Determinate is the best way to use Nix on macOS, WSL, and Linux. It is an end-to-end toolchain for using Nix, from installation to collaboration to deployment.
Based on the Determinate Nix Installer and its corresponding Nix Installer Action, responsible for over tens of thousands of Nix installs daily.
Note
Why a different Action?
We created a new Action to synchronize version tags to Determinate Nix releases.
GitHub Actions are tagged with the specific version, like v3.5.2, with a moving v3 tag for the major version.
We needed a fresh tag namespace since nix-installer-action already has a v3 tag.
- ⚡ Accelerated KVM on open source projects and larger runners. See GitHub's announcement for more info.
- 🐧 Linux, x86_64, aarch64, and i686
- 🍏 macOS, x86_64 and aarch64
- 🪟 WSL2, x86_64 and aarch64
- 🐋 Containers, ARC, and Act
- 🐙 GitHub Enterprise Server
- 💁 GitHub Hosted, self-hosted, and long running Actions Runners
Here's an example Actions workflow configuration that uses determinate-nix-action:
on:
pull_request:
push:
branches: [main]
jobs:
build-pkg:
name: Build Nix package
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- uses: actions/checkout@v4.2.2
- uses: DeterminateSystems/determinate-nix-action@main # or v3.6.1 to pin to a release
- run: nix build .Important
If you use FlakeHub, you need to add a permissions block like the one in the example above or else Determinate Nix can't authenticate with FlakeHub or FlakeHub Cache.
Unlike DeterminateSystems/nix-installer-action, we fully support explicit version pinning for maximum consistency.
This Action is automatically tagged for every Determinate Nix release, giving you complete control over your CI environment:
📍 Pinning to DeterminateSystems/determinate-nix-action@v3.6.1 guarantees:
- Same
nix-installer-actionrevision every time - Consistent Determinate Nix v3.6.1 installation
- Reproducible CI workflows, even years later
✨ Using @main instead? You'll:
- Always get the latest Determinate Nix release
- Occasionally participate in phased rollouts (helping us test new releases!)
Important
Set up Dependabot to stay current with Determinate Nix releases without sacrificing stability.
Keep your GitHub Actions fresh without manual work! Create .github/dependabot.yml with:
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly| Parameter | Description | Required | Default |
|---|---|---|---|
extra-conf |
Extra configuration lines for /etc/nix/nix.conf (includes access-tokens with secrets.GITHUB_TOKEN automatically if github-token is set) |
||
github-server-url |
The URL for the GitHub server, to use with the github-token token. Defaults to the current GitHub server, supporting GitHub Enterprise Server automatically. Only change this value if the provided github-token is for a different GitHub server than the current server. |
${{ github.server_url }} |
|
github-token |
A GitHub token for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests) | ${{ github.token }} |
|
trust-runner-user |
Whether to make the runner user trusted by the Nix daemon | true |
|
force-no-systemd |
Force using other methods than systemd to launch the daemon. This setting is automatically enabled when necessary. | false |
|
init |
The init system to configure, requires planner: linux-multi (allowing the choice between none or systemd) |
||
kvm |
Automatically configure the GitHub Actions Runner for NixOS test supports, if the host supports it. | true |
|
planner |
A planner to use | ||
proxy |
The proxy to use (if any), valid proxy bases are https://$URL, http://$URL and socks5://$URL |
||
reinstall |
Force a reinstall if an existing installation is detected (consider backing up /nix/store) |
false |
|
source-binary |
Run a version of the nix-installer binary from somewhere already on disk. Conflicts with all other source-* options. Intended only for testing this Action. |
||
source-branch |
The branch of nix-installer to use (conflicts with source-tag, source-revision, source-pr) |
||
source-pr |
The PR of nix-installer to use (conflicts with source-tag, source-revision, source-branch) |
||
source-revision |
The revision of nix-installer to use (conflicts with source-tag, source-branch, source-pr) |
||
source-tag |
The tag of nix-installer to use (conflicts with source-revision, source-branch, source-pr) |
v3.6.1 |
|
source-url |
A URL pointing to a nix-installer executable |
||
backtrace |
The setting for RUST_BACKTRACE (see https://doc.rust-lang.org/std/backtrace/index.html#environment-variables) |
||
diagnostic-endpoint |
Diagnostic endpoint url where the installer sends data to. To disable set this to an empty string. | - |
|
log-directives |
A list of Tracing directives, comma separated, -s replaced with _ (eg. nix_installer=trace, see https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#directives) |
||
logger |
The logger to use for install (eg. pretty, json, full, compact) |
||
_internal-strict-mode |
Whether to fail when any errors are thrown. Used only to test the Action; do not set this in your own workflows. | false |
We're committed to making your experience with Determinate Nix as smooth as possible. If you encounter any issues or have questions, here's how to reach us:
- 🐛 Found a bug? Open an issue on GitHub
- 💬 Want to chat? Join our Discord community for quick help and discussions
- 📧 Need direct support? Email us at support@determinate.systems
🤝 Looking for enterprise support? We offer dedicated support contracts and shared Slack channels for organizations requiring priority assistance. Contact us to learn more.