Matrix (#96)

* Update `detsys-ts` for: `Merge pull request #67 from DeterminateSystems/allow-obliterating-id-token-privs` (`4280bc94c9545f31ccf08001cc16f20ccb91b770`)

* Update the defaults / docs on the use-flakehub and use-gha-cache options

* Support the MNC trinary, to allow GHA cache to turn off if FHC is enabled

* let's go?

* arg, you can't parameterize the permissions

* don't fail fast

* Maybe if we bust the token sooner..?

* Clearer job names

* Debug...

* ?

* ...?

* ?

* fancy it up

* more seed

* Test against determinate too

* ...

* derp, obliterate

* Identify the failed-to-setup FHC as not being enabled

* Don't fail on github if the cache is throttled

* derp

* Add a success job for the ci workflow

---------

Co-authored-by: grahamc <76716+grahamc@users.noreply.github.com>

.github/workflows/cache-test.sh

@@ -3,39 +3,80 @@
 set -e
 set -ux
 
-seed=$(date)
+seed="$(date)-$RANDOM"
 
 log="${MAGIC_NIX_CACHE_DAEMONDIR}/daemon.log"
 
-binary_cache=https://cache.flakehub.com
+flakehub_binary_cache=https://cache.flakehub.com
+gha_binary_cache=http://127.0.0.1:37515
+
+is_gh_throttled() {
+  grep 'GitHub Actions Cache throttled Magic Nix Cache' "${log}"
+}
 
 # Check that the action initialized correctly.
-grep 'FlakeHub cache is enabled' "${log}"
+if [ "$EXPECT_FLAKEHUB" == "true" ]; then
-grep 'Using cache' "${log}"
+  grep 'FlakeHub cache is enabled' "${log}"
-grep 'GitHub Action cache is enabled' "${log}"
+  grep 'Using cache' "${log}"
+else
+  grep 'FlakeHub cache is disabled' "${log}" \
+  || grep 'FlakeHub cache initialization failed:' "${log}"
+fi
+
+if [ "$EXPECT_GITHUB_CACHE" == "true" ]; then
+  grep 'GitHub Action cache is enabled' "${log}"
+else
+  grep 'Native GitHub Action cache is disabled' "${log}"
+fi
 
 # Build something.
 outpath=$(nix-build .github/workflows/cache-tester.nix --argstr seed "$seed")
 
 # Wait until it has been pushed succesfully.
-found=
+if [ "$EXPECT_FLAKEHUB" == "true" ]; then
-for ((i = 0; i < 60; i++)); do
+  found=
+  for ((i = 0; i < 60; i++)); do
       sleep 1
       if grep "✅ $(basename "${outpath}")" "${log}"; then
           found=1
           break
       fi
-done
+  done
-if [[ -z $found ]]; then
+  if [[ -z $found ]]; then
       echo "FlakeHub push did not happen." >&2
       exit 1
+  fi
 fi
 
-# Check the FlakeHub binary cache to see if the path is really there.
+if [ "$EXPECT_GITHUB_CACHE" == "true" ]; then
-nix path-info --store "${binary_cache}" "${outpath}"
+  found=
+  for ((i = 0; i < 60; i++)); do
+      sleep 1
+      if grep "Uploaded '${outpath}' to the GitHub Action Cache" "${log}"; then
+          found=1
+          break
+      fi
+  done
+  if [[ -z $found ]]; then
+      echo "GitHub Actions Cache push did not happen." >&2
 
-# FIXME: remove this once the daemon also uploads to GHA automatically.
+      if ! is_gh_throttled; then
-nix copy --to 'http://127.0.0.1:37515' "${outpath}"
+        exit 1
+      fi
+  fi
+fi
+
+
+
+if [ "$EXPECT_FLAKEHUB" == "true" ]; then
+  # Check the FlakeHub binary cache to see if the path is really there.
+  nix path-info --store "${flakehub_binary_cache}" "${outpath}"
+fi
+
+if [ "$EXPECT_GITHUB_CACHE" == "true" ] && ! is_gh_throttled; then
+  # Check the GitHub binary cache to see if the path is really there.
+  nix path-info --store "${gha_binary_cache}" "${outpath}"
+fi
 
 rm ./result
 nix store delete "${outpath}"
@@ -50,4 +91,16 @@ echo "-------"
 echo "Trying to substitute the build again..."
 echo "if it fails, the cache is broken."
 
-nix-store --realize -vvvvvvvv "$outpath"
+if [ "$EXPECT_FLAKEHUB" == "true" ]; then
+  # Check the FlakeHub binary cache to see if the path is really there.
+  nix path-info --store "${flakehub_binary_cache}" "${outpath}"
+fi
+
+if [ "$EXPECT_GITHUB_CACHE" == "true" ] && ! is_gh_throttled; then
+  # Check the FlakeHub binary cache to see if the path is really there.
+  nix path-info --store "${gha_binary_cache}" "${outpath}"
+fi
+
+if ([ "$EXPECT_GITHUB_CACHE" == "true" ] && ! is_gh_throttled) || [ "$EXPECT_FLAKEHUB" == "true" ]; then
+  nix-store --realize -vvvvvvvv "$outpath"
+fi

.github/workflows/ci.yml

@@ -72,8 +72,9 @@ jobs:
           _internal-strict-mode: true
 
   run-systems:
+    if: github.event_name == 'merge_group'
     needs: build
-    name: "Run ${{ matrix.systems.nix-system }}"
+    name: "Test: ${{ matrix.systems.nix-system }} gha:${{matrix.use-gha-cache}},fhc:${{matrix.use-flakehub}},id:${{matrix.id-token}},determinate:${{matrix.determinate}}"
     runs-on: "${{ matrix.systems.runner }}"
     permissions:
       id-token: "write"
@@ -81,10 +82,15 @@ jobs:
     env:
       ACTIONS_STEP_DEBUG: true
     strategy:
+      fail-fast: false
       matrix:
+        determinate: [true, false]
+        use-gha-cache: ["disabled", "no-preference", "enabled"]
+        use-flakehub: ["disabled", "no-preference", "enabled"]
+        id-token: ["write", "none"]
         systems:
           - nix-system: "aarch64-darwin"
-            runner: "macos-latest-xlarge"
+            runner: "macos-latest"
           - nix-system: "x86_64-darwin"
             runner: "macos-13"
           - nix-system: "aarch64-linux"
@@ -93,20 +99,41 @@ jobs:
             runner: "ubuntu-22.04"
     steps:
       - uses: actions/checkout@v4
-        if: github.event_name == 'merge_group'
       - name: Install Nix on ${{ matrix.systems.nix-system }} system
-        if: github.event_name == 'merge_group'
         uses: DeterminateSystems/nix-installer-action@main
         with:
-          flakehub: true
+          _internal-obliterate-actions-id-token-request-variables: ${{ matrix.id-token == 'none' }}
+          determinate: ${{ matrix.determinate }}
           extra-conf: |
             narinfo-cache-negative-ttl = 0
       - name: Cache the store
-        if: github.event_name == 'merge_group'
         uses: ./
         with:
           _internal-strict-mode: true
+          _internal-obliterate-actions-id-token-request-variables: ${{ matrix.id-token == 'none' }}
+          use-gha-cache: ${{ matrix.use-gha-cache }}
+          use-flakehub: ${{ matrix.use-flakehub }}
       - name: Check the cache for liveness
-        if: github.event_name == 'merge_group'
+        env:
+          EXPECT_FLAKEHUB: ${{ toJson(matrix.use-flakehub != 'disabled' && matrix.id-token == 'write') }}
+          EXPECT_GITHUB_CACHE: ${{ toJson(
+            (matrix.use-gha-cache != 'disabled')
+            && (
+            (!(matrix.use-flakehub != 'disabled' && matrix.id-token == 'write'))
+            || (matrix.use-gha-cache == 'enabled')
+            )
+            ) }}
         run: |
           .github/workflows/cache-test.sh
+
+  success:
+    runs-on: ubuntu-latest
+    needs: run-systems
+    steps:
+      - run: "true"
+      - run: |
+          echo "A dependent in the build matrix failed."
+          exit 1
+        if: |
+          contains(needs.*.result, 'failure') ||
+          contains(needs.*.result, 'cancelled')

action.yml

@@ -5,8 +5,12 @@ branding:
 description: "Free, no-configuration Nix cache. Cut CI time by 50% or more by caching to GitHub Actions' cache."
 inputs:
   use-gha-cache:
-    description: "Whether to upload build results to the GitHub Actions cache."
+    description: |
-    default: true
+      Whether to upload build results to the Github Actions cache.
+      Set to "no-preference" or null to have the GitHub Actions cache turn on if it is available, and FlakeHub Cache is not available (default).
+      Set to "enabled" or true to explicitly request the GitHub Actions Cache.
+      Set to "disabled" or false to explicitly disable the GitHub Actions Cache.
+    default: null
     required: false
   listen:
     description: The host and port to listen on.
@@ -18,8 +22,12 @@ inputs:
     description: "Diagnostic endpoint url where diagnostics and performance data is sent. To disable set this to an empty string."
     default: "-"
   use-flakehub:
-    description: "Whether to upload build results to FlakeHub Cache."
+    description: |
-    default: true
+      Whether to upload build results to FlakeHub Cache.
+      Set to "no-preference" or null to have FlakeHub Cache turn on opportunistically (default).
+      Set to "enabled" or true to explicitly request FlakeHub Cache.
+      Set to "disabled" or false to explicitly disable FlakeHub Cache.
+    default: null
     required: false
   flakehub-cache-server:
     description: "The FlakeHub binary cache server."

pnpm-lock.yaml

@@ -13,7 +13,7 @@ dependencies:
     version: 1.1.1
   detsys-ts:
     specifier: github:DeterminateSystems/detsys-ts
-    version: github.com/DeterminateSystems/detsys-ts/65dd73c562ac60a068340f8e0c040bdcf2c59afe
+    version: github.com/DeterminateSystems/detsys-ts/4280bc94c9545f31ccf08001cc16f20ccb91b770
   got:
     specifier: ^14.4.2
     version: 14.4.2
@@ -67,19 +67,18 @@ devDependencies:
 
 packages:
 
-  /@actions/cache@3.2.4:
+  /@actions/cache@3.3.0:
-    resolution: {integrity: sha512-RuHnwfcDagtX+37s0ZWy7clbOfnZ7AlDJQ7k/9rzt2W4Gnwde3fa/qjSjVuz4vLcLIpc7fUob27CMrqiWZytYA==}
+    resolution: {integrity: sha512-+eCsMTIZUEm+QA9GqjollOhCdvRrZ1JV8d9Rp34zVNizBkYITO8dhKczP5Xps1dFzc5n59p7vYVtZrGt18bb5Q==}
     dependencies:
-      '@actions/core': 1.10.1
+      '@actions/core': 1.11.1
       '@actions/exec': 1.1.1
       '@actions/glob': 0.1.2
       '@actions/http-client': 2.2.3
       '@actions/io': 1.1.3
       '@azure/abort-controller': 1.1.0
       '@azure/ms-rest-js': 2.7.0
-      '@azure/storage-blob': 12.24.0
+      '@azure/storage-blob': 12.25.0
       semver: 6.3.1
-      uuid: 3.4.0
     transitivePeerDependencies:
       - encoding
       - supports-color
@@ -92,6 +91,13 @@ packages:
       uuid: 8.3.2
     dev: false
 
+  /@actions/core@1.11.1:
+    resolution: {integrity: sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==}
+    dependencies:
+      '@actions/exec': 1.1.1
+      '@actions/http-client': 2.2.3
+    dev: false
+
   /@actions/exec@1.1.1:
     resolution: {integrity: sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==}
     dependencies:
@@ -127,23 +133,23 @@ packages:
     resolution: {integrity: sha512-TrRLIoSQVzfAJX9H1JeFjzAoDGcoK1IYX1UImfceTZpsyYfWr09Ss1aHW1y5TrrR3iq6RZLBwJ3E24uwPhwahw==}
     engines: {node: '>=12.0.0'}
     dependencies:
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
   /@azure/abort-controller@2.1.2:
     resolution: {integrity: sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==}
     engines: {node: '>=18.0.0'}
     dependencies:
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
-  /@azure/core-auth@1.7.2:
+  /@azure/core-auth@1.9.0:
-    resolution: {integrity: sha512-Igm/S3fDYmnMq1uKS38Ae1/m37B3zigdlZw+kocwEhh5GjyKjPrXKO2J6rzpC1wAxrNil/jX9BJRqBshyjnF3g==}
+    resolution: {integrity: sha512-FPwHpZywuyasDSLMqJ6fhbOK3TqUdviZNF8OqRGA4W5Ewib2lEEZ+pBsYcBa88B2NGO/SEnYPGhyBqNlE8ilSw==}
     engines: {node: '>=18.0.0'}
     dependencies:
       '@azure/abort-controller': 2.1.2
-      '@azure/core-util': 1.9.2
+      '@azure/core-util': 1.11.0
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
   /@azure/core-client@1.9.2:
@@ -151,12 +157,12 @@ packages:
     engines: {node: '>=18.0.0'}
     dependencies:
       '@azure/abort-controller': 2.1.2
-      '@azure/core-auth': 1.7.2
+      '@azure/core-auth': 1.9.0
-      '@azure/core-rest-pipeline': 1.16.3
+      '@azure/core-rest-pipeline': 1.17.0
-      '@azure/core-tracing': 1.1.2
+      '@azure/core-tracing': 1.2.0
-      '@azure/core-util': 1.9.2
+      '@azure/core-util': 1.11.0
       '@azure/logger': 1.1.4
-      tslib: 2.7.0
+      tslib: 2.8.1
     transitivePeerDependencies:
       - supports-color
     dev: false
@@ -167,7 +173,7 @@ packages:
     dependencies:
       '@azure/abort-controller': 2.1.2
       '@azure/core-client': 1.9.2
-      '@azure/core-rest-pipeline': 1.16.3
+      '@azure/core-rest-pipeline': 1.17.0
     transitivePeerDependencies:
       - supports-color
     dev: false
@@ -177,70 +183,70 @@ packages:
     engines: {node: '>=18.0.0'}
     dependencies:
       '@azure/abort-controller': 2.1.2
-      '@azure/core-util': 1.9.2
+      '@azure/core-util': 1.11.0
       '@azure/logger': 1.1.4
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
   /@azure/core-paging@1.6.2:
     resolution: {integrity: sha512-YKWi9YuCU04B55h25cnOYZHxXYtEvQEbKST5vqRga7hWY9ydd3FZHdeQF8pyh+acWZvppw13M/LMGx0LABUVMA==}
     engines: {node: '>=18.0.0'}
     dependencies:
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
-  /@azure/core-rest-pipeline@1.16.3:
+  /@azure/core-rest-pipeline@1.17.0:
-    resolution: {integrity: sha512-VxLk4AHLyqcHsfKe4MZ6IQ+D+ShuByy+RfStKfSjxJoL3WBWq17VNmrz8aT8etKzqc2nAeIyLxScjpzsS4fz8w==}
+    resolution: {integrity: sha512-62Vv8nC+uPId3j86XJ0WI+sBf0jlqTqPUFCBNrGtlaUeQUIXWV/D8GE5A1d+Qx8H7OQojn2WguC8kChD6v0shA==}
     engines: {node: '>=18.0.0'}
     dependencies:
       '@azure/abort-controller': 2.1.2
-      '@azure/core-auth': 1.7.2
+      '@azure/core-auth': 1.9.0
-      '@azure/core-tracing': 1.1.2
+      '@azure/core-tracing': 1.2.0
-      '@azure/core-util': 1.9.2
+      '@azure/core-util': 1.11.0
       '@azure/logger': 1.1.4
       http-proxy-agent: 7.0.2
       https-proxy-agent: 7.0.5
-      tslib: 2.7.0
+      tslib: 2.8.1
     transitivePeerDependencies:
       - supports-color
     dev: false
 
-  /@azure/core-tracing@1.1.2:
+  /@azure/core-tracing@1.2.0:
-    resolution: {integrity: sha512-dawW9ifvWAWmUm9/h+/UQ2jrdvjCJ7VJEuCJ6XVNudzcOwm53BFZH4Q845vjfgoUAM8ZxokvVNxNxAITc502YA==}
+    resolution: {integrity: sha512-UKTiEJPkWcESPYJz3X5uKRYyOcJD+4nYph+KpfdPRnQJVrZfk0KJgdnaAWKfhsBBtAf/D58Az4AvCJEmWgIBAg==}
     engines: {node: '>=18.0.0'}
     dependencies:
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
-  /@azure/core-util@1.9.2:
+  /@azure/core-util@1.11.0:
-    resolution: {integrity: sha512-l1Qrqhi4x1aekkV+OlcqsJa4AnAkj5p0JV8omgwjaV9OAbP41lvrMvs+CptfetKkeEaGRGSzby7sjPZEX7+kkQ==}
+    resolution: {integrity: sha512-DxOSLua+NdpWoSqULhjDyAZTXFdP/LKkqtYuxxz1SCN289zk3OG8UOpnCQAz/tygyACBtWp/BoO72ptK7msY8g==}
     engines: {node: '>=18.0.0'}
     dependencies:
       '@azure/abort-controller': 2.1.2
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
-  /@azure/core-xml@1.4.3:
+  /@azure/core-xml@1.4.4:
-    resolution: {integrity: sha512-D6G7FEmDiTctPKuWegX2WTrS1enKZwqYwdKTO6ZN6JMigcCehlT0/CYl+zWpI9vQ9frwwp7GQT3/owaEXgnOsA==}
+    resolution: {integrity: sha512-J4FYAqakGXcbfeZjwjMzjNcpcH4E+JtEBv+xcV1yL0Ydn/6wbQfeFKTCHh9wttAi0lmajHw7yBbHPRG+YHckZQ==}
     engines: {node: '>=18.0.0'}
     dependencies:
       fast-xml-parser: 4.5.0
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
   /@azure/logger@1.1.4:
     resolution: {integrity: sha512-4IXXzcCdLdlXuCG+8UKEwLA1T1NHqUfanhXYHiQTn+6sfWCZXduqbtXDGceg3Ce5QxTGo7EqmbV6Bi+aqKuClQ==}
     engines: {node: '>=18.0.0'}
     dependencies:
-      tslib: 2.7.0
+      tslib: 2.8.1
     dev: false
 
   /@azure/ms-rest-js@2.7.0:
     resolution: {integrity: sha512-ngbzWbqF+NmztDOpLBVDxYM+XLcUj7nKhxGbSU9WtIsXfRB//cf2ZbAG5HkOrhU9/wd/ORRB6lM/d69RKVjiyA==}
     dependencies:
-      '@azure/core-auth': 1.7.2
+      '@azure/core-auth': 1.9.0
       abort-controller: 3.0.0
-      form-data: 2.5.1
+      form-data: 2.5.2
       node-fetch: 2.7.0
       tslib: 1.14.1
       tunnel: 0.0.6
@@ -250,23 +256,23 @@ packages:
       - encoding
     dev: false
 
-  /@azure/storage-blob@12.24.0:
+  /@azure/storage-blob@12.25.0:
-    resolution: {integrity: sha512-l8cmWM4C7RoNCBOImoFMxhTXe1Lr+8uQ/IgnhRNMpfoA9bAFWoLG4XrWm6O5rKXortreVQuD+fc1hbzWklOZbw==}
+    resolution: {integrity: sha512-oodouhA3nCCIh843tMMbxty3WqfNT+Vgzj3Xo5jqR9UPnzq3d7mzLjlHAYz7lW+b4km3SIgz+NAgztvhm7Z6kQ==}
     engines: {node: '>=18.0.0'}
     dependencies:
-      '@azure/abort-controller': 1.1.0
+      '@azure/abort-controller': 2.1.2
-      '@azure/core-auth': 1.7.2
+      '@azure/core-auth': 1.9.0
       '@azure/core-client': 1.9.2
       '@azure/core-http-compat': 2.1.2
       '@azure/core-lro': 2.7.2
       '@azure/core-paging': 1.6.2
-      '@azure/core-rest-pipeline': 1.16.3
+      '@azure/core-rest-pipeline': 1.17.0
-      '@azure/core-tracing': 1.1.2
+      '@azure/core-tracing': 1.2.0
-      '@azure/core-util': 1.9.2
+      '@azure/core-util': 1.11.0
-      '@azure/core-xml': 1.4.3
+      '@azure/core-xml': 1.4.4
       '@azure/logger': 1.1.4
       events: 3.3.0
-      tslib: 2.7.0
+      tslib: 2.8.1
     transitivePeerDependencies:
       - supports-color
     dev: false
@@ -895,6 +901,11 @@ packages:
     engines: {node: '>=18'}
     dev: false
 
+  /@sindresorhus/is@7.0.1:
+    resolution: {integrity: sha512-QWLl2P+rsCJeofkDNIT3WFmb6NrRud1SUYW8dIhXK/46XFV8Q/g7Bsvib0Askb0reRLe+WYPeeE+l5cH7SlkuQ==}
+    engines: {node: '>=18'}
+    dev: false
+
   /@szmarczak/http-timer@5.0.1:
     resolution: {integrity: sha512-+PmQX0PiAYPMeVYe237LJAYvOMYW1j2rH5YROyS3b4CTVJum34HfRvKvAzozHAQG0TnHNdUfY9nCeUyRAs//cw==}
     engines: {node: '>=14.16'}
@@ -1109,7 +1120,7 @@ packages:
     resolution: {integrity: sha512-H0TSyFNDMomMNJQBn8wFV5YC/2eJ+VXECwOadZJT554xP6cODZHPX3H9QMQECxvrgiSOP1pHjy1sMWQVYJOUOA==}
     engines: {node: '>= 14'}
     dependencies:
-      debug: 4.3.6
+      debug: 4.3.7
     transitivePeerDependencies:
       - supports-color
     dev: false
@@ -1502,6 +1513,19 @@ packages:
         optional: true
     dependencies:
       ms: 2.1.2
+    dev: true
+
+  /debug@4.3.7:
+    resolution: {integrity: sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+    dependencies:
+      ms: 2.1.3
+    dev: false
 
   /decompress-response@6.0.0:
     resolution: {integrity: sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==}
@@ -2239,13 +2263,14 @@ packages:
     engines: {node: '>= 18'}
     dev: false
 
-  /form-data@2.5.1:
+  /form-data@2.5.2:
-    resolution: {integrity: sha512-m21N3WOmEEURgk6B9GLOE4RuWOFf28Lhh9qGYeNlGq4VDXUlJy2th2slBNU8Gp8EzloYZOibZJ7t5ecIrFSjVA==}
+    resolution: {integrity: sha512-GgwY0PS7DbXqajuGf4OYlsrIu3zgxD6Vvql43IBhm6MahqA5SK/7mwhtNj2AdH2z35YR34ujJ7BN+3fFC3jP5Q==}
     engines: {node: '>= 0.12'}
     dependencies:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       mime-types: 2.1.35
+      safe-buffer: 5.2.1
     dev: false
 
   /fs.realpath@1.0.0:
@@ -2410,6 +2435,23 @@ packages:
       type-fest: 4.23.0
     dev: false
 
+  /got@14.4.4:
+    resolution: {integrity: sha512-tqiF7eSgTBwQkxb1LxsEpva8TaMYVisbhplrFVmw9GQE3855Z+MH/mnsXLLOkDxR6hZJRFMj5VTAZ8lmTF8ZOA==}
+    engines: {node: '>=20'}
+    dependencies:
+      '@sindresorhus/is': 7.0.1
+      '@szmarczak/http-timer': 5.0.1
+      cacheable-lookup: 7.0.0
+      cacheable-request: 12.0.1
+      decompress-response: 6.0.0
+      form-data-encoder: 4.0.2
+      http2-wrapper: 2.2.1
+      lowercase-keys: 3.0.0
+      p-cancelable: 4.0.1
+      responselike: 3.0.0
+      type-fest: 4.26.1
+    dev: false
+
   /graceful-fs@4.2.11:
     resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
     dev: true
@@ -2471,7 +2513,7 @@ packages:
     engines: {node: '>= 14'}
     dependencies:
       agent-base: 7.1.1
-      debug: 4.3.6
+      debug: 4.3.7
     transitivePeerDependencies:
       - supports-color
     dev: false
@@ -2489,7 +2531,7 @@ packages:
     engines: {node: '>= 14'}
     dependencies:
       agent-base: 7.1.1
-      debug: 4.3.6
+      debug: 4.3.7
     transitivePeerDependencies:
       - supports-color
     dev: false
@@ -2964,10 +3006,10 @@ packages:
 
   /ms@2.1.2:
     resolution: {integrity: sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==}
+    dev: true
 
   /ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
-    dev: true
 
   /mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
@@ -3353,6 +3395,10 @@ packages:
       isarray: 2.0.5
     dev: true
 
+  /safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+    dev: false
+
   /safe-regex-test@1.0.3:
     resolution: {integrity: sha512-CdASjNJPvRa7roO6Ra/gLYBTzYzzPyyBXxIMdGW3USQLyjWEls2RgW5UBTXaQVp+OrpeCK3bLem8smtmheoRuw==}
     engines: {node: '>= 0.4'}
@@ -3667,8 +3713,8 @@ packages:
     resolution: {integrity: sha512-xNvxJEOUiWPGhUuUdQgAJPKOOJfGnIyKySOc09XkKsgdUV/3E2zvwZYdejjmRgPCgcym1juLH3226yA7sEFJKQ==}
     dev: true
 
-  /tslib@2.7.0:
+  /tslib@2.8.1:
-    resolution: {integrity: sha512-gLXCKdN1/j47AiHiOkJN69hJmcbGTHI0ImLmbYLHykhgeN0jVGola9yVjFgzCUklsZQMW55o+dW7IXv3RCXDzA==}
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
     dev: false
 
   /tsup@8.2.3(typescript@5.5.4):
@@ -3736,8 +3782,8 @@ packages:
     engines: {node: '>=16'}
     dev: false
 
-  /type-fest@4.26.0:
+  /type-fest@4.26.1:
-    resolution: {integrity: sha512-OduNjVJsFbifKb57UqZ2EMP1i4u64Xwow3NYXUtBbD4vIwJdQd4+xl8YDou1dlm4DVrtwT/7Ky8z8WyCULVfxw==}
+    resolution: {integrity: sha512-yOGpmOAL7CkKe/91I5O3gPICmJNLJ1G4zFYVAsRHg7M64biSnPtRj0WNQt++bRkjYOqjWXrhnUw1utzmVErAdg==}
     engines: {node: '>=16'}
     dev: false
 
@@ -3828,12 +3874,6 @@ packages:
       punycode: 2.3.1
     dev: true
 
-  /uuid@3.4.0:
-    resolution: {integrity: sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==}
-    deprecated: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
-    hasBin: true
-    dev: false
-
   /uuid@8.3.2:
     resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==}
     hasBin: true
@@ -3964,16 +4004,16 @@ packages:
     engines: {node: '>=10'}
     dev: true
 
-  github.com/DeterminateSystems/detsys-ts/65dd73c562ac60a068340f8e0c040bdcf2c59afe:
+  github.com/DeterminateSystems/detsys-ts/4280bc94c9545f31ccf08001cc16f20ccb91b770:
-    resolution: {tarball: https://codeload.github.com/DeterminateSystems/detsys-ts/tar.gz/65dd73c562ac60a068340f8e0c040bdcf2c59afe}
+    resolution: {tarball: https://codeload.github.com/DeterminateSystems/detsys-ts/tar.gz/4280bc94c9545f31ccf08001cc16f20ccb91b770}
     name: detsys-ts
     version: 1.0.0
     dependencies:
-      '@actions/cache': 3.2.4
+      '@actions/cache': 3.3.0
-      '@actions/core': 1.10.1
+      '@actions/core': 1.11.1
       '@actions/exec': 1.1.1
-      got: 14.4.2
+      got: 14.4.4
-      type-fest: 4.26.0
+      type-fest: 4.26.1
     transitivePeerDependencies:
       - encoding
       - supports-color

src/helpers.ts

@@ -4,6 +4,33 @@ import * as os from "node:os";
 import path from "node:path";
 import { Tail } from "tail";
 
+export function getTrinaryInput(
+  name: string,
+): "enabled" | "disabled" | "no-preference" {
+  const trueValue = ["true", "True", "TRUE", "enabled"];
+  const falseValue = ["false", "False", "FALSE", "disabled"];
+  const noPreferenceValue = ["", "null", "no-preference"];
+
+  const val = actionsCore.getInput(name);
+  if (trueValue.includes(val)) {
+    return "enabled";
+  }
+  if (falseValue.includes(val)) {
+    return "disabled";
+  }
+  if (noPreferenceValue.includes(val)) {
+    return "no-preference";
+  }
+
+  const possibleValues = trueValue
+    .concat(falseValue)
+    .concat(noPreferenceValue)
+    .join(" | ");
+  throw new TypeError(
+    `Input ${name} does not look like a trinary, which requires one of:\n${possibleValues}`,
+  );
+}
+
 export function tailLog(daemonDir: string): Tail {
   const log = new Tail(path.join(daemonDir, "daemon.log"));
   actionsCore.debug(`tailing daemon.log...`);

src/index.ts

@@ -1,4 +1,4 @@
-import { netrcPath, tailLog } from "./helpers.js";
+import { getTrinaryInput, netrcPath, tailLog } from "./helpers.js";
 import * as actionsCore from "@actions/core";
 import { DetSysAction, inputs, stringifyError } from "detsys-ts";
 import got, { Got, Response } from "got";
@@ -207,11 +207,11 @@ class MagicNixCacheAction extends DetSysAction {
     const nixConfPath = `${process.env["HOME"]}/.config/nix/nix.conf`;
     const upstreamCache = inputs.getString("upstream-cache");
     const diagnosticEndpoint = inputs.getString("diagnostic-endpoint");
-    const useFlakeHub = inputs.getBool("use-flakehub");
+    const useFlakeHub = getTrinaryInput("use-flakehub");
     const flakeHubCacheServer = inputs.getString("flakehub-cache-server");
     const flakeHubApiServer = inputs.getString("flakehub-api-server");
     const flakeHubFlakeName = inputs.getString("flakehub-flake-name");
-    const useGhaCache = inputs.getBool("use-gha-cache");
+    const useGhaCache = getTrinaryInput("use-gha-cache");
 
     const daemonCliFlags: string[] = [
       "--startup-notification-url",
@@ -224,12 +224,15 @@ class MagicNixCacheAction extends DetSysAction {
       diagnosticEndpoint,
       "--nix-conf",
       nixConfPath,
+      "--use-gha-cache",
+      useGhaCache,
+      "--use-flakehub",
+      useFlakeHub,
     ]
       .concat(this.diffStore ? ["--diff-store"] : [])
       .concat(
-        useFlakeHub
+        useFlakeHub !== "disabled"
           ? [
-              "--use-flakehub",
               "--flakehub-cache-server",
               flakeHubCacheServer,
               "--flakehub-api-server",
@@ -240,8 +243,7 @@ class MagicNixCacheAction extends DetSysAction {
               flakeHubFlakeName,
             ]
           : [],
-      )
+      );
-      .concat(useGhaCache ? ["--use-gha-cache"] : []);
 
     const opts: SpawnOptions = {
       stdio: ["ignore", output, output],