A GitHub Action to restore and save Nix store paths using GitHub Actions cache.
This action is based on actions/cache.
- Restore and save the Nix store on
LinuxandmacOSrunners. - Restore and save other directories on
Linux,macOS, andWindowsrunners. - Collect garbage in the Nix store before saving a new cache.
- Merge caches produced by several jobs.
- Purge caches created or last accessed at least the given time ago.
Note
Inputs are given for reference. All available inputs are specified below.
-
The nix-quick-install-action installs Nix in single-user mode.
-
Restorephase:[!NOTE] For a cache to be restored in the current step,
pathsused to create that cache must be the same as thepathsspecified in the current step.-
The
cache-nix-actiontries to restore a cache whose key is the same as the specified one (inputs:primary-key,paths). -
When it can't restore, the
cache-nix-actiontries to restore a cache whose key matches a prefix in a given list of key prefixes (inputs:restore-prefixes-first-match,paths). -
The
cache-nix-actionrestores all caches whose keys match some of the prefixes in another given list of key prefixes (inputs:restore-prefixes-all-matches,paths).
-
-
Other job steps run.
-
Post Restorephase:-
The
cache-nix-actionpurges caches whose keys are the same as the primary key and that were created or last accessed more than a given time ago (inputs:purge,purge-created,purge-last-accessed,purge-primary-key). -
When there's no cache whose key is the same as the primary key, the
cache-nix-actioncollects garbage in the Nix store and saves a new cache (inputs:save,gc-max-store-size,gc-max-store-size-linux,gc-max-store-size-macos). -
The
cache-nix-actionpurges caches whose keys match some of the given prefixes in a given list of key prefixes and that were created or last accessed more than a given time ago relative to the start of thePost Restorephase (purge,purge-prefixes,purge-created,purge-last-accessed,purge-primary-key).
-
- Uses experimental nix commands like nix store gc and nix path-info.
- By default, the action caches and restores only
/nix,~/.cache/nix,~root/.cache/nix(see documentation for thepathsinput).- The action doesn't automatically cache stores specified via the
--storeflag (link). - When restoring a cache, the action doesn't extract from the cache the
/nix/storepaths that already exist on the runner. - Additionally, the action unarchives only the
/nix/var/nix/db/db.sqliteand skips other cached/nix/vardirectories. - The action merges existing and new databases when restoring a cache.
- The action doesn't automatically cache stores specified via the
- The action requires nix-quick-install-action.
- The action supports only
LinuxandmacOSrunners for Nix store caching. - The action purges caches scoped to the current GITHUB_REF.
- The action purges caches by keys without considering cache versions (see Cache version).
GitHuballows only10GBof caches and then removes the least recently used entries (see its eviction policy). Workarounds:- The Nix store size is limited by a runner storage size (link). Workarounds:
- Ubuntu, macOS, Windows:
- Ubuntu, macOS:
- Ubuntu:
- jlumbroso/free-disk-space
- endersonmenezes/free-disk-space
- easimon/maximize-build-space
- AdityaGarg8/remove-unwanted-software,gmij/max-build-space
- firus-v/free-disk-space
- coder-xiaomo/free-disk-space
- data-intuitive/reclaim-the-bytes
- laverdet/remove-bloatware
- xd009642/ci-hoover
- justinthelaw/maximize-github-runner-space
- macOS:
- Caches are isolated for restoring between refs (link).
- Workaround: provide caches for PRs on default or base branches.
- Garbage collection by default evicts flake inputs (issue).
- Workaround: save the flake closure as an installable (link).
See Caching Approaches.
Note
For purging, the workflow or the job must have the permission actions: write.
Note
If the paths input is specified, the action will be able to restore only caches created with the same paths.
- uses: nixbuild/nix-quick-install-action@v30
with:
nix_conf: |
keep-env-derivations = true
keep-outputs = true
- name: Restore and save Nix store
uses: nix-community/cache-nix-action@v6
with:
# restore and save a cache using this key
primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
# if there's no cache hit, restore a cache by this prefix
restore-prefixes-first-match: nix-${{ runner.os }}-
# collect garbage until the Nix store size (in bytes) is at most this number
# before trying to save a new cache
# 1G = 1073741824
gc-max-store-size-linux: 1G
# do purge caches
purge: true
# purge all versions of the cache
purge-prefixes: nix-${{ runner.os }}-
# created more than this number of seconds ago
purge-created: 0
# or, last accessed more than this number of seconds ago
# relative to the start of the `Post Restore and save Nix store` phase
purge-last-accessed: 0
# except any version with the key that is the same as the `primary-key`
purge-primary-key: nevernix-quick-install-actionwrites the supplied nix_conf to nix.conf (see action.yml, script).nix-quick-install-actionenables flakes and acceptsnixConfigfromflake.nix(see script).- Due to
gc-max-store-size-linux: 1G, onLinuxrunners, garbage in the Nix store is collected until the store size reaches1GBor until there's no garbage to collect. - Since
gc-max-store-size-macosisn't set to a number, onmacOSrunners, no garbage is collected in the Nix store. - At the end of the job, and before trying to save a new cache, the
cache-nix-actionpurges caches:- (with the key prefix
nix-${{ runner.os }}-) AND (created more than0seconds ago OR last accessed more than0seconds ago).
- (with the key prefix
See Always save cache.
See Merge caches, Example cache workflow, Caching Strategies.
- Use action-tmate to connect to the runner via SSH.
- Use action-debug-vscode to run a browser VSCode on the runner.
See action.yml.
| name | description | required | default |
|---|---|---|---|
primary-key |
|
true |
"" |
restore-prefixes-first-match |
|
false |
"" |
restore-prefixes-all-matches |
|
false |
"" |
skip-restore-on-hit-primary-key |
|
false |
false |
fail-on |
|
false |
"" |
nix |
|
false |
true |
save |
|
false |
true |
paths |
|
false |
"" |
paths-macos |
|
false |
"" |
paths-linux |
|
false |
"" |
backend |
Choose an implementation of the
|
false |
actions |
gc-max-store-size |
|
false |
"" |
gc-max-store-size-macos |
|
false |
"" |
gc-max-store-size-linux |
|
false |
"" |
purge |
|
false |
false |
purge-primary-key |
|
false |
"" |
purge-prefixes |
|
false |
"" |
purge-last-accessed |
|
false |
"" |
purge-created |
|
false |
"" |
upload-chunk-size |
|
false |
"" |
token |
|
false |
${{ github.token }} |
| name | description |
|---|---|
primary-key |
|
hit |
|
hit-primary-key |
|
hit-first-match |
|
restored-key |
|
restored-keys |
|
The cache-nix-action allows to delete old caches after saving a new cache (see purge-* inputs in Inputs and the compare-run-times job in the Example workflow).
The purge-cache action allows to remove caches based on their last accessed or created time without branch limitations.
Alternatively, you can use the GitHub Actions Cache API.
GitHub evicts the least recently used caches when their total size exceeds 10GB (see Limitations).
If you have multiple similar caches produced on runners with the same OS (Linux or macOS), you can merge them into a single cache and store just it to save space.
In short:
- Matrix jobs produce similar individual caches.
- The next job restores all of these individual caches, saves a common cache, and purges individual caches.
- On subsequent runs, matrix jobs use the common cache.
See the make-similar-caches and merge-similar-caches jobs in the example workflow.
Pros: if N individual caches are very similar, a common cache will take approximately N times less space.
Cons: if caches aren't very similar, the run time may increase due to a bigger common cache.
When restoring a Nix store from a cache, the store may contain old unnecessary paths. These paths should be removed sometimes to limit cache size and ensure the fastest restore/save steps.
Produce a cache once, use it multiple times. Don't collect garbage.
Advantages:
- Unnecessary paths are saved to a cache only during a new save.
Disadvantages:
- Unnecessary paths can accumulate between new saves.
- A job at the firs run produces a path
Aand saves a cache. - The job at the second run restores the cache, produces a path
B, and saves a cache. The cache has bothAandB. - etc.
- A job at the firs run produces a path
Collect garbage before saving a cache.
Advantages:
- Automatically keep cache at a minimal/limited size
Disadvantages:
- No standard way to gc only old paths.
- GC by
atime: nix-heuristic-gc. - GC via gc roots: nix-cache-cut.
- GC based on time: cache-gc.
- Visualize GC roots: nix-du.
See examples/saveFromGC/flake.nix and saveFromGC.nix.
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
flake-utils = {
url = "github:numtide/flake-utils";
inputs.systems.follows = "systems";
};
cache-nix-action = {
url = "github:nix-community/cache-nix-action";
flake = false;
};
systems.url = "github:nix-systems/default";
};
outputs =
inputs:
inputs.flake-utils.lib.eachDefaultSystem (
system:
let
pkgs = inputs.nixpkgs.legacyPackages.${system};
packages = {
hello = pkgs.hello;
inherit
(import "${inputs.cache-nix-action}/saveFromGC.nix" {
inherit pkgs inputs;
inputsExclude = [
# the systems input will still be saved
# because flake-utils needs it
inputs.systems
];
derivations = [
packages.hello
devShells.default
];
paths = [ "${packages.hello}/bin/hello" ];
})
saveFromGC
;
};
devShells.default = pkgs.mkShell { buildInputs = [ pkgs.gcc ]; };
in
{
inherit packages devShells;
}
);
}Each profile is a garbage collection root.
Each nix build result symlink is a garbage collection root.
To save particular Nix store paths, create an installable that contains these paths and
- add it to a profile via
nix profile installor nix buildit
The saveFromGC attribute of the flake above is a script (an installable) that contains paths of elements of the flake closure (the flake itself, flake inputs, inputs of these inputs, etc.).
Enter the examples/saveFromGC directory.
cd examples/saveFromGCPrint the contents of saveFromGC.
cat $(nix build .#saveFromGC --no-link --print-out-paths)/bin/save-from-gc
closure
/nix/store/pj0rhk7zkfx82xsighf72v8x4rqldzgi-source
/nix/store/01x5k4nlxcpyd85nnr0b9gm89rm8ff4x-source
/nix/store/97hxap05brgklr57xh7qaab6s833rfg0-source
/nix/store/yj1wxm9hh8610iyzqnz75kvs6xl8j3my-source
derivations
/nix/store/p09fxxwkdj69hk4mgddk4r3nassiryzc-hello-2.12.1
/nix/store/54zp3xb1qgzy14pd7hi9spjxss437jwr-nix-shell
paths
/nix/store/p09fxxwkdj69hk4mgddk4r3nassiryzc-hello-2.12.1/bin/helloAdd the installable to the default profile.
nix profile remove examples/saveFromGC
nix profile install .#saveFromGC
nix profile list | grep save-from-gc
Store paths: /nix/store/bgd1sgyc8wy1i3msh0p2g1yl0iywp7ys-save-from-gcOr, build the installable and see the garbage collection roots that won't let it be garbage collected.
nix-store --query --roots $(nix build .#saveFromGC --print-out-paths)nix-store --query --roots resultOutput (edited):
...
<...>/.local/state/nix/profiles/profile-1-link -> /nix/store/pyvyymji6pvgify5gvnlvprlrxi42pdd-profile
<...>/cache-nix-action/examples/saveFromGC/result -> /nix/store/bgd1sgyc8wy1i3msh0p2g1yl0iywp7ys-save-from-gc- Run direnv in background.
Initially discussed here and here.
Caching approaches work at different "distances" from /nix/store of GitHub Actions runner.
These distances affect the restore and save speed.
Pros:
- Free.
- Easy to set up.
- Uses
GitHub Actions Cacheand works fast. - Doesn't require repository secrets.
- Allows to save a store of at most a given size (see Inputs).
- Allows to save outputs from garbage collection (see Garbage collection).
- When there's a cache hit, restoring from a GitHub Actions cache can be faster than downloading multiple paths from binary caches.
- You can compare run times of jobs with and without store caching in Actions.
- Open a run and click on the time under
Total duration.
- Open a run and click on the time under
- You can compare run times of jobs with and without store caching in Actions.
Cons: see Limitations
Pros (link):
- Free.
- Easy to set up.
- Uses
GitHub Actions Cacheand works fast. - Restores and saves paths selectively.
Cons:
- Collects telemetry (link)
- May trigger rate limit errors (link).
- Follows the GitHub Actions Cache semantics (link).
- Caches are isolated between branches (link).
- Saves a cache for each path in a store and quickly litters
Caches.
Pros (link):
- Free for one month with a coupon code (link).
- Easy to set up.
Cons:
- Not free (link)
If used with nix-quick-install-action, it's similar to the cache-nix-action.
If used with install-nix-action and a chroot local store:
Pros:
- Quick restore and save
/tmp/nix.
Cons:
- Slow nix copy from
/tmp/nixto/nix/store.
If used with install-nix-action and this trick, it's similar to the cache-nix-action, but slower (link).
See binary cache, HTTP Binary Cache Store.
Pros:
- Restore and save paths selectively.
- Provide least recently used garbage collection strategies (cachix, attic).
- Don't cache paths available from the NixOS cache (cachix).
- Allow to share paths between projects (cachix).
Cons:
- Have limited free storage (cachix gives 5GB for open-source projects).
- Need good bandwidth for receiving and pushing paths over the Internet.
- Can be down.
-
Clone the repository.
git clone --recurse-submodules https://github.com/nix-community/cache-nix-action -
Improve README.
-
Report errors, suggest improvements in issues.
-
Improve code.
- Read about JavaScript actions
- See main files:
-
Improve docs.
-
Edit action.nix.
-
Update
action.yml-s andREADME.md-s:nix run .#write
-
-
Update deps:
- Update the
actions-toolkitbranch that contains a patched version of actions/toolkit. - Update the
buildjet-toolkitbranch that contains a patched version of BuildJet/toolkit synchronized with actions/toolkit. - Update submodules for the mentioned branches on the
mainbranch.
- Update the
This action allows caching dependencies and build outputs to improve workflow execution time.
Two other actions are available in addition to the primary
cacheaction:
See "Caching dependencies to speed up workflows".
The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.
The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.
We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).
If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0
If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.
Upgrading to the recommended versions will not break your workflows.
Read more about the change & access the migration guide: reference to the announcement.
- Integrated with the new cache service (v2) APIs.
- Updated to node 20
- Integrated with the new cache service (v2) APIs.
- Added support for caching in GHES 3.5+.
- Fixed download issue for files > 2GB during restore.
- Updated the minimum runner version support from node 12 -> node 16.
- Fixed avoiding empty cache save when no files are available for caching.
- Fixed tar creation error while trying to create tar with path as
~/home folder onubuntu-latest. - Fixed zstd failing on amazon linux 2.0 runners.
- Fixed cache not working with github workspace directory or current directory.
- Fixed the download stuck problem by introducing a timeout of 1 hour for cache downloads.
- Fix zstd not working for windows on gnu tar in issues.
- Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable
SEGMENT_DOWNLOAD_TIMEOUT_MINS. Default is 10 minutes. - New actions are available for granular control over caches - restore and save.
- Support cross-os caching as an opt-in feature. See Cross OS caching for more info.
- Added option to fail job on cache miss. See Exit workflow on cache miss for more info.
- Fix zstd not being used after zstd version upgrade to 1.5.4 on hosted runners
- Added option to lookup cache without downloading it.
- Reduced segment size to 128MB and segment timeout to 10 minutes to fail fast in case the cache download is stuck.
See the v2 README.md for older updates.
Create a workflow .yml file in your repository's .github/workflows directory. An example workflow is available below. For more information, see the GitHub Help Documentation for Creating a workflow file.
If you are using this inside a container, a POSIX-compliant tar needs to be included and accessible from the execution path.
If you are using a self-hosted Windows runner, GNU tar and zstd are required for Cross-OS caching to work. They are also recommended to be installed in general so the performance is on par with hosted Windows runners.
SEGMENT_DOWNLOAD_TIMEOUT_MINS- Segment download timeout (in minutes, default10) to abort download of the segment if not completed in the defined number of minutes. Read more
The cache is scoped to the key, version, and branch. The default branch cache is available to other branches.
See Matching a cache key for more info.
name: Caching Primes
on: push
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Cache Primes
id: cache-primes
uses: nix-community/cache-nix-action@v6
with:
primary-key: ${{ runner.os }}-primes
paths: prime-numbers
- name: Generate Prime Numbers
if: steps.cache-primes.outputs.hit-primary-key != 'true'
run: /generate-primes.sh -d prime-numbers
- name: Use Prime Numbers
run: /primes.sh -d prime-numbersThe cache-nix-action provides the hit-primary-key output which is set to 'true' when the cache is restored using the primary-key and 'false' otherwise.
Note
The paths input in the cache-nix-action/restore and cache-nix-action/save must be the same.
name: Caching Primes
on: push
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Restore cached Primes
id: cache-primes-restore
uses: nix-community/cache-nix-action/restore@v6
with:
primary-key: ${{ runner.os }}-primes
paths: |
path/to/dependencies
some/other/dependencies
# other steps
- name: Save Primes
id: cache-primes-save
uses: nix-community/cache-nix-action/save@v6
with:
primary-key: ${{ steps.cache-primes-restore.outputs.cache-primary-key }}
paths: |
path/to/dependencies
some/other/dependenciesNote You must use the
cacheorrestoreaction in your workflow before you need to use the files that might be restored from the cache. If the providedprimary-keymatches an existing cache, a new cache is not created and if the providedprimary-keydoesn't match an existing cache, a new cache is automatically created provided the job completes successfully.
With the introduction of the restore and save actions, a lot of caching use cases can now be achieved. Please see the caching strategies document for understanding how you can use the actions strategically to achieve the desired goal.
Every programming language and framework has its own way of caching.
See Examples for a list of nix-community/cache-nix-action implementations for use with:
- Bun
- C# - NuGet
- Clojure - Lein Deps
- D - DUB
- Deno
- Elixir - Mix
- Go - Modules
- Haskell - Cabal
- Haskell - Stack
- Java - Gradle
- Java - Maven
- Node - npm
- Node - Lerna
- Node - Yarn
- OCaml/Reason - esy
- PHP - Composer
- Python - pip
- Python - pipenv
- R - renv
- Ruby - Bundler
- Rust - Cargo
- Scala - SBT
- Swift, Objective-C - Carthage
- Swift, Objective-C - CocoaPods
- Swift - Swift Package Manager
- Swift - Mint
A cache key can include any of the contexts, functions, literals, and operators supported by GitHub Actions.
For example, using the hashFiles function allows you to create a new cache when dependencies change.
- uses: nix-community/cache-nix-action@v6
with:
primary-key: ${{ runner.os }}-${{ hashFiles('**/lockfiles') }}
paths: |
path/to/dependencies
some/other/dependenciesAdditionally, you can use arbitrary command output in a cache key, such as a date or software version:
# http://man7.org/linux/man-pages/man1/date.1.html
- name: Get Date
id: get-date
run: echo "date=$(/bin/date -u "+%Y%m%d")" >> $GITHUB_OUTPUT
shell: bash
- uses: nix-community/cache-nix-action@v6
with:
primary-key: ${{ runner.os }}-${{ steps.get-date.outputs.date }}-${{ hashFiles('**/lockfiles') }}
paths: path/to/dependenciesSee Using contexts to create cache keys
A repository can have up to 10GB of caches. Once the 10GB limit is reached, older caches will be evicted based on when the cache was last accessed.
Caches that are not accessed within the last week will also be evicted.
Using the hit-primary-key output, subsequent steps (such as install or build) can be skipped when a cache hit occurs on the key.
It is recommended to install missing/updated dependencies in case of a partial key match when the key is dependent on the hash of the package file.
Example:
steps:
- uses: actions/checkout@v4
- uses: nix-community/cache-nix-action@v6
id: cache
with:
primary-key: ${{ runner.os }}-${{ hashFiles('**/lockfiles') }}
paths: path/to/dependencies
- name: Install Dependencies
if: steps.cache.outputs.hit-primary-key != 'true'
run: /install.shNote The
iddefined innix-community/cache-nix-actionmust match the[id]in theifstatement (i.e.steps.[id].outputs.hit-primary-key)
Cache version is a hash generated for a combination of compression tool used (Gzip, Zstd, etc. based on the runner OS) and the paths of directories being cached. If two caches have different versions, they are identified as unique caches while matching. This, for example, means that a cache created on a windows-latest runner can't be restored on ubuntu-latest as cache Versions are different.
Pro tip: The list caches API can be used to get the version of a cache. This can be helpful to troubleshoot cache miss due to version.
Example
The workflow will create 3 unique caches with same keys. Ubuntu and Windows runners will use different compression technique and hence create two different caches. And build-linux will create two different caches as the paths are different.
jobs:
build-linux:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Cache Primes
id: cache-primes
uses: nix-community/cache-nix-action@v6
with:
primary-key: primes
paths: prime-numbers
- name: Generate Prime Numbers
if: steps.cache-primes.outputs.hit-primary-key != 'true'
run: ./generate-primes.sh -d prime-numbers
- name: Cache Numbers
id: cache-numbers
uses: nix-community/cache-nix-action@v6
with:
primary-key: primes
paths: numbers
- name: Generate Numbers
if: steps.cache-numbers.outputs.hit-primary-key != 'true'
run: ./generate-primes.sh -d numbers
build-windows:
runs-on: windows-latest
steps:
- uses: actions/checkout@v4
- name: Cache Primes
id: cache-primes
uses: nix-community/cache-nix-action@v6
with:
primary-key: primes
paths: prime-numbers
- name: Generate Prime Numbers
if: steps.cache-primes.outputs.hit-primary-key != 'true'
run: ./generate-primes -d prime-numbersThere are a number of community practices/workarounds to fulfill specific requirements. You may choose to use them if they suit your use case. Note these are not necessarily the only solution or even a recommended solution.
- Cache segment restore timeout
- Update a cache
- Use cache across feature branches
- Cross OS cache
- Force deletion of caches overriding default cache eviction policy
Please note that Windows environment variables (like %LocalAppData%) will NOT be expanded by this action. Instead, prefer using ~ in your paths which will expand to the HOME directory. For example, instead of %LocalAppData%, use ~\AppData\Local. For a list of supported default environment variables, see the Learn GitHub Actions: Variables page.
We would love for you to contribute to nix-community/cache-nix-action. Pull requests are welcome! Please see the CONTRIBUTING.md for more information.
The scripts and documentation in this project are released under the MIT License