ci: Replace magic-nix-cache actions with cache-nix-action

magic-nix-cache runs into GH rate limit easily, and ec2 instance somehow
cannot restore magic-nix-cache.

cache-nix-action would save a whole nix shell in GH cache, which can be
sharable between branches, thus speeding up CI.

Hash of nix files is used as cache suffix, so that cache sharing between
branch should be safe

'-multi' suffix for cache prefix is added if installed in multi-user
mode, to avoid cache pollution

Signed-off-by: Thing-han, Lim <[email protected]>

.github/actions/bench/action.yml

@@ -34,7 +34,7 @@ inputs:
     default: "ci"
   nix-cache:
     description: Determine whether to enable nix cache
-    default: 'true'
+    default: 'false'
   nix-verbose:
     description: Determine wether to suppress nix log or not
     default: 'false'

.github/actions/functest/action.yml

@@ -9,7 +9,7 @@ inputs:
     default: "ci"
   nix-cache:
     description: Determine whether to enable nix cache
-    default: 'true'
+    default: 'false'
   nix-verbose:
     description: Determine wether to suppress nix log or not
     default: 'false'

.github/actions/multi-functest/action.yml

@@ -12,7 +12,7 @@ inputs:
     default: "bash"
   nix-cache:
     description: Determine whether to enable nix cache
-    default: 'true'
+    default: 'false'
   nix-verbose:
     description: Determine wether to suppress nix log or not
     default: 'false'

.github/actions/setup-nix/action.yml

@@ -12,10 +12,17 @@ inputs:
     required: true
   cache:
     description: Determine whether to enable nix cache
-    default: 'true'
+    default: 'false'
   verbose:
     description: Determine wether to suppress nix log or not
     default: 'false'
+  cache_prefix:
+    description: Fixed prefix of ID of Github cache entries that should be removed.
+    required: false
+  purge_cache:
+    description: Determine whether to purge cache with primary key or not
+    required: false
+    default: 'true'
 
 runs:
   using: composite
@@ -69,6 +76,26 @@ runs:
         EOF
         fi
 
+        if [[ ! -z $GH_TOKEN ]]; then
+           mkdir -p ~/.config/nix
+           echo "access-tokens = github.com=$GH_TOKEN" > ~/.config/nix/nix.conf
+        fi
+
+        if command -v gh >/dev/null 2>&1; then
+          limit=$(gh api rate_limit --jq '.rate.remaining')
+          reset=$(gh api rate_limit --jq '.rate.reset')
+          now=$(date +%s)
+          if [[ $limit < 10 ]]; then
+            wait=$(( reset - now ))
+            echo "Rate limit remaining is $limit less then 10, waiting for $wait secs to retry"
+            sleep $wait
+          else
+            echo "Rate limit remaining is $limit greater than 10, no need to wait"
+          fi
+        else
+            echo "GitHub CLI is not installed."
+        fi
+
         if [[ $NIX_INSTALL_MODE == 'multi' ]]; then
           . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
         else
@@ -78,19 +105,49 @@ runs:
         nix profile install nixpkgs/nixos-24.05#sqlite
         echo "::endgroup::"
     - name: Post-check nix
+      id: nix-post-check
       continue-on-error: true
       shell: bash -lo pipefail {0}
       run: |
+        echo "::group::nix config"
+        if [[ -z "${{ inputs.cache_prefix }}" ]]; then
+          cache_prefix="${{ runner.os }}-${{ runner.arch }}-${{ inputs.devShell }}"
+        else
+          cache_prefix="${{ inputs.cache_prefix }}"
+        fi
+        if [[ ! -z $NIX_INSTALL_MODE ]]; then
+          cache_prefix="$cache_prefix-$NIX_INSTALL_MODE"
+        fi
+
+        echo "cache_prefix=$cache_prefix" >> $GITHUB_OUTPUT
+
         nix config check
-    - uses: DeterminateSystems/magic-nix-cache-action@v8
-      if: ${{ env.NIX_SHELL == '' && inputs.cache == 'true' }}
+        nix config show
+        echo "::endgroup::"
+    - uses: nix-community/cache-nix-action@v5
+      id: cache
+      if: ${{ env.NIX_CACHE_ENABLED != 1 && inputs.cache == 'true' }}
       continue-on-error: true
+      with:
+        primary-key: ${{ steps.nix-post-check.outputs.cache_prefix }}-${{ hashFiles('**/*.nix') }}
+        restore-prefixes-first-match: ${{ steps.nix-post-check.outputs.cache_prefix }}
+        gc-max-store-size-linux: 536870912
+        purge: ${{ inputs.purge_cache == 'true' }}
+        purge-prefixes: cache-${{ steps.nix-post-check.outputs.cache_prefix }}
+        purge-created: 0
+        purge-primary-key: ${{ inputs.purge_cache == 'true' && 'always' || 'never' }}
     - name: Set Shell
       shell: bash -lo pipefail {0}
       run: |
+        echo "::group::set nix shell"
+        if [[ "${{ steps.cache.outputs.hit-primary-key }}" == "true" ]]; then
+          echo NIX_CACHE_ENABLED=1 >> $GITHUB_ENV
+        fi
+
         echo NIX_SHELL="${{ inputs.devShell }}" >> $GITHUB_ENV
         nix_extra_flags="${{ inputs.verbose == 'false' && '--quiet' || '' }}"
         echo SHELL="$(which nix) develop $nix_extra_flags .#${{ inputs.devShell }} -c bash -e {0}" >> $GITHUB_ENV
+        echo "::endgroup::"
     - name: Prepare nix dev shell
       shell: ${{ env.SHELL }}
       run: |

.github/actions/setup-shell/action.yml

@@ -9,7 +9,7 @@ inputs:
     default: 'ci'
   nix-cache:
     description: Determine whether to enable nix cache
-    default: 'true'
+    default: 'false'
   nix-verbose:
     description: Determine wether to suppress nix log or not
     default: 'false'

.github/workflows/bench.yml

@@ -44,7 +44,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/bench
         with:
-          nix-cache: false
           name: ${{ matrix.target.name }}
           cflags: ${{ matrix.target.cflags }}
           archflags: ${{ matrix.target.archflags }}

.github/workflows/bench_ec2_reusable.yml

@@ -111,7 +111,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/bench
         with:
-          nix-cache: false
           nix-verbose: ${{ inputs.verbose }}
           name: ${{ inputs.name }}
           cflags: ${{ inputs.cflags }}

.github/workflows/ci.yml

@@ -91,6 +91,7 @@ jobs:
         uses: ./.github/actions/multi-functest
         with:
           nix-shell: ci-cross
+          nix-cache: true
           compile_mode: cross
           func: false
           nistkat: false

.github/workflows/ci_ec2_reusable.yml

@@ -106,10 +106,16 @@ jobs:
     runs-on: ${{ needs.start-ec2-runner.outputs.label }}
     steps:
       - uses: actions/checkout@v4
+      - name: Preprocess
+        id: preprocess
+        shell: bash
+        run: |
+          echo "nix-shell=${{ inputs.cbmc && 'ci-cbmc' || 'ci' }}${{ inputs.compile_mode == 'cross' && '-cross' || '' }}" >> $GITHUB_OUTPUT
       - name: Functional Tests
         uses: ./.github/actions/multi-functest
         with:
-          nix-cache: false
+          nix-shell: ${{ steps.preprocess.outputs.nix-shell }}
+          nix-cache: ${{ inputs.cbmc || inputs.compile_mode == 'cross' }}
           nix-verbose: ${{ inputs.verbose }}
           cflags: ${{ inputs.cflags }}
           compile_mode: ${{ inputs.compile_mode }}
@@ -122,13 +128,12 @@ jobs:
         uses: ./.github/actions/lint
         with:
           nix-shell: ci-linter
-          nix-cache: false
           nix-verbose: ${{ inputs.verbose }}
       - name: CBMC
         if: ${{ inputs.cbmc && (success() || failure()) }}
         uses: ./.github/actions/cbmc
         with:
-          nix-shell: ci-cbmc
+          nix-shell: ${{ steps.preprocess.outputs.nix-shell }}
           nix-verbose: ${{ inputs.verbose }}
   stop-ec2-runner:
     name: Stop ${{ inputs.name }} (${{ inputs.ec2_instance_type }})