Nix workflow (onekey-sec/unblob)

The Nix workflow from onekey-sec/unblob, explained and optimized by Latchkey.

CI health: C - fair

Run this on Latchkey for self-healing, caching, and up to 58% lower cost.

Grade your own workflow free or run it on Latchkey →

Source: onekey-sec/unblob.github/workflows/build-nix.ymlLicense MITView source

What it does

This is the Nix workflow from the onekey-sec/unblob repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: "Nix"
on:
  pull_request:
  merge_group:
  push:
    branches:
      - main
permissions:
  contents: read

jobs:
  build:
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            arch: x86_64-linux
          - os: ubuntu-24.04-arm
            arch: aarch64-linux
          - os: macos-15-intel
            arch: x86_64-darwin
          - os: macos-15
            arch: aarch64-darwin
    name: Build Nix - ${{ matrix.arch }}.${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Setup git lfs
        uses: ./.github/actions/setup-git-lfs
      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
        with:
          install_url: https://releases.nixos.org/nix/nix-2.18.8/install
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: unblob
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: pyperscan
      - run: |
          nix flake check -L

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: "Nix"
on:
  pull_request:
  merge_group:
  push:
    branches:
      - main
permissions:
  contents: read
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  build:
    timeout-minutes: 30
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            arch: x86_64-linux
          - os: ubuntu-24.04-arm
            arch: aarch64-linux
          - os: macos-15-intel
            arch: x86_64-darwin
          - os: macos-15
            arch: aarch64-darwin
    name: Build Nix - ${{ matrix.arch }}.${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Setup git lfs
        uses: ./.github/actions/setup-git-lfs
      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
        with:
          install_url: https://releases.nixos.org/nix/nix-2.18.8/install
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: unblob
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
          extraPullNames: pyperscan
      - run: |
          nix flake check -L

What changed

Cancel superseded runs when a branch or PR gets a newer push.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout