`     | The Nix build group GID                                                                                                                                                                               | integer                                    |                                                      |
-| `nix-build-group-name`   | The Nix build group name                                                                                                                                                                              | string                                     |                                                      |
-| `nix-build-user-base`    | The Nix build user base UID (ascending)                                                                                                                                                               | integer                                    |                                                      |
-| `nix-build-user-count`   | The number of build users to create                                                                                                                                                                   | integer                                    | 32                                                   |
-| `nix-build-user-prefix`  | The Nix build user prefix (user numbers will be postfixed)                                                                                                                                            | string                                     |                                                      |
-| `nix-installer-branch`   | The branch of `nix-installer` to use (conflicts with the `nix-installer-tag`, `nix-installer-revision`, and `nix-installer-branch`)                                                                   | string                                     |                                                      |
-| `nix-installer-pr`       | The pull request of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, and `nix-installer-branch`)                                                                 | integer                                    |                                                      |
-| `nix-installer-revision` | The revision of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-branch`, and `nix-installer-pr`)                                                                           | string                                     |                                                      |
-| `nix-installer-tag`      | The tag of `nix-installer` to use (conflicts with `nix-installer-revision`, `nix-installer-branch`, `nix-installer-pr`)                                                                               | string                                     |                                                      |
-| `nix-installer-url`      | A URL pointing to a `nix-installer.sh` script                                                                                                                                                         | URL                                        | `https://install.determinate.systems/nix`            |
-| `nix-package-url`        | The Nix package URL                                                                                                                                                                                   | URL                                        |                                                      |
-| `planner`                | The installation [planner] to use                                                                                                                                                                     | enum (`linux` or `macos`)                  |                                                      |
-| `reinstall`              | Force a reinstall if an existing installation is detected (consider backing up `/nix/store`)                                                                                                          | Boolean                                    | `false`                                              |
-| `start-daemon`           | If the daemon should be started, requires `planner: linux-multi`                                                                                                                                      | Boolean                                    | `false`                                              |
-| `trust-runner-user`      | Whether to make the runner user trusted by the Nix daemon                                                                                                                                             | Boolean                                    | `true`                                               |
-| `diagnostic-endpoint`    | Diagnostic endpoint url where the installer sends install [diagnostic reports](https://github.com/DeterminateSystems/nix-installer#diagnostics) to, to disable set this to an empty string            | string                                     | `https://install.determinate.systems/nix/diagnostic` |
-| `proxy`                  | The proxy to use (if any), valid proxy bases are `https://$URL`, `http://$URL` and `socks5://$URL`                                                                                                    | string                                     |                                                      |
-| `ssl-cert-file`          | An SSL cert to use (if any), used for fetching Nix and sets `NIX_SSL_CERT_FILE` for Nix                                                                                                               | string                                     |                                                      |
+| Parameter               | Description                                                                                                                                                                                                                                                                    | Type                                       | Default                                                        |
+| :---------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------- | :------------------------------------------------------------- |
+| `backtrace`             | The setting for [`RUST_BACKTRACE`][backtrace]                                                                                                                                                                                                                                  | string                                     |                                                                |
+| `determinate`           | Whether to install [Determinate Nix](https://determinate.systems/enterprise) and log in to FlakeHub for private Flakes and binary caches.                                                                                                                                      | Boolean                                    | `true`                                                         |
+| `extra-args`            | Extra arguments to pass to the planner (prefer using structured `with:` arguments unless using a custom [planner]!)                                                                                                                                                            | string                                     |                                                                |
+| `extra-conf`            | Extra configuration lines for `/etc/nix/nix.conf` (includes `access-tokens` with `secrets.GITHUB_TOKEN` automatically if `github-token` is set)                                                                                                                                | string                                     |                                                                |
+| `flakehub`              | Deprecated. Implies `determinate`.                                                                                                                                                                                                                                             | Boolean                                    | `false`                                                        |
+| `force-no-systemd`      | Force using other methods than systemd to launch the daemon. This setting is automatically enabled when necessary.                                                                                                                                                             | Boolean                                    | `false`                                                        |
+| `github-token`          | A [GitHub token] for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests)                                                                                                                                                        | string                                     | `${{ github.token }}`                                          |
+| `github-server-url`     | The URL for the GitHub server, to use with the `github-token` token. Defaults to the current GitHub server, supporting GitHub Enterprise Server automatically. Only change this value if the provided `github-token` is for a different GitHub server than the current server. | string                                     | `${{ github.server }}`                                         |
+| `init`                  | The init system to configure (requires `planner: linux-multi`)                                                                                                                                                                                                                 | enum (`none` or `systemd`)                 |                                                                |
+| `kvm`                   | Automatically configure the GitHub Actions Runner for NixOS test support, if the host supports it.                                                                                                                                                                             | Boolean                                    | `true`                                                         |
+| `local-root`            | A local `nix-installer` binary root. Overrides the `nix-installer-url` setting (a `nix-installer.sh` should exist, binaries should be named `nix-installer-$ARCH`, eg. `nix-installer-x86_64-linux`).                                                                          | Boolean                                    | `false`                                                        |
+| `log-directives`        | A list of [tracing directives], comma separated with `-`s replaced with `_` (eg. `nix_installer=trace`)                                                                                                                                                                        | string                                     |                                                                |
+| `logger`                | The logger to use during installation                                                                                                                                                                                                                                          | enum (`pretty`, `json`, `full`, `compact`) |                                                                |
+| `mac-case-sensitive`    | Use a case-sensitive volume (`planner: macos` only)                                                                                                                                                                                                                            | Boolean                                    | `false`                                                        |
+| `mac-encrypt`           | Force encryption on the volume (`planner: macos` only)                                                                                                                                                                                                                         | Boolean                                    | `false`                                                        |
+| `mac-root-disk`         | The root disk of the target (`planner: macos` only)                                                                                                                                                                                                                            | string                                     |                                                                |
+| `mac-volume-label`      | The label for the created [APFS] volume (`planner: macos` only)                                                                                                                                                                                                                | string                                     |                                                                |
+| `modify-profile`        | Modify the user [profile] to automatically load Nix                                                                                                                                                                                                                            | Boolean                                    | `false`                                                        |
+| `nix-build-group-id`    | The Nix build group GID                                                                                                                                                                                                                                                        | integer                                    |                                                                |
+| `nix-build-group-name`  | The Nix build group name                                                                                                                                                                                                                                                       | string                                     |                                                                |
+| `nix-build-user-base`   | The Nix build user base UID (ascending)                                                                                                                                                                                                                                        | integer                                    |                                                                |
+| `nix-build-user-count`  | The number of build users to create                                                                                                                                                                                                                                            | integer                                    | 32                                                             |
+| `nix-build-user-prefix` | The Nix build user prefix (user numbers will be postfixed)                                                                                                                                                                                                                     | string                                     |                                                                |
+| `source-branch`         | The branch of `nix-installer` to use (conflicts with the `source-tag`, `source-revision`, and `source-branch`)                                                                                                                                                                 | string                                     |                                                                |
+| `source-pr`             | The pull request of `nix-installer` to use (conflicts with `source-tag`, `source-revision`, and `source-branch`)                                                                                                                                                               | integer                                    |                                                                |
+| `source-revision`       | The revision of `nix-installer` to use (conflicts with `source-tag`, `source-branch`, and `source-pr`)                                                                                                                                                                         | string                                     |                                                                |
+| `source-tag`            | The tag of `nix-installer` to use (conflicts with `source-revision`, `source-branch`, `source-pr`)                                                                                                                                                                             | string                                     |                                                                |
+| `source-url`            | A URL pointing to the `nix-installer` binary                                                                                                                                                                                                                                   | URL                                        | n/a (calculated)                                               |
+| `nix-package-url`       | The Nix package URL                                                                                                                                                                                                                                                            | URL                                        |                                                                |
+| `planner`               | The installation [planner] to use                                                                                                                                                                                                                                              | enum (`linux` or `macos`)                  |                                                                |
+| `reinstall`             | Force a reinstall if an existing installation is detected (consider backing up `/nix/store`)                                                                                                                                                                                   | Boolean                                    | `false`                                                        |
+| `start-daemon`          | If the daemon should be started, requires `planner: linux-multi`                                                                                                                                                                                                               | Boolean                                    | `false`                                                        |
+| `trust-runner-user`     | Whether to make the runner user trusted by the Nix daemon                                                                                                                                                                                                                      | Boolean                                    | `true`                                                         |
+| `diagnostic-endpoint`   | Diagnostic endpoint url where the installer sends install [diagnostic reports](https://github.com/DeterminateSystems/nix-installer#diagnostics) to, to disable set this to an empty string                                                                                     | string                                     | `https://install.determinate.systems/nix-installer/diagnostic` |
+| `proxy`                 | The proxy to use (if any), valid proxy bases are `https://$URL`, `http://$URL` and `socks5://$URL`                                                                                                                                                                             | string                                     |                                                                |
+| `ssl-cert-file`         | An SSL cert to use (if any), used for fetching Nix and sets `NIX_SSL_CERT_FILE` for Nix                                                                                                                                                                                        | string                                     |                                                                |
 
 [apfs]: https://en.wikipedia.org/wiki/Apple_File_System
 [backtrace]: https://doc.rust-lang.org/std/backtrace/index.html#environment-variables
+[dependabot-actions]: https://github.com/DeterminateSystems/determinate-nix-action?tab=readme-ov-file#-automate-updates-with-dependabot
+[determinate-nix-action]: https://github.com/DeterminateSystems/determinate-nix-action
 [github token]: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
 [planner]: https://github.com/determinateSystems/nix-installer#usage
 [profile]: https://nixos.org/manual/nix/stable/package-management/profiles

action.yml

@@ -7,6 +7,10 @@ inputs:
   backtrace:
     description: The setting for `RUST_BACKTRACE` (see https://doc.rust-lang.org/std/backtrace/index.html#environment-variables)
     required: false
+  determinate:
+    description: |
+      Whether to install [Determinate Nix](https://determinate.systems/enterprise) and log in to FlakeHub for private Flakes and binary caches.
+    default: true
   extra-args:
     description: Extra args to pass to the planner (prefer using structured `with:` arguments unless using a custom planner!)
     required: false
@@ -14,15 +18,29 @@ inputs:
     description: Extra configuration lines for `/etc/nix/nix.conf` (includes `access-tokens` with `secrets.GITHUB_TOKEN` automatically if `github-token` is set)
     required: false
   flakehub:
-    description: Automatically log in to your [FlakeHub](https://flakehub.com) account, for accessing private flakes.
+    description: Deprecated. Implies `determinate`.
+    required: false
+    default: false
+  force-no-systemd:
+    description: Force using other methods than systemd to launch the daemon. This setting is automatically enabled when necessary.
     required: false
     default: false
   github-token:
     description: A GitHub token for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests)
     default: ${{ github.token }}
+  github-server-url:
+    description: The URL for the GitHub server, to use with the `github-token` token. Defaults to the current GitHub server, supporting GitHub Enterprise Server automatically. Only change this value if the provided `github-token` is for a different GitHub server than the current server.
+    default: ${{ github.server_url }}
   init:
     description: "The init system to configure, requires `planner: linux-multi` (allowing the choice between `none` or `systemd`)"
     required: false
+  job-status:
+    description: The overall status of the job. Set automatically, for aggregate analysis of Nix stability.
+    default: ${{ job.status }}
+  kvm:
+    description: Automatically configure the GitHub Actions Runner for NixOS test supports, if the host supports it.
+    required: false
+    default: true
   local-root:
     description: A local `nix-installer` binary root, overrides any settings which change the `nix-installer` used (binaries should be named `nix-installer-$ARCH-$OS`, eg. `nix-installer-x86_64-linux`)
     required: false
@@ -69,20 +87,23 @@ inputs:
   nix-build-user-prefix:
     description: The Nix build user prefix (user numbers will be postfixed)
     required: false
-  nix-installer-branch:
-    description: The branch of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, `nix-installer-pr`)
+  source-binary:
+    description: Run a version of the nix-installer binary from somewhere already on disk. Conflicts with all other `source-*` options. Intended only for testing this Action.
     required: false
-  nix-installer-pr:
-    description: The PR of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, `nix-installer-branch`)
+  source-branch:
+    description: The branch of `nix-installer` to use (conflicts with `source-tag`, `source-revision`, `source-pr`)
     required: false
-  nix-installer-revision:
-    description: The revision of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-branch`, `nix-installer-pr`)
+  source-pr:
+    description: The PR of `nix-installer` to use (conflicts with `source-tag`, `source-revision`, `source-branch`)
     required: false
-  nix-installer-tag:
-    description: The tag of `nix-installer` to use (conflicts with `nix-installer-revision`, `nix-installer-branch`, `nix-installer-pr`)
+  source-revision:
+    description: The revision of `nix-installer` to use (conflicts with `source-tag`, `source-branch`, `source-pr`)
     required: false
-  nix-installer-url:
-    description: A URL pointing to a `nix-installer.sh` script
+  source-tag:
+    description: The tag of `nix-installer` to use (conflicts with `source-revision`, `source-branch`, `source-pr`)
+    required: false
+  source-url:
+    description: A URL pointing to a `nix-installer` executable
     required: false
   nix-package-url:
     description: The Nix package URL
@@ -100,12 +121,32 @@ inputs:
     default: true
   diagnostic-endpoint:
     description: "Diagnostic endpoint url where the installer sends data to. To disable set this to an empty string."
-    default: "https://install.determinate.systems/nix/diagnostic"
+    required: false
+    default: "-"
   trust-runner-user:
     description: Whether to make the runner user trusted by the Nix daemon
-    default: "true"
+    default: true
+  nix-installer-branch:
+    description: (deprecated) The branch of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, `nix-installer-pr`)
+    required: false
+  nix-installer-pr:
+    description: (deprecated) The PR of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-revision`, `nix-installer-branch`)
+    required: false
+  nix-installer-revision:
+    description: (deprecated) The revision of `nix-installer` to use (conflicts with `nix-installer-tag`, `nix-installer-branch`, `nix-installer-pr`)
+    required: false
+  nix-installer-tag:
+    description: (deprecated) The tag of `nix-installer` to use (conflicts with `nix-installer-revision`, `nix-installer-branch`, `nix-installer-pr`)
+    required: false
+  nix-installer-url:
+    description: (deprecated) A URL pointing to a `nix-installer.sh` script
+    required: false
+  _internal-strict-mode:
+    description: Whether to fail when any errors are thrown. Used only to test the Action; do not set this in your own workflows.
+    required: false
+    default: false
 
 runs:
-  using: "node16"
-  main: 'dist/index.js'
-  post: 'dist/index.js'
+  using: "node20"
+  main: "dist/index.js"
+  post: "dist/index.js"

dist/37.index.js

@@ -1,453 +0,0 @@
-"use strict";
-exports.id = 37;
-exports.ids = [37];
-exports.modules = {
-
-/***/ 4037:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-__webpack_require__.r(__webpack_exports__);
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   "toFormData": () => (/* binding */ toFormData)
-/* harmony export */ });
-/* harmony import */ var fetch_blob_from_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2185);
-/* harmony import */ var formdata_polyfill_esm_min_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8010);
-
-
-
-let s = 0;
-const S = {
-	START_BOUNDARY: s++,
-	HEADER_FIELD_START: s++,
-	HEADER_FIELD: s++,
-	HEADER_VALUE_START: s++,
-	HEADER_VALUE: s++,
-	HEADER_VALUE_ALMOST_DONE: s++,
-	HEADERS_ALMOST_DONE: s++,
-	PART_DATA_START: s++,
-	PART_DATA: s++,
-	END: s++
-};
-
-let f = 1;
-const F = {
-	PART_BOUNDARY: f,
-	LAST_BOUNDARY: f *= 2
-};
-
-const LF = 10;
-const CR = 13;
-const SPACE = 32;
-const HYPHEN = 45;
-const COLON = 58;
-const A = 97;
-const Z = 122;
-
-const lower = c => c | 0x20;
-
-const noop = () => {};
-
-class MultipartParser {
-	/**
-	 * @param {string} boundary
-	 */
-	constructor(boundary) {
-		this.index = 0;
-		this.flags = 0;
-
-		this.onHeaderEnd = noop;
-		this.onHeaderField = noop;
-		this.onHeadersEnd = noop;
-		this.onHeaderValue = noop;
-		this.onPartBegin = noop;
-		this.onPartData = noop;
-		this.onPartEnd = noop;
-
-		this.boundaryChars = {};
-
-		boundary = '\r\n--' + boundary;
-		const ui8a = new Uint8Array(boundary.length);
-		for (let i = 0; i < boundary.length; i++) {
-			ui8a[i] = boundary.charCodeAt(i);
-			this.boundaryChars[ui8a[i]] = true;
-		}
-
-		this.boundary = ui8a;
-		this.lookbehind = new Uint8Array(this.boundary.length + 8);
-		this.state = S.START_BOUNDARY;
-	}
-
-	/**
-	 * @param {Uint8Array} data
-	 */
-	write(data) {
-		let i = 0;
-		const length_ = data.length;
-		let previousIndex = this.index;
-		let {lookbehind, boundary, boundaryChars, index, state, flags} = this;
-		const boundaryLength = this.boundary.length;
-		const boundaryEnd = boundaryLength - 1;
-		const bufferLength = data.length;
-		let c;
-		let cl;
-
-		const mark = name => {
-			this[name + 'Mark'] = i;
-		};
-
-		const clear = name => {
-			delete this[name + 'Mark'];
-		};
-
-		const callback = (callbackSymbol, start, end, ui8a) => {
-			if (start === undefined || start !== end) {
-				this[callbackSymbol](ui8a && ui8a.subarray(start, end));
-			}
-		};
-
-		const dataCallback = (name, clear) => {
-			const markSymbol = name + 'Mark';
-			if (!(markSymbol in this)) {
-				return;
-			}
-
-			if (clear) {
-				callback(name, this[markSymbol], i, data);
-				delete this[markSymbol];
-			} else {
-				callback(name, this[markSymbol], data.length, data);
-				this[markSymbol] = 0;
-			}
-		};
-
-		for (i = 0; i < length_; i++) {
-			c = data[i];
-
-			switch (state) {
-				case S.START_BOUNDARY:
-					if (index === boundary.length - 2) {
-						if (c === HYPHEN) {
-							flags |= F.LAST_BOUNDARY;
-						} else if (c !== CR) {
-							return;
-						}
-
-						index++;
-						break;
-					} else if (index - 1 === boundary.length - 2) {
-						if (flags & F.LAST_BOUNDARY && c === HYPHEN) {
-							state = S.END;
-							flags = 0;
-						} else if (!(flags & F.LAST_BOUNDARY) && c === LF) {
-							index = 0;
-							callback('onPartBegin');
-							state = S.HEADER_FIELD_START;
-						} else {
-							return;
-						}
-
-						break;
-					}
-
-					if (c !== boundary[index + 2]) {
-						index = -2;
-					}
-
-					if (c === boundary[index + 2]) {
-						index++;
-					}
-
-					break;
-				case S.HEADER_FIELD_START:
-					state = S.HEADER_FIELD;
-					mark('onHeaderField');
-					index = 0;
-					// falls through
-				case S.HEADER_FIELD:
-					if (c === CR) {
-						clear('onHeaderField');
-						state = S.HEADERS_ALMOST_DONE;
-						break;
-					}
-
-					index++;
-					if (c === HYPHEN) {
-						break;
-					}
-
-					if (c === COLON) {
-						if (index === 1) {
-							// empty header field
-							return;
-						}
-
-						dataCallback('onHeaderField', true);
-						state = S.HEADER_VALUE_START;
-						break;
-					}
-
-					cl = lower(c);
-					if (cl < A || cl > Z) {
-						return;
-					}
-
-					break;
-				case S.HEADER_VALUE_START:
-					if (c === SPACE) {
-						break;
-					}
-
-					mark('onHeaderValue');
-					state = S.HEADER_VALUE;
-					// falls through
-				case S.HEADER_VALUE:
-					if (c === CR) {
-						dataCallback('onHeaderValue', true);
-						callback('onHeaderEnd');
-						state = S.HEADER_VALUE_ALMOST_DONE;
-					}
-
-					break;
-				case S.HEADER_VALUE_ALMOST_DONE:
-					if (c !== LF) {
-						return;
-					}
-
-					state = S.HEADER_FIELD_START;
-					break;
-				case S.HEADERS_ALMOST_DONE:
-					if (c !== LF) {
-						return;
-					}
-
-					callback('onHeadersEnd');
-					state = S.PART_DATA_START;
-					break;
-				case S.PART_DATA_START:
-					state = S.PART_DATA;
-					mark('onPartData');
-					// falls through
-				case S.PART_DATA:
-					previousIndex = index;
-
-					if (index === 0) {
-						// boyer-moore derrived algorithm to safely skip non-boundary data
-						i += boundaryEnd;
-						while (i < bufferLength && !(data[i] in boundaryChars)) {
-							i += boundaryLength;
-						}
-
-						i -= boundaryEnd;
-						c = data[i];
-					}
-
-					if (index < boundary.length) {
-						if (boundary[index] === c) {
-							if (index === 0) {
-								dataCallback('onPartData', true);
-							}
-
-							index++;
-						} else {
-							index = 0;
-						}
-					} else if (index === boundary.length) {
-						index++;
-						if (c === CR) {
-							// CR = part boundary
-							flags |= F.PART_BOUNDARY;
-						} else if (c === HYPHEN) {
-							// HYPHEN = end boundary
-							flags |= F.LAST_BOUNDARY;
-						} else {
-							index = 0;
-						}
-					} else if (index - 1 === boundary.length) {
-						if (flags & F.PART_BOUNDARY) {
-							index = 0;
-							if (c === LF) {
-								// unset the PART_BOUNDARY flag
-								flags &= ~F.PART_BOUNDARY;
-								callback('onPartEnd');
-								callback('onPartBegin');
-								state = S.HEADER_FIELD_START;
-								break;
-							}
-						} else if (flags & F.LAST_BOUNDARY) {
-							if (c === HYPHEN) {
-								callback('onPartEnd');
-								state = S.END;
-								flags = 0;
-							} else {
-								index = 0;
-							}
-						} else {
-							index = 0;
-						}
-					}
-
-					if (index > 0) {
-						// when matching a possible boundary, keep a lookbehind reference
-						// in case it turns out to be a false lead
-						lookbehind[index - 1] = c;
-					} else if (previousIndex > 0) {
-						// if our boundary turned out to be rubbish, the captured lookbehind
-						// belongs to partData
-						const _lookbehind = new Uint8Array(lookbehind.buffer, lookbehind.byteOffset, lookbehind.byteLength);
-						callback('onPartData', 0, previousIndex, _lookbehind);
-						previousIndex = 0;
-						mark('onPartData');
-
-						// reconsider the current character even so it interrupted the sequence
-						// it could be the beginning of a new sequence
-						i--;
-					}
-
-					break;
-				case S.END:
-					break;
-				default:
-					throw new Error(`Unexpected state entered: ${state}`);
-			}
-		}
-
-		dataCallback('onHeaderField');
-		dataCallback('onHeaderValue');
-		dataCallback('onPartData');
-
-		// Update properties for the next call
-		this.index = index;
-		this.state = state;
-		this.flags = flags;
-	}
-
-	end() {
-		if ((this.state === S.HEADER_FIELD_START && this.index === 0) ||
-			(this.state === S.PART_DATA && this.index === this.boundary.length)) {
-			this.onPartEnd();
-		} else if (this.state !== S.END) {
-			throw new Error('MultipartParser.end(): stream ended unexpectedly');
-		}
-	}
-}
-
-function _fileName(headerValue) {
-	// matches either a quoted-string or a token (RFC 2616 section 19.5.1)
-	const m = headerValue.match(/\bfilename=("(.*?)"|([^()<>@,;:\\"/[\]?={}\s\t]+))($|;\s)/i);
-	if (!m) {
-		return;
-	}
-
-	const match = m[2] || m[3] || '';
-	let filename = match.slice(match.lastIndexOf('\\') + 1);
-	filename = filename.replace(/%22/g, '"');
-	filename = filename.replace(/&#(\d{4});/g, (m, code) => {
-		return String.fromCharCode(code);
-	});
-	return filename;
-}
-
-async function toFormData(Body, ct) {
-	if (!/multipart/i.test(ct)) {
-		throw new TypeError('Failed to fetch');
-	}
-
-	const m = ct.match(/boundary=(?:"([^"]+)"|([^;]+))/i);
-
-	if (!m) {
-		throw new TypeError('no or bad content-type header, no multipart boundary');
-	}
-
-	const parser = new MultipartParser(m[1] || m[2]);
-
-	let headerField;
-	let headerValue;
-	let entryValue;
-	let entryName;
-	let contentType;
-	let filename;
-	const entryChunks = [];
-	const formData = new formdata_polyfill_esm_min_js__WEBPACK_IMPORTED_MODULE_1__/* .FormData */ .Ct();
-
-	const onPartData = ui8a => {
-		entryValue += decoder.decode(ui8a, {stream: true});
-	};
-
-	const appendToFile = ui8a => {
-		entryChunks.push(ui8a);
-	};
-
-	const appendFileToFormData = () => {
-		const file = new fetch_blob_from_js__WEBPACK_IMPORTED_MODULE_0__/* .File */ .$B(entryChunks, filename, {type: contentType});
-		formData.append(entryName, file);
-	};
-
-	const appendEntryToFormData = () => {
-		formData.append(entryName, entryValue);
-	};
-
-	const decoder = new TextDecoder('utf-8');
-	decoder.decode();
-
-	parser.onPartBegin = function () {
-		parser.onPartData = onPartData;
-		parser.onPartEnd = appendEntryToFormData;
-
-		headerField = '';
-		headerValue = '';
-		entryValue = '';
-		entryName = '';
-		contentType = '';
-		filename = null;
-		entryChunks.length = 0;
-	};
-
-	parser.onHeaderField = function (ui8a) {
-		headerField += decoder.decode(ui8a, {stream: true});
-	};
-
-	parser.onHeaderValue = function (ui8a) {
-		headerValue += decoder.decode(ui8a, {stream: true});
-	};
-
-	parser.onHeaderEnd = function () {
-		headerValue += decoder.decode();
-		headerField = headerField.toLowerCase();
-
-		if (headerField === 'content-disposition') {
-			// matches either a quoted-string or a token (RFC 2616 section 19.5.1)
-			const m = headerValue.match(/\bname=("([^"]*)"|([^()<>@,;:\\"/[\]?={}\s\t]+))/i);
-
-			if (m) {
-				entryName = m[2] || m[3] || '';
-			}
-
-			filename = _fileName(headerValue);
-
-			if (filename) {
-				parser.onPartData = appendToFile;
-				parser.onPartEnd = appendFileToFormData;
-			}
-		} else if (headerField === 'content-type') {
-			contentType = headerValue;
-		}
-
-		headerValue = '';
-		headerField = '';
-	};
-
-	for await (const chunk of Body) {
-		parser.write(chunk);
-	}
-
-	parser.end();
-
-	return formData;
-}
-
-
-/***/ })
-
-};
-;
-//# sourceMappingURL=37.index.js.map

dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

dist/licenses.txt

@@ -1,23 +0,0 @@
-node-fetch
-MIT
-The MIT License (MIT)
-
-Copyright (c) 2016 David Frank
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

flake.lock

@@ -2,6 +2,7 @@
   "nodes": {
     "flake-schemas": {
       "locked": {
+        "lastModified": 1693491534,
         "narHash": "sha256-ifw8Td8kD08J8DxFbYjeIx5naHcDLz7s2IFP3X42I/U=",
         "rev": "c702cbb663d6d70bbb716584a2ee3aeb35017279",
         "revCount": 21,
@@ -15,15 +16,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "narHash": "sha256-g7nIUV4uq1TOVeVIDEZLb005suTWCUjSY0zYOlSBsyE=",
-        "rev": "32dcb45f66c0487e92db8303a798ebc548cadedc",
-        "revCount": 491340,
+        "lastModified": 1696879762,
+        "narHash": "sha256-Ud6bH4DMcYHUDKavNMxAhcIpDGgHMyL/yaDEAVSImQY=",
+        "rev": "f99e5f03cc0aa231ab5950a15ed02afec45ed51a",
+        "revCount": 534224,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2305.491340%2Brev-32dcb45f66c0487e92db8303a798ebc548cadedc/018aebfc-faf0-743e-aeb4-28acf5a64d95/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.534224%2Brev-f99e5f03cc0aa231ab5950a15ed02afec45ed51a/018b1d3c-12f0-76a5-b796-7668d7633f08/source.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nixpkgs/%2A.tar.gz"
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1.0.tar.gz"
       }
     },
     "root": {

flake.nix

@@ -4,12 +4,12 @@
 
   inputs = {
     flake-schemas.url = "https://flakehub.com/f/DeterminateSystems/flake-schemas/*.tar.gz";
-    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/*.tar.gz";
+    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1.0.tar.gz";
   };
 
   outputs = { self, flake-schemas, nixpkgs }:
     let
-      supportedSystems = [ "x86_64-linux" "aarch64-darwin" ];
+      supportedSystems = [ "x86_64-linux" "aarch64-darwin" "aarch64-linux" ];
       forEachSupportedSystem = f: nixpkgs.lib.genAttrs supportedSystems (system: f {
         pkgs = import nixpkgs { inherit system; };
       });
@@ -20,8 +20,10 @@
       devShells = forEachSupportedSystem ({ pkgs }: {
         default = pkgs.mkShell {
           packages = with pkgs; [
-            nodejs-18_x
+            nodejs_latest
             nixpkgs-fmt
+            nodePackages_latest.pnpm
+            nodePackages_latest.typescript-language-server
           ];
         };
       });

package.json

@@ -1,14 +1,18 @@
 {
   "name": "nix-installer-action",
   "version": "1.0.0",
-  "description": "You can use [`nix-installer`](https://github.com/DeterminateSystems/nix-installer) as a Github action:",
-  "main": "lib/main.js",
+  "description": "You can use [`nix-installer`](https://github.com/DeterminateSystems/nix-installer) as a Github Action:",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "type": "module",
   "scripts": {
-    "build": "tsc",
-    "format": "prettier --write '**/*.ts'",
+    "build": "tsup",
+    "format": "prettier --write .",
+    "check-fmt": "prettier --check .",
     "lint": "eslint src/**/*.ts",
-    "package": "ncc build --source-map --license licenses.txt",
-    "all": "npm run build && npm run format && npm run lint && npm run package"
+    "package": "ncc build",
+    "test": "vitest --watch false",
+    "all": "pnpm run test && pnpm run format && pnpm run lint && pnpm run build && pnpm run package"
   },
   "repository": {
     "type": "git",
@@ -22,20 +26,27 @@
   },
   "homepage": "https://github.com/DeterminateSystems/nix-installer-action#readme",
   "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^5.1.1",
-    "node-fetch": "^3.3.1",
-    "string-argv": "^0.3.2"
+    "@actions/core": "^1.11.1",
+    "@actions/exec": "^1.1.1",
+    "@actions/github": "^6.0.1",
+    "detsys-ts": "github:DeterminateSystems/detsys-ts",
+    "got": "^14.6.2",
+    "string-argv": "^0.3.2",
+    "vitest": "^3.2.4"
   },
   "devDependencies": {
-    "@types/node": "^18.16.3",
-    "@typescript-eslint/parser": "^5.59.2",
-    "@vercel/ncc": "^0.36.1",
-    "eslint": "^8.44.0",
-    "eslint-plugin-github": "^4.3.6",
-    "eslint-plugin-import": "^2.26.0",
-    "eslint-plugin-prettier": "^5.0.0-alpha.1",
-    "prettier": "^3.0.0",
-    "typescript": "^5.1.6"
+    "@trivago/prettier-plugin-sort-imports": "^4.3.0",
+    "@types/node": "^20.19.24",
+    "@types/uuid": "^9.0.8",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@vercel/ncc": "^0.38.4",
+    "eslint": "^8.57.1",
+    "eslint-import-resolver-typescript": "^3.10.1",
+    "eslint-plugin-github": "^4.10.2",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-prettier": "^5.5.4",
+    "prettier": "^3.6.2",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3"
   }
 }

src/annotate.ts

@@ -0,0 +1,66 @@
+import * as core from "@actions/core";
+
+import type { Fix, FixHashesOutputV1, Mismatch } from "./fixHashes.js";
+
+function prettyDerivation(derivation: string): string {
+  return derivation.replace(/\/nix\/store\/\w+-/, "").replace(/.drv$/, "");
+}
+
+function annotateSingle(
+  file: string,
+  line: number,
+  { derivation, replacement }: Mismatch,
+): void {
+  const pretty = prettyDerivation(derivation);
+  core.error(`To correct the hash mismatch for ${pretty}, use ${replacement}`, {
+    file,
+    startLine: line,
+  });
+}
+
+function annotateMultiple(
+  file: string,
+  { line, found, mismatches }: Fix,
+): void {
+  const matches = mismatches
+    .map(({ derivation, replacement }) => {
+      const pretty = prettyDerivation(derivation);
+      return `* For the derivation ${pretty}, use ${replacement}`;
+    })
+    .join("\n");
+
+  core.error(
+    `There are multiple replacements for the expression ${found}:\n${matches}`,
+    {
+      file,
+      startLine: line,
+    },
+  );
+}
+
+function annotate(file: string, fix: Fix): void {
+  if (fix.mismatches.length === 1) {
+    annotateSingle(file, fix.line, fix.mismatches[0]);
+  } else {
+    annotateMultiple(file, fix);
+  }
+}
+
+/**
+ * Annotates fixed-output derivation hash mismatches using GitHub Actions'
+ *
+ * @param output The output of `determinate-nixd fix hashes --json`
+ * @returns The number of annotations reported to the user
+ */
+export function annotateMismatches(output: FixHashesOutputV1): number {
+  let count = 0;
+
+  for (const { file, fixes } of output.files) {
+    for (const fix of fixes) {
+      annotate(file, fix);
+      count++;
+    }
+  }
+
+  return count;
+}

src/events.test.ts

@@ -0,0 +1,65 @@
+import { parseEvents, getRecentEvents } from "./events.js";
+import { expect, test } from "vitest";
+
+// Handy test for locally making sure you can fetch recent events:
+// eslint-disable-next-line no-constant-condition
+if (false) {
+  test("Parsing existing events", async () => {
+    expect(await getRecentEvents(new Date(Date.now() - 1000000))).toStrictEqual(
+      [{}],
+    );
+  });
+}
+
+test("Parsing existing events", () => {
+  const { events } = parseEvents([
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: "/nix/store/m96zgji4fhi70s2zs6pq5pric6ch7p4h-stdenv-darwin.drv",
+      outputs: ["/nix/store/dalhfz3l75w4b4q06sxzqgb2wfydvkbv-stdenv-darwin"],
+      timing: null,
+    },
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: "/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv",
+      outputs: ["/nix/store/qwlgz5da3pfb53gqpgdmazaj9jczrnly-dep-1"],
+      timing: {
+        startTime: "2025-04-11T14:38:02Z",
+        stopTime: "2025-04-11T14:38:05Z",
+        durationSeconds: 3,
+      },
+    },
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: "/nix/store/ykvbksjqrza2zpj6nkbycrdfwgfdpr8g-hash-mismatch-md5-base16.drv",
+      timing: {
+        startTime: "2025-04-11T14:36:44Z",
+        stopTime: "2025-04-11T14:36:44Z",
+        durationSeconds: 0,
+      },
+    },
+  ]);
+  expect(events).toStrictEqual([
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: "/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv",
+      timing: {
+        durationSeconds: 3,
+        startTime: new Date("2025-04-11T14:38:02Z"),
+      },
+    },
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: "/nix/store/ykvbksjqrza2zpj6nkbycrdfwgfdpr8g-hash-mismatch-md5-base16.drv",
+      timing: {
+        durationSeconds: 0,
+        startTime: new Date("2025-04-11T14:36:44Z"),
+      },
+    },
+  ]);
+});

src/events.ts

@@ -0,0 +1,89 @@
+import got from "got";
+
+export interface DEvent {
+  v: string;
+  c: string;
+  drv: string;
+  timing: {
+    startTime: Date;
+    durationSeconds: number;
+  };
+}
+
+export interface ParsedEventsResult {
+  readonly events: DEvent[];
+  readonly hasMismatches: boolean;
+}
+
+export function parseEvents(data: unknown): ParsedEventsResult {
+  let hasMismatches = false;
+
+  if (!Array.isArray(data)) {
+    return { events: [], hasMismatches };
+  }
+
+  const events = data.flatMap((event) => {
+    // If this was a hash mismatch event, note it and move on
+    if (event.v === "1" && event.c === "HashMismatchResponseEventV1") {
+      hasMismatches = true;
+      return [];
+    }
+
+    // Otherwise, determine if it's an event we're interested in
+    if (
+      event.v === "1" &&
+      (event.c === "BuildFailureResponseEventV1" ||
+        event.c === "BuiltPathResponseEventV1") &&
+      Object.hasOwn(event, "drv") &&
+      typeof event.drv === "string" &&
+      Object.hasOwn(event, "timing") &&
+      typeof event.timing === "object" &&
+      event.timing !== null
+    ) {
+      const timing = event.timing as { [key: string]: unknown };
+
+      if (
+        Object.hasOwn(timing, "startTime") &&
+        typeof timing.startTime === "string" &&
+        Object.hasOwn(timing, "durationSeconds") &&
+        typeof timing.durationSeconds === "number"
+      ) {
+        const date = Date.parse(timing.startTime);
+        if (!Number.isNaN(date)) {
+          return [
+            {
+              v: event.v,
+              c: event.c,
+              drv: event.drv,
+              timing: {
+                startTime: new Date(date),
+                durationSeconds: timing.durationSeconds,
+              },
+            },
+          ];
+        }
+      }
+    }
+
+    return [];
+  });
+
+  return { events, hasMismatches };
+}
+
+export async function getRecentEvents(
+  since: Date,
+): Promise<ParsedEventsResult> {
+  const queryParam = encodeURIComponent(since.toISOString());
+
+  const resp = await got
+    .get(
+      `http://unix:/nix/var/determinate/determinate-nixd.socket:/events/recent?since=${queryParam}`,
+      {
+        enableUnixSockets: true,
+      },
+    )
+    .json();
+
+  return parseEvents(resp);
+}

src/failuresummary.test.ts

@@ -0,0 +1,275 @@
+import { expect, test } from "vitest";
+import {
+  FailureSummary,
+  getBuildFailures,
+  summarizeFailures,
+} from "./failuresummary.js";
+
+/* eslint-disable @typescript-eslint/no-non-null-assertion */
+
+test("Select for failure events", () => {
+  const events = [
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv`,
+      timing: {
+        startTime: new Date(1 * 1000),
+        durationSeconds: 1,
+      },
+    },
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-2.drv`,
+      timing: {
+        startTime: new Date(2 * 1000),
+        durationSeconds: 2,
+      },
+    },
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv`,
+      timing: {
+        startTime: new Date(3 * 1000),
+        durationSeconds: 3,
+      },
+    },
+  ];
+
+  expect(getBuildFailures(events)).toStrictEqual([
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv`,
+      timing: {
+        startTime: new Date(1 * 1000),
+        durationSeconds: 1,
+      },
+    },
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv`,
+      timing: {
+        startTime: new Date(3 * 1000),
+        durationSeconds: 3,
+      },
+    },
+  ]);
+});
+
+test("Summarize Failures", async () => {
+  const events = [
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv`,
+      timing: {
+        startTime: new Date(1 * 1000),
+        durationSeconds: 1,
+      },
+    },
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-2.drv`,
+      timing: {
+        startTime: new Date(2 * 1000),
+        durationSeconds: 2,
+      },
+    },
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv`,
+      timing: {
+        startTime: new Date(3 * 1000),
+        durationSeconds: 3,
+      },
+    },
+  ];
+
+  const logMaker = async (drv: string): Promise<string | undefined> => {
+    if (drv.includes("dep-1")) {
+      return `${drv}\n`.repeat(9).trimEnd();
+    } else {
+      return `${drv}\n`.repeat(25).trimEnd();
+    }
+  };
+
+  const summary: FailureSummary = (await summarizeFailures(events, logMaker))!;
+
+  expect(summary.markdownLines.join("\n"))
+    .toStrictEqual(`### Build error review :boom:
+> [!NOTE]
+> 2 builds failed
+<details><summary>Failure log: <code>/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-<strong>dep-1</strong>.drv</code></summary>
+
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+
+</details>
+
+<details><summary>Failure log: <code>/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-<strong>dep-3</strong>.drv</code></summary>
+
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+
+</details>
+`);
+
+  expect(summary.logLines.join("\n"))
+    .toStrictEqual(`\u001b[38;2;255;0;0mBuild logs from 2 failures
+The following build logs are also available in the Markdown summary:
+::group::Failed build: /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+::endgroup::
+::group::Failed build: /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+::endgroup::`);
+});
+
+test("Omit some logs if there are too many", async () => {
+  const events = [
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv`,
+      timing: {
+        startTime: new Date(1 * 1000),
+        durationSeconds: 1,
+      },
+    },
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-2.drv`,
+      timing: {
+        startTime: new Date(2 * 1000),
+        durationSeconds: 2,
+      },
+    },
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv`,
+      timing: {
+        startTime: new Date(3 * 1000),
+        durationSeconds: 3,
+      },
+    },
+  ];
+
+  const logMaker = async (drv: string): Promise<string | undefined> => {
+    return `${drv}\n`.repeat(5).trimEnd();
+  };
+
+  const summary: FailureSummary = (await summarizeFailures(
+    events,
+    logMaker,
+    500,
+  ))!;
+
+  expect(summary.markdownLines.join("\n"))
+    .toStrictEqual(`### Build error review :boom:
+> [!NOTE]
+> 2 builds failed
+<details><summary>Failure log: <code>/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-<strong>dep-1</strong>.drv</code></summary>
+
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+
+</details>
+
+
+> [!NOTE]
+> The following failure has been omitted due to GitHub Actions' summary length limitations.
+> The full logs are available in the post-run phase of the Nix Installer Action.
+> * \`/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv\``);
+
+  expect(summary.logLines.join("\n"))
+    .toStrictEqual(`\u001b[38;2;255;0;0mBuild logs from 2 failures
+The following build logs are also available in the Markdown summary:
+::group::Failed build: /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv
+::endgroup::
+The following build logs are NOT available in the Markdown summary:
+::group::Failed build: /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+    /nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-3.drv
+::endgroup::`);
+});

src/failuresummary.ts

@@ -0,0 +1,124 @@
+import { getExecOutput } from "@actions/exec";
+import { DEvent } from "./events.js";
+import { stripVTControlCharacters } from "node:util";
+
+// CI summaries have a max length of "1024k" which I assume to be 1048576 bytes.
+// Generously, the mermaid doc is about 50,000 bytes.
+// Rounding it all down a bit further for wiggle room, that leaves lots of log space.
+const defaultMaxSummaryLength = 995_000;
+
+export function getBuildFailures(events: DEvent[]): DEvent[] {
+  return events.filter((event: DEvent): Boolean => {
+    return event.c === "BuildFailureResponseEventV1";
+  });
+}
+
+export interface FailureSummary {
+  logLines: string[];
+  markdownLines: string[];
+}
+
+export async function summarizeFailures(
+  events: DEvent[],
+  getLog: (drv: string) => Promise<string | undefined> = getLogFromNix,
+  maxLength: number = defaultMaxSummaryLength,
+): Promise<FailureSummary | undefined> {
+  const failures = getBuildFailures(events);
+
+  if (failures.length === 0) {
+    return undefined;
+  }
+
+  const logLines = [];
+  const markdownLines = [];
+
+  logLines.push(
+    `\u001b[38;2;255;0;0mBuild logs from ${failures.length} failure${failures.length === 1 ? "" : "s"}`,
+  );
+  logLines.push(
+    `The following build logs are also available in the Markdown summary:`,
+  );
+  markdownLines.push(`### Build error review :boom:`);
+  markdownLines.push("> [!NOTE]");
+  markdownLines.push(
+    `> ${failures.length} build${failures.length === 1 ? "" : "s"} failed`,
+  );
+
+  const markdownLogChunks: {
+    drv: string;
+    txtLines: string[];
+    mdLines: string[];
+  }[] = [];
+  for (const event of failures) {
+    const markdownLogChunk = [];
+    const txtLogChunk = [];
+    txtLogChunk.push(`::group::Failed build: ${event.drv}`);
+
+    const log =
+      (await getLog(event.drv)) ??
+      "(failure reading the log for this derivation.)";
+    const indented = log.split("\n").map((line) => `    ${line}`);
+
+    markdownLogChunk.push(
+      `<details><summary>Failure log: <code>${event.drv.replace(/^(\/nix[^-]*-)(.*)(\.drv)$/, "$1<strong>$2</strong>$3")}</code></summary>`,
+    );
+    markdownLogChunk.push("");
+
+    for (const line of indented) {
+      txtLogChunk.push(line);
+      markdownLogChunk.push(stripVTControlCharacters(line));
+    }
+    markdownLogChunk.push("");
+    markdownLogChunk.push("</details>");
+    markdownLogChunk.push("");
+
+    markdownLogChunks.push({
+      drv: event.drv,
+      mdLines: markdownLogChunk,
+      txtLines: txtLogChunk,
+    });
+    txtLogChunk.push(`::endgroup::`);
+  }
+
+  const skippedChunks = [];
+
+  // Add markdown log chunks until we exceed the max length
+  let markdownLength = markdownLines.join("\n").length;
+  for (const chunk of markdownLogChunks) {
+    const chunkLength = chunk.mdLines.join("\n").length;
+    if (markdownLength + chunkLength > maxLength) {
+      skippedChunks.push(chunk);
+    } else {
+      logLines.push(...chunk.txtLines);
+      markdownLines.push(...chunk.mdLines);
+      markdownLength += chunkLength;
+    }
+  }
+
+  if (skippedChunks.length > 0) {
+    markdownLines.push(
+      "",
+      "> [!NOTE]",
+      `> The following ${skippedChunks.length === 1 ? "failure has" : "failures have"} been omitted due to GitHub Actions' summary length limitations.`,
+      "> The full logs are available in the post-run phase of the Nix Installer Action.",
+    );
+
+    logLines.push(
+      "The following build logs are NOT available in the Markdown summary:",
+    );
+    for (const chunk of skippedChunks) {
+      markdownLines.push(`> * \`${chunk.drv}\``);
+      logLines.push(...chunk.txtLines);
+    }
+  }
+
+  return { logLines, markdownLines };
+}
+
+async function getLogFromNix(drv: string): Promise<string | undefined> {
+  const output = await getExecOutput("nix", ["log", drv], {
+    silent: true,
+  });
+
+  return output.stdout;
+}

src/fixHashes.ts

@@ -0,0 +1,38 @@
+import { getExecOutput } from "@actions/exec";
+
+export interface Mismatch {
+  readonly derivation: string;
+  readonly replacement: string;
+}
+
+export interface Fix {
+  readonly line: number;
+  readonly found: string;
+  readonly mismatches: readonly Mismatch[];
+}
+
+export interface FileFix {
+  readonly file: string;
+  readonly fixes: readonly Fix[];
+}
+
+export interface FixHashesOutputV1 {
+  readonly version: "v1";
+  readonly files: readonly FileFix[];
+}
+
+export async function getFixHashes(since: string): Promise<FixHashesOutputV1> {
+  const output = await getExecOutput(
+    "determinate-nixd",
+    ["fix", "hashes", "--json", "--since", since],
+    { silent: true },
+  );
+
+  if (output.exitCode !== 0) {
+    throw new Error(
+      `determinate-nixd fix hashes returned non-zero exit code ${output.exitCode} with the following error output:\n${output.stderr}`,
+    );
+  }
+
+  return JSON.parse(output.stdout);
+}

src/main.ts

@@ -1,684 +0,0 @@
-import * as actions_core from "@actions/core";
-import * as github from "@actions/github";
-import { mkdtemp, chmod, access, writeFile } from "node:fs/promises";
-import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { pipeline } from "node:stream";
-import fetch from "node-fetch";
-import { promisify } from "node:util";
-import fs from "node:fs";
-import stringArgv from "string-argv";
-
-class NixInstallerAction {
-  platform: string;
-  nix_package_url: string | null;
-  backtrace: string | null;
-  extra_args: string | null;
-  extra_conf: string[] | null;
-  flakehub: boolean;
-  github_token: string | null;
-  // TODO: linux_init
-  init: string | null;
-  local_root: string | null;
-  log_directives: string | null;
-  logger: string | null;
-  ssl_cert_file: string | null;
-  proxy: string | null;
-  mac_case_sensitive: string | null;
-  mac_encrypt: string | null;
-  mac_root_disk: string | null;
-  mac_volume_label: string | null;
-  modify_profile: boolean;
-  nix_build_group_id: number | null;
-  nix_build_group_name: string | null;
-  nix_build_user_base: number | null;
-  nix_build_user_count: number | null;
-  nix_build_user_prefix: string | null;
-  planner: string | null;
-  reinstall: boolean;
-  start_daemon: boolean;
-  diagnostic_endpoint: string | null;
-  trust_runner_user: boolean | null;
-  nix_installer_url: URL;
-
-  // Connects the installation diagnostic report to the post-run diagnostic report.
-  // This is for monitoring the real impact of Nix updates, to avoid breaking large
-  // swaths of users at once with botched Nix releases. For example:
-  // https://github.com/NixOS/nix/issues/9052.
-  correlation: string | undefined;
-
-  constructor() {
-    this.platform = get_nix_platform();
-    this.nix_package_url = action_input_string_or_null("nix-package-url");
-    this.backtrace = action_input_string_or_null("backtrace");
-    this.extra_args = action_input_string_or_null("extra-args");
-    this.extra_conf = action_input_multiline_string_or_null("extra-conf");
-    this.flakehub = action_input_bool("flakehub");
-    this.github_token = action_input_string_or_null("github-token");
-    this.init = action_input_string_or_null("init");
-    this.local_root = action_input_string_or_null("local-root");
-    this.log_directives = action_input_string_or_null("log-directives");
-    this.logger = action_input_string_or_null("logger");
-    this.ssl_cert_file = action_input_string_or_null("ssl-cert-file");
-    this.proxy = action_input_string_or_null("proxy");
-    this.mac_case_sensitive = action_input_string_or_null("mac-case-sensitive");
-    this.mac_encrypt = action_input_string_or_null("mac-encrypt");
-    this.mac_root_disk = action_input_string_or_null("mac-root-disk");
-    this.mac_volume_label = action_input_string_or_null("mac-volume-label");
-    this.modify_profile = action_input_bool("modify-profile");
-    this.nix_build_group_id = action_input_number_or_null("nix-build-group-id");
-    this.nix_build_group_name = action_input_string_or_null(
-      "nix-build-group-name",
-    );
-    this.nix_build_user_base = action_input_number_or_null(
-      "nix_build-user-base",
-    );
-    this.nix_build_user_count = action_input_number_or_null(
-      "nix-build-user-count",
-    );
-    this.nix_build_user_prefix = action_input_string_or_null(
-      "nix-build-user-prefix",
-    );
-    this.planner = action_input_string_or_null("planner");
-    this.reinstall = action_input_bool("reinstall");
-    this.start_daemon = action_input_bool("start-daemon");
-    this.diagnostic_endpoint = action_input_string_or_null(
-      "diagnostic-endpoint",
-    );
-    this.trust_runner_user = action_input_bool("trust-runner-user");
-    this.correlation = process.env["STATE_correlation"];
-    this.nix_installer_url = resolve_nix_installer_url(
-      this.platform,
-      this.correlation,
-    );
-  }
-
-  private async executionEnvironment(): Promise<ExecuteEnvironment> {
-    const execution_env: ExecuteEnvironment = {};
-
-    execution_env.NIX_INSTALLER_NO_CONFIRM = "true";
-    execution_env.NIX_INSTALLER_DIAGNOSTIC_ATTRIBUTION = this.correlation;
-
-    if (this.backtrace !== null) {
-      execution_env.RUST_BACKTRACE = this.backtrace;
-    }
-    if (this.modify_profile !== null) {
-      if (this.modify_profile) {
-        execution_env.NIX_INSTALLER_MODIFY_PROFILE = "true";
-      } else {
-        execution_env.NIX_INSTALLER_MODIFY_PROFILE = "false";
-      }
-    }
-
-    if (this.nix_build_group_id !== null) {
-      execution_env.NIX_INSTALLER_NIX_BUILD_GROUP_ID = `${this.nix_build_group_id}`;
-    }
-
-    if (this.nix_build_group_name !== null) {
-      execution_env.NIX_INSTALLER_NIX_BUILD_GROUP_NAME =
-        this.nix_build_group_name;
-    }
-
-    if (this.nix_build_user_prefix !== null) {
-      execution_env.NIX_INSTALLER_NIX_BUILD_USER_PREFIX =
-        this.nix_build_user_prefix;
-    }
-
-    if (this.nix_build_user_count !== null) {
-      execution_env.NIX_INSTALLER_NIX_BUILD_USER_COUNT = `${this.nix_build_user_count}`;
-    }
-
-    if (this.nix_build_user_base !== null) {
-      execution_env.NIX_INSTALLER_NIX_BUILD_USER_ID_BASE = `${this.nix_build_user_count}`;
-    }
-
-    if (this.nix_package_url !== null) {
-      execution_env.NIX_INSTALLER_NIX_PACKAGE_URL = `${this.nix_package_url}`;
-    }
-
-    if (this.proxy !== null) {
-      execution_env.NIX_INSTALLER_PROXY = this.proxy;
-    }
-
-    if (this.ssl_cert_file !== null) {
-      execution_env.NIX_INSTALLER_SSL_CERT_FILE = this.ssl_cert_file;
-    }
-
-    if (this.diagnostic_endpoint !== null) {
-      execution_env.NIX_INSTALLER_DIAGNOSTIC_ENDPOINT =
-        this.diagnostic_endpoint;
-    }
-
-    // TODO: Error if the user uses these on not-MacOS
-    if (this.mac_encrypt !== null) {
-      if (process.env.RUNNER_OS !== "macOS") {
-        throw new Error("`mac-encrypt` while `$RUNNER_OS` was not `macOS`");
-      }
-      execution_env.NIX_INSTALLER_ENCRYPT = this.mac_encrypt;
-    }
-
-    if (this.mac_case_sensitive !== null) {
-      if (process.env.RUNNER_OS !== "macOS") {
-        throw new Error(
-          "`mac-case-sensitive` while `$RUNNER_OS` was not `macOS`",
-        );
-      }
-      execution_env.NIX_INSTALLER_CASE_SENSITIVE = this.mac_case_sensitive;
-    }
-
-    if (this.mac_volume_label !== null) {
-      if (process.env.RUNNER_OS !== "macOS") {
-        throw new Error(
-          "`mac-volume-label` while `$RUNNER_OS` was not `macOS`",
-        );
-      }
-      execution_env.NIX_INSTALLER_VOLUME_LABEL = this.mac_volume_label;
-    }
-
-    if (this.mac_root_disk !== null) {
-      if (process.env.RUNNER_OS !== "macOS") {
-        throw new Error("`mac-root-disk` while `$RUNNER_OS` was not `macOS`");
-      }
-      execution_env.NIX_INSTALLER_ROOT_DISK = this.mac_root_disk;
-    }
-
-    if (this.logger !== null) {
-      execution_env.NIX_INSTALLER_LOGGER = this.logger;
-    }
-
-    if (this.log_directives !== null) {
-      execution_env.NIX_INSTALLER_LOG_DIRECTIVES = this.log_directives;
-    }
-
-    // TODO: Error if the user uses these on MacOS
-    if (this.init !== null) {
-      if (process.env.RUNNER_OS === "macOS") {
-        throw new Error(
-          "`init` is not a valid option when `$RUNNER_OS` is `macOS`",
-        );
-      }
-      execution_env.NIX_INSTALLER_INIT = this.init;
-    }
-
-    if (this.start_daemon !== null) {
-      if (this.start_daemon) {
-        execution_env.NIX_INSTALLER_START_DAEMON = "true";
-      } else {
-        execution_env.NIX_INSTALLER_START_DAEMON = "false";
-      }
-    }
-
-    let extra_conf = "";
-    if (this.github_token !== null) {
-      extra_conf += `access-tokens = github.com=${this.github_token}`;
-      extra_conf += "\n";
-    }
-    if (this.trust_runner_user !== null) {
-      extra_conf += `trusted-users = root ${process.env.USER}`;
-      extra_conf += "\n";
-    }
-    if (this.flakehub) {
-      extra_conf += `netrc-file = ${await this.flakehub_login()}`;
-      extra_conf += "\n";
-    }
-    if (this.extra_conf !== null && this.extra_conf.length !== 0) {
-      extra_conf += this.extra_conf.join("\n");
-      extra_conf += "\n";
-    }
-    execution_env.NIX_INSTALLER_EXTRA_CONF = extra_conf;
-
-    if (process.env.ACT && !process.env.NOT_ACT) {
-      actions_core.info(
-        "Detected `$ACT` environment, assuming this is a https://github.com/nektos/act created container, set `NOT_ACT=true` to override this. This will change the setting of the `init` to be compatible with `act`",
-      );
-      execution_env.NIX_INSTALLER_INIT = "none";
-    }
-
-    return execution_env;
-  }
-
-  private async execute_install(binary_path: string): Promise<number> {
-    const execution_env = await this.executionEnvironment();
-    actions_core.info(
-      `Execution environment: ${JSON.stringify(execution_env, null, 4)}`,
-    );
-
-    const args = ["install"];
-    if (this.planner) {
-      args.push(this.planner);
-    } else {
-      args.push(get_default_planner());
-    }
-
-    if (this.extra_args) {
-      const extra_args = stringArgv(this.extra_args);
-      args.concat(extra_args);
-    }
-
-    const merged_env = {
-      ...process.env, // To get $PATH, etc
-      ...execution_env,
-    };
-
-    const spawned = spawn(`${binary_path}`, args, {
-      env: merged_env,
-    });
-
-    spawned.stdout.setEncoding("utf-8");
-    spawned.stdout.on("data", (data) => {
-      const trimmed = data.trimEnd();
-      if (trimmed.length >= 0) {
-        actions_core.info(trimmed);
-      }
-    });
-
-    spawned.stderr.setEncoding("utf-8");
-    spawned.stderr.on("data", (data) => {
-      const trimmed = data.trimEnd();
-      if (trimmed.length >= 0) {
-        actions_core.info(trimmed);
-      }
-    });
-
-    const exit_code: number = await new Promise((resolve, _reject) => {
-      spawned.on("close", resolve);
-    });
-
-    if (exit_code !== 0) {
-      throw new Error(`Non-zero exit code of \`${exit_code}\` detected`);
-    }
-
-    return exit_code;
-  }
-
-  async install(): Promise<void> {
-    const existing_install = await this.detect_existing();
-    if (existing_install) {
-      if (this.reinstall) {
-        // We need to uninstall, then reinstall
-        actions_core.info(
-          "Nix was already installed, `reinstall` is set, uninstalling for a reinstall",
-        );
-        await this.execute_uninstall();
-      } else {
-        // We're already installed, and not reinstalling, just set GITHUB_PATH and finish early
-        await this.set_github_path();
-        actions_core.info("Nix was already installed, using existing install");
-        return;
-      }
-    }
-    // Normal just doing of the install
-    const binary_path = await this.fetch_binary();
-    await this.execute_install(binary_path);
-    await this.set_github_path();
-  }
-
-  async set_github_path(): Promise<void> {
-    // Interim versions of the `nix-installer` crate may have already manipulated `$GITHUB_PATH`, as root even! Accessing that will be an error.
-    try {
-      const nix_var_nix_profile_path = "/nix/var/nix/profiles/default/bin";
-      const home_nix_profile_path = `${process.env.HOME}/.nix-profile/bin`;
-      actions_core.addPath(nix_var_nix_profile_path);
-      actions_core.addPath(home_nix_profile_path);
-      actions_core.info(
-        `Added \`${nix_var_nix_profile_path}\` and \`${home_nix_profile_path}\` to \`$GITHUB_PATH\``,
-      );
-    } catch (error) {
-      actions_core.info(
-        "Skipping setting $GITHUB_PATH in action, the `nix-installer` crate seems to have done this already. From `nix-installer` version 0.11.0 and up, this step is done in the action. Prior to 0.11.0, this was only done in the `nix-installer` binary.",
-      );
-    }
-  }
-
-  async flakehub_login(): Promise<string> {
-    const netrc_path = `${process.env["RUNNER_TEMP"]}/determinate-nix-installer-netrc`;
-
-    const jwt = await actions_core.getIDToken("api.flakehub.com");
-
-    await writeFile(
-      netrc_path,
-      [
-        `machine api.flakehub.com login flakehub password ${jwt}`,
-        `machine flakehub.com login flakehub password ${jwt}`,
-      ].join("\n"),
-    );
-
-    actions_core.info("Logging in to FlakeHub.");
-
-    // the join followed by a match on ^... looks silly, but extra_config
-    // could contain multi-line values
-    if (this.extra_conf?.join("\n").match(/^netrc-file/m)) {
-      actions_core.warning(
-        "Logging in to FlakeHub conflicts with the Nix option `netrc-file`.",
-      );
-    }
-
-    return netrc_path;
-  }
-
-  async execute_uninstall(): Promise<number> {
-    const spawned = spawn(`/nix/nix-installer`, ["uninstall"], {
-      env: {
-        NIX_INSTALLER_NO_CONFIRM: "true",
-        ...process.env, // To get $PATH, etc
-      },
-    });
-
-    spawned.stdout.setEncoding("utf-8");
-    spawned.stdout.on("data", (data) => {
-      const trimmed = data.trimEnd();
-      if (trimmed.length >= 0) {
-        actions_core.info(trimmed);
-      }
-    });
-
-    spawned.stderr.setEncoding("utf-8");
-    spawned.stderr.on("data", (data) => {
-      const trimmed = data.trimEnd();
-      if (trimmed.length >= 0) {
-        actions_core.info(trimmed);
-      }
-    });
-
-    const exit_code: number = await new Promise((resolve, _reject) => {
-      spawned.on("close", resolve);
-    });
-
-    if (exit_code !== 0) {
-      throw new Error(`Non-zero exit code of \`${exit_code}\` detected`);
-    }
-
-    return exit_code;
-  }
-
-  async detect_existing(): Promise<boolean> {
-    const receipt_path = "/nix/receipt.json";
-    try {
-      await access(receipt_path);
-      // There is a /nix/receipt.json
-      return true;
-    } catch {
-      // No /nix/receipt.json
-      return false;
-    }
-  }
-
-  private async fetch_binary(): Promise<string> {
-    if (!this.local_root) {
-      actions_core.info(`Fetching binary from ${this.nix_installer_url}`);
-      const response = await fetch(this.nix_installer_url);
-      if (!response.ok) {
-        throw new Error(
-          `Got a status of ${response.status} from \`${this.nix_installer_url}\`, expected a 200`,
-        );
-      }
-
-      const tempdir = await mkdtemp(join(tmpdir(), "nix-installer-"));
-      const tempfile = join(tempdir, `nix-installer-${this.platform}`);
-
-      if (!response.ok) {
-        throw new Error(`unexpected response ${response.statusText}`);
-      }
-
-      if (response.body !== null) {
-        const streamPipeline = promisify(pipeline);
-        await streamPipeline(response.body, fs.createWriteStream(tempfile));
-        actions_core.info(`Downloaded \`nix-installer\` to \`${tempfile}\``);
-      } else {
-        throw new Error("No response body recieved");
-      }
-
-      // Make executable
-      await chmod(tempfile, fs.constants.S_IXUSR | fs.constants.S_IXGRP);
-
-      return tempfile;
-    } else {
-      const local_path = join(
-        this.local_root,
-        `nix-installer-${this.platform}`,
-      );
-      actions_core.info(`Using binary ${local_path}`);
-      return local_path;
-    }
-  }
-
-  async report_overall(): Promise<void> {
-    if (this.diagnostic_endpoint == null) {
-      return;
-    }
-
-    try {
-      await fetch(this.diagnostic_endpoint, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-          "post-github-workflow-run-report": true,
-          correlation: this.correlation,
-          conclusion: await this.get_workflow_conclusion(),
-        }),
-      });
-    } catch (error) {
-      actions_core.debug(
-        `Error submitting post-run diagnostics report: ${error}`,
-      );
-    }
-  }
-
-  private async get_workflow_conclusion(): Promise<
-    undefined | "success" | "failure" | "cancelled" | "unavailable" | "no-jobs"
-  > {
-    if (this.github_token == null) {
-      return undefined;
-    }
-
-    try {
-      const octokit = github.getOctokit(this.github_token);
-      const jobs = await octokit.paginate(
-        octokit.rest.actions.listJobsForWorkflowRun,
-        {
-          owner: github.context.repo.owner,
-          repo: github.context.repo.repo,
-          run_id: github.context.runId,
-        },
-      );
-
-      actions_core.debug(`awaited jobs: ${jobs}`);
-      const job = jobs
-        .filter((candidate) => candidate.name === github.context.job)
-        .at(0);
-      if (job === undefined) {
-        return "no-jobs";
-      }
-
-      const outcomes = (job.steps || []).map((j) => j.conclusion || "unknown");
-
-      // Possible values: success, failure, cancelled, or skipped
-      // from: https://docs.github.com/en/actions/learn-github-actions/contexts
-
-      if (outcomes.includes("failure")) {
-        // Any failures fails the job
-        return "failure";
-      }
-      if (outcomes.includes("cancelled")) {
-        // Any cancellations cancels the job
-        return "cancelled";
-      }
-
-      // Assume success if no jobs failed or were canceled
-      return "success";
-    } catch (error) {
-      actions_core.debug(`Error determining final disposition: ${error}`);
-      return "unavailable";
-    }
-  }
-}
-
-type ExecuteEnvironment = {
-  // All env vars are strings, no fanciness here.
-  RUST_BACKTRACE?: string;
-  NIX_INSTALLER_MODIFY_PROFILE?: string;
-  NIX_INSTALLER_NIX_BUILD_GROUP_NAME?: string;
-  NIX_INSTALLER_NIX_BUILD_GROUP_ID?: string;
-  NIX_INSTALLER_NIX_BUILD_USER_PREFIX?: string;
-  NIX_INSTALLER_NIX_BUILD_USER_COUNT?: string;
-  NIX_INSTALLER_NIX_BUILD_USER_ID_BASE?: string;
-  NIX_INSTALLER_NIX_PACKAGE_URL?: string;
-  NIX_INSTALLER_PROXY?: string;
-  NIX_INSTALLER_SSL_CERT_FILE?: string;
-  NIX_INSTALLER_DIAGNOSTIC_ENDPOINT?: string;
-  NIX_INSTALLER_DIAGNOSTIC_ATTRIBUTION?: string;
-  NIX_INSTALLER_ENCRYPT?: string;
-  NIX_INSTALLER_CASE_SENSITIVE?: string;
-  NIX_INSTALLER_VOLUME_LABEL?: string;
-  NIX_INSTALLER_ROOT_DISK?: string;
-  NIX_INSTALLER_INIT?: string;
-  NIX_INSTALLER_START_DAEMON?: string;
-  NIX_INSTALLER_NO_CONFIRM?: string;
-  NIX_INSTALLER_EXTRA_CONF?: string;
-  NIX_INSTALLER_LOG_DIRECTIVES?: string;
-  NIX_INSTALLER_LOGGER?: string;
-};
-
-function get_nix_platform(): string {
-  const env_os = process.env.RUNNER_OS;
-  const env_arch = process.env.RUNNER_ARCH;
-
-  if (env_os === "macOS" && env_arch === "X64") {
-    return "x86_64-darwin";
-  } else if (env_os === "macOS" && env_arch === "ARM64") {
-    return "aarch64-darwin";
-  } else if (env_os === "Linux" && env_arch === "X64") {
-    return "x86_64-linux";
-  } else if (env_os === "Linux" && env_arch === "ARM64") {
-    return "aarch64-linux";
-  } else {
-    throw new Error(
-      `Unsupported \`RUNNER_OS\` (currently \`${env_os}\`) and \`RUNNER_ARCH\` (currently \`${env_arch}\`)  combination`,
-    );
-  }
-}
-
-function get_default_planner(): string {
-  const env_os = process.env.RUNNER_OS;
-
-  if (env_os === "macOS") {
-    return "macos";
-  } else if (env_os === "Linux") {
-    return "linux";
-  } else {
-    throw new Error(`Unsupported \`RUNNER_OS\` (currently \`${env_os}\`)`);
-  }
-}
-
-function resolve_nix_installer_url(
-  platform: string,
-  correlation?: string,
-): URL {
-  // Only one of these are allowed.
-  const nix_installer_branch = action_input_string_or_null(
-    "nix-installer-branch",
-  );
-  const nix_installer_pr = action_input_number_or_null("nix-installer-pr");
-  const nix_installer_revision = action_input_string_or_null(
-    "nix-installer-revision",
-  );
-  const nix_installer_tag = action_input_string_or_null("nix-installer-tag");
-  const nix_installer_url = action_input_string_or_null("nix-installer-url");
-  const url_suffix = `ci=github&correlation=${correlation}`;
-  let resolved_nix_installer_url = null;
-  let num_set = 0;
-
-  if (nix_installer_branch !== null) {
-    num_set += 1;
-    resolved_nix_installer_url = new URL(
-      `https://install.determinate.systems/nix/branch/${nix_installer_branch}/nix-installer-${platform}?${url_suffix}`,
-    );
-  } else if (nix_installer_pr !== null) {
-    num_set += 1;
-    resolved_nix_installer_url = new URL(
-      `https://install.determinate.systems/nix/pr/${nix_installer_pr}/nix-installer-${platform}?${url_suffix}`,
-    );
-  } else if (nix_installer_revision !== null) {
-    num_set += 1;
-    resolved_nix_installer_url = new URL(
-      `https://install.determinate.systems/nix/rev/${nix_installer_revision}/nix-installer-${platform}?${url_suffix}`,
-    );
-  } else if (nix_installer_tag !== null) {
-    num_set += 1;
-    resolved_nix_installer_url = new URL(
-      `https://install.determinate.systems/nix/tag/${nix_installer_tag}/nix-installer-${platform}?${url_suffix}`,
-    );
-  } else if (nix_installer_url !== null) {
-    num_set += 1;
-    resolved_nix_installer_url = new URL(nix_installer_url);
-  } else {
-    resolved_nix_installer_url = new URL(
-      `https://install.determinate.systems/nix/nix-installer-${platform}?${url_suffix}`,
-    );
-  }
-
-  if (num_set > 1) {
-    throw new Error(
-      `The following options are mututally exclusive, but ${num_set} were set: \`nix_installer_branch\`, \`nix_installer_pr\`, \`nix_installer_revision\`, \`nix_installer_tag\`, and \`nix_installer_url\``,
-    );
-  }
-  return resolved_nix_installer_url;
-}
-
-function action_input_string_or_null(name: string): string | null {
-  const value = actions_core.getInput(name);
-  if (value === "") {
-    return null;
-  } else {
-    return value;
-  }
-}
-
-function action_input_multiline_string_or_null(name: string): string[] | null {
-  const value = actions_core.getMultilineInput(name);
-  if (value.length === 0) {
-    return null;
-  } else {
-    return value;
-  }
-}
-
-function action_input_number_or_null(name: string): number | null {
-  const value = actions_core.getInput(name);
-  if (value === "") {
-    return null;
-  } else {
-    return Number(value);
-  }
-}
-
-function action_input_bool(name: string): boolean {
-  return actions_core.getBooleanInput(name);
-}
-
-async function main(): Promise<void> {
-  try {
-    if (!process.env["STATE_correlation"]) {
-      const correlation = `GH-${randomUUID()}`;
-      actions_core.saveState("correlation", correlation);
-      process.env["STATE_correlation"] = correlation;
-    }
-    const installer = new NixInstallerAction();
-
-    const isPost = !!process.env["STATE_isPost"];
-    if (!isPost) {
-      actions_core.saveState("isPost", "true");
-      await installer.install();
-    } else {
-      installer.report_overall();
-    }
-  } catch (error) {
-    if (error instanceof Error) actions_core.setFailed(error);
-  }
-}
-
-main();

src/mermaid.test.ts

@@ -0,0 +1,207 @@
+import { mermaidify, makeMermaidReport } from "./mermaid.js";
+import { DEvent, parseEvents } from "./events.js";
+import { expect, test } from "vitest";
+
+/* eslint-disable @typescript-eslint/no-non-null-assertion */
+
+function generateEvents(count: number): DEvent[] {
+  const events: DEvent[] = [];
+
+  for (let i = 0; i < count; i++) {
+    events.push({
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: `/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-${i}.drv`,
+      timing: {
+        startTime: new Date(i * 1000),
+        durationSeconds: i,
+      },
+    });
+  }
+
+  return events;
+}
+
+test("Empty event list returns no report", () => {
+  const report = makeMermaidReport([]);
+
+  expect(report).toBeUndefined();
+});
+
+test("Create a very large report doc and make sure it is small enough", () => {
+  const report = makeMermaidReport(generateEvents(2500))!;
+
+  // Assert the `.drv` suffix was pruned (1 reference = the NOTE at the end)
+  expect(report.match(/\.drv/g)!.length).equals(1);
+
+  // Assert the `/nix/store` prefix was pruned (1 reference = the NOTE at the end)
+  expect(report.match(/\/nix\/store\//g)!.length).equals(1);
+
+  // Assert that some events were pruned
+  expect(report.match(/dep-/g)!.length).lessThan(2500);
+  expect(report.match(/dep-/g)!.length).greaterThan(1500);
+
+  expect(report).toContain("suffix, and builds that took less than ");
+
+  expect(report.length).lessThan(50200);
+  expect(report.length).greaterThan(49000);
+});
+
+test("Create a medium large report doc and make sure it is small enough", () => {
+  const eventCount = 675;
+  const report = makeMermaidReport(generateEvents(eventCount))!;
+
+  // Assert the `.drv` suffix was pruned (1 reference = the NOTE at the end)
+  expect(report.match(/\.drv/g)!.length).equals(1);
+
+  // Assert the `/nix/store` prefix was pruned (1 reference = the NOTE at the end)
+  expect(report.match(/\/nix\/store\//g)!.length).equals(1);
+
+  // Assert that no lines were pruned
+  expect(report.match(/dep-/g)!.length).toStrictEqual(eventCount);
+
+  expect(report).toContain(
+    "suffixes have been removed to make the graph small enough to render",
+  );
+
+  expect(report.length).lessThan(50200);
+  expect(report.length).greaterThan(18000);
+});
+
+test("Create a small report doc and make sure it isn't pruned", () => {
+  const report = makeMermaidReport(generateEvents(100))!;
+
+  // Assert 100 events have the `.drv` suffix, ie: were not pruned
+  expect(report.match(/\.drv/g)!.length).equals(100);
+
+  // Assert 100 events have the `.drv` suffix, ie: were not pruned
+  expect(report.match(/\/nix\/store\//g)!.length).equals(100);
+
+  expect(report.length).lessThan(50000);
+});
+
+test("Generate a really big report and shrink it", () => {
+  const events = generateEvents(1000);
+
+  const originalLength = mermaidify(events, -1)!.length;
+  const limitedLengthZero = mermaidify(events, 0)!.length;
+  const limitedLengthOne = mermaidify(events, 1)!.length;
+  const limitedLengthTwo = mermaidify(events, 2)!.length;
+
+  expect(originalLength).greaterThan(limitedLengthZero);
+  expect(limitedLengthZero).greaterThan(limitedLengthOne);
+  expect(limitedLengthOne).greaterThan(limitedLengthTwo);
+});
+
+test("Generate a rough report of various length", () => {
+  const { events } = parseEvents([
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: "/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-0.drv",
+      outputs: ["/nix/store/qwlgz5da3pfb53gqpgdmazaj9jczrnly-dep-0"],
+      timing: {
+        startTime: "2025-04-11T14:38:02Z",
+        stopTime: "2025-04-11T14:38:05Z",
+        durationSeconds: 0,
+      },
+    },
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: "/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv",
+      outputs: ["/nix/store/qwlgz5da3pfb53gqpgdmazaj9jczrnly-dep-1"],
+      timing: {
+        startTime: "2025-04-11T14:38:02Z",
+        stopTime: "2025-04-11T14:38:05Z",
+        durationSeconds: 1,
+      },
+    },
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: "/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-2.drv",
+      outputs: ["/nix/store/qwlgz5da3pfb53gqpgdmazaj9jczrnly-dep-2"],
+      timing: {
+        startTime: "2025-04-11T14:38:02Z",
+        stopTime: "2025-04-11T14:38:05Z",
+        durationSeconds: 2,
+      },
+    },
+    {
+      v: "1",
+      c: "BuildFailureResponseEventV1",
+      drv: "/nix/store/ykvbksjqrza2zpj6nkbycrdfwgfdpr8g-hash-mismatch-md5-base16.drv",
+      timing: {
+        startTime: "2025-04-11T14:38:05Z",
+        stopTime: "2025-04-11T14:38:09Z",
+        durationSeconds: 4,
+      },
+    },
+  ]);
+
+  expect(mermaidify(events, -1)).toStrictEqual(`\`\`\`mermaid
+gantt
+    dateFormat X
+    axisFormat %Mm%Ss
+/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-0.drv (0s):d, 0, 0s
+/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-1.drv (1s):d, 0, 1s
+/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-2.drv (2s):d, 0, 2s
+/nix/store/ykvbksjqrza2zpj6nkbycrdfwgfdpr8g-hash-mismatch-md5-base16.drv (4s):crit, 3, 4s
+\`\`\``);
+
+  expect(mermaidify(events, 0)).toStrictEqual(`\`\`\`mermaid
+gantt
+    dateFormat X
+    axisFormat %Mm%Ss
+dep-0 (0s):d, 0, 0s
+dep-1 (1s):d, 0, 1s
+dep-2 (2s):d, 0, 2s
+hash-mismatch-md5-base16 (4s):crit, 3, 4s
+\`\`\``);
+
+  expect(mermaidify(events, 1)).toStrictEqual(`\`\`\`mermaid
+gantt
+    dateFormat X
+    axisFormat %Mm%Ss
+dep-1 (1s):d, 0, 1s
+dep-2 (2s):d, 0, 2s
+hash-mismatch-md5-base16 (4s):crit, 3, 4s
+\`\`\``);
+});
+
+test("Generate a really big report and shrink it", () => {
+  const events = generateEvents(1000);
+
+  const originalLength = mermaidify(events, -1)!.length;
+  const limitedLengthZero = mermaidify(events, 0)!.length;
+  const limitedLengthOne = mermaidify(events, 1)!.length;
+  const limitedLengthTwo = mermaidify(events, 2)!.length;
+
+  expect(originalLength).greaterThan(limitedLengthZero);
+  expect(limitedLengthZero).greaterThan(limitedLengthOne);
+  expect(limitedLengthOne).greaterThan(limitedLengthTwo);
+});
+
+test("Really long builds get multi-unit timestamps", () => {
+  const { events } = parseEvents([
+    {
+      v: "1",
+      c: "BuiltPathResponseEventV1",
+      drv: "/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-0.drv",
+      outputs: ["/nix/store/qwlgz5da3pfb53gqpgdmazaj9jczrnly-dep-0"],
+      timing: {
+        startTime: "2025-04-11T14:38:02Z",
+        stopTime: "2026-05-14T13:32:01Z",
+        durationSeconds: 34383239,
+      },
+    },
+  ]);
+
+  expect(mermaidify(events, -1)).toStrictEqual(`\`\`\`mermaid
+gantt
+    dateFormat X
+    axisFormat %Mm%Ss
+/nix/store/rz9hrpay90sjrid5hx3x8v606ji679xa-dep-0.drv (573053m59s):d, 0, 34383239s
+\`\`\``);
+});

src/mermaid.ts

@@ -0,0 +1,96 @@
+import { DEvent } from "./events.js";
+import { truncateDerivation } from "./util.js";
+
+export function makeMermaidReport(events: DEvent[]): string | undefined {
+  // # 50k is the max: https://github.com/mermaid-js/mermaid/blob/c269dc822c528e1afbde34e18a1cad03d972d4fe/src/defaultConfig.js#L55
+  const maxLength = 49900;
+  let mermaid = "";
+  let pruneLevel = -2;
+
+  do {
+    pruneLevel += 1;
+    mermaid = mermaidify(events, pruneLevel) ?? "";
+  } while (mermaid.length > maxLength);
+
+  if (!mermaid) {
+    return undefined;
+  }
+
+  const lines = [
+    "<details open><summary><strong>Build timeline</strong> :hourglass_flowing_sand:</summary>",
+    "", // load bearing whitespace, deleting it breaks the details expander / markdown
+    mermaid,
+    "", // load bearing whitespace, deleting it breaks the details expander / markdown
+  ];
+
+  if (pruneLevel === 0) {
+    lines.push("> [!NOTE]");
+    lines.push(
+      "> `/nix/store/[hash]` and the `.drv` suffixes have been removed to make the graph small enough to render.",
+    );
+  } else if (pruneLevel > 0) {
+    lines.push("> [!NOTE]");
+    lines.push(
+      `> \`/nix/store/[hash]\`, the \`.drv\` suffix, and builds that took less than ${formatDuration(pruneLevel)} have been removed to make the graph small enough to render.`,
+    );
+  }
+
+  lines.push(""); // load bearing whitespace, deleting it breaks the details expander / markdown
+  lines.push("</details>");
+
+  return lines.join("\n");
+}
+
+export function mermaidify(
+  allEvents: DEvent[],
+  pruneLevel: number,
+): string | undefined {
+  const events = allEvents
+    .filter(
+      (event) =>
+        event.c === "BuiltPathResponseEventV1" ||
+        event.c === "BuildFailureResponseEventV1",
+    )
+    .sort(
+      (a, b) => a.timing.startTime.getTime() - b.timing.startTime.getTime(),
+    );
+
+  const firstEvent = events.at(0);
+  if (firstEvent === undefined) {
+    return undefined;
+  }
+
+  const zeroMoment = firstEvent.timing.startTime.getTime();
+
+  const lines = [
+    "```mermaid",
+    "gantt",
+    "    dateFormat X",
+    "    axisFormat %Mm%Ss",
+  ];
+
+  for (const event of events) {
+    const duration = event.timing.durationSeconds;
+    if (duration < pruneLevel) {
+      continue;
+    }
+
+    const label = pruneLevel >= 0 ? truncateDerivation(event.drv) : event.drv;
+    const tag = event.c === "BuildFailureResponseEventV1" ? "crit" : "d";
+    const relativeStartTime =
+      (event.timing.startTime.getTime() - zeroMoment) / 1000;
+
+    lines.push(
+      `${label} (${formatDuration(duration)}):${tag}, ${relativeStartTime}, ${duration}s`,
+    );
+  }
+  lines.push("```");
+
+  return lines.join("\n");
+}
+
+function formatDuration(duration: number): string {
+  const durSeconds = duration % 60;
+  const durMinutes = (duration - durSeconds) / 60;
+  return `${durMinutes > 0 ? `${durMinutes}m` : ""}${durSeconds}s`;
+}

src/util.ts

@@ -0,0 +1,3 @@
+export function truncateDerivation(drv: string): string {
+  return drv.replace(/^\/nix\/store\/[a-z0-9]+-/, "").replace(/\.drv$/, "");
+}

tsconfig.json

@@ -1,15 +1,15 @@
 {
-    "compilerOptions": {
-        "target": "es6", /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-        "module": "commonjs", /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
-        "outDir": "./lib", /* Redirect output structure to the directory. */
-        "rootDir": "./src", /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
-        "strict": true, /* Enable all strict type-checking options. */
-        "noImplicitAny": true, /* Raise error on expressions and declarations with an implied 'any' type. */
-        "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
-    },
-    "exclude": [
-        "node_modules",
-        "**/*.test.ts"
-    ]
-}
+  "compilerOptions": {
+    "target": "ES2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "module": "Node16",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true /* Enable all strict type-checking options. */,
+    "noImplicitAny": true /* Raise error on expressions and declarations with an implied 'any' type. */,
+    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
+    "resolveJsonModule": true,
+    "declaration": true
+  },
+  "exclude": ["node_modules", "dist"]
+}

tsup.config.ts

@@ -0,0 +1,15 @@
+import { defineConfig } from "tsup";
+import { name } from "./package.json";
+
+export default defineConfig({
+  name,
+  entry: ["src/index.ts"],
+  format: ["esm"],
+  target: "node20",
+  bundle: true,
+  splitting: false,
+  clean: true,
+  dts: {
+    resolve: true,
+  },
+});