From 0edbcf547564aa99c0450f94f24b6ce309e57250 Mon Sep 17 00:00:00 2001 From: risk-alt Date: Mon, 10 Aug 2026 14:41:12 +0200 Subject: [PATCH] ci: skip the binary cache setup when credentials are unavailable GitHub does not expose repository secrets to workflows triggered by a pull request opened from a fork. The three inputs given to the cache action are then empty strings, and the S3 store rejects every request: post-build-hook: error: AWS error fetching 'nix-cache-info': Unable to parse ExceptionName: InvalidRequest Message: Invalid Request. error: program '.../post-build-hook' failed with exit code 123 The failure comes from the upload hook rather than from the build itself, so the test suite reports a failure even though the derivations built fine. Every pull request coming from a fork has been affected. Guard the cache setup on the presence of the credentials. Internal branches and pushes to main keep reading from and writing to the cache, while forks build against cache.nixos.org alone and report the actual result of the test suite. --- .github/workflows/securix-testsuite.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/securix-testsuite.yaml b/.github/workflows/securix-testsuite.yaml index 9551cf9f..17972b81 100644 --- a/.github/workflows/securix-testsuite.yaml +++ b/.github/workflows/securix-testsuite.yaml @@ -1,10 +1,16 @@ jobs: tests: runs-on: ubuntu-latest + # Secrets are not exposed to workflows triggered by a pull request opened + # from a fork. Without credentials, every request to the S3 substituter is + # rejected, so the cache is only configured when they are available. + env: + HAS_CACHE_CREDENTIALS: ${{ secrets.AWS_ACCESS_KEY_ID != '' && secrets.AWS_SECRET_KEY != '' && secrets.NIX_SIGNING_PRIVATE_KEY != '' }} steps: - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - uses: samueldr/lix-gha-installer-action@f526e761e1ad201b0f4231f61a2a569f17bcc2ac # main - uses: zombiezen/setup-nix-cache-action@cacc7abf0a6636b0ef45ec2ae055a9734cdd4122 # main + if: env.HAS_CACHE_CREDENTIALS == 'true' with: substituters: s3://oss-securix?endpoint=https://s3.gra.io.cloud.ovh.net®ion=gra&compression=xz¶llel-compression=true secret_keys: ${{ secrets.NIX_SIGNING_PRIVATE_KEY }}