Skip to content

chore(deps): bump cachix/install-nix-action from 27 to 31 - #33

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/cachix/install-nix-action-31
Closed

chore(deps): bump cachix/install-nix-action from 27 to 31#33
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/cachix/install-nix-action-31

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps cachix/install-nix-action from 27 to 31.

Release notes

Sourced from cachix/install-nix-action's releases.

v31

Starting with v31, this action will use semantic versioning for releases. Major tags, like v31, will be bumped to point to the latest minor/patch release. This is in line with how most GitHub actions manage releases.

What's Changed

... (truncated)

Changelog

Sourced from cachix/install-nix-action's changelog.

Release

As of v31, releases of this action follow Semantic Versioning.

Publishing a new release

Publish the release

Draft a new release on GitHub:

  • In Choose a tag, create a new tag, like v31.2.1, following semver.
  • Click Generate release notes.
  • Set as the latest release should be selected automatically.
  • Publish release

Update the major tag

The major tag, like v31, allows downstream users to opt-in to automatic non-breaking updates.

This process follows GitHub's own guidelines: https://github.com/actions/toolkit/blob/main/docs/action-versioning.md

Fetch the latest tags
git pull --tags --force
Move the tag
git tag -fa v31

git push origin v31 --force

Update the release notes for the major tag

Find the release on GitHub: https://github.com/cachix/install-nix-action/releases

Edit the release and click Generate release notes. Edit the formatting and publish.

Commits
  • 96951a3 Merge pull request #271 from cachix/create-pull-request/patch
  • 6281169 nix: 2.34.2 -> 2.34.4
  • 51f3067 Revert "ci: use 25.11 for channel tests"
  • 15118c1 ci: use 25.11 for channel tests
  • e1ac057 Merge pull request #270 from cachix/create-pull-request/patch
  • d181b96 nix: 2.34.1 -> 2.34.2
  • 1ca7d21 Merge pull request #269 from cachix/create-pull-request/patch
  • b613734 nix: 2.34.0 -> 2.34.1
  • 19effe9 Merge pull request #267 from cachix/create-pull-request/patch
  • d3f3b99 nix: 2.33.3 -> 2.34.0
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/cachix/install-nix-action-31 branch from 97912b1 to f11b32a Compare March 27, 2026 04:49
@ghost

ghost commented Mar 27, 2026

Copy link
Copy Markdown

🔍 Arkana PR Review — ArkLabsHQ/enclave#33

Summary: Dependabot bump of cachix/install-nix-action from v27 → v31 across two CI workflows (integration-test.yml, release.yml).

Changes: Minimal — two line changes, version tag only. No config changes to nix_path or extra_nix_config.

Assessment:

  • ✅ Safe upgrade — v31 brings Nix 2.27→2.34.2 with several security patches (privilege escalation fix in 2.29.1, macOS root execution fix in 2.30.1)
  • ✅ No breaking changes to action inputs/outputs between v27 and v31
  • ✅ Semantic versioning now used by install-nix-action starting at v31 — future minor/patch updates auto-included under the v31 tag
  • ⚠️ Minor note: The jump skips v28-v30 entirely. The release notes mention a rollback of Nix 2.34.0 due to cachix-action auth key issues, but 2.34.1 fixed that. Current v31 pins to 2.34.2 which is stable.

Verdict: Clean dependency bump with security improvements. No concerns.

@dependabot
chore(deps): bump cachix/install-nix-action from 27 to 31
a22567d 
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 27 to 31.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](cachix/install-nix-action@v27...v31)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: '31'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/cachix/install-nix-action-31 branch from f11b32a to a22567d Compare April 7, 2026 07:52
arkana-ai-bot
arkana-ai-bot reviewed Jul 28, 2026
View reviewed changes

@arkana-ai-bot arkana-ai-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM as a CI-only change. Non-protocol; no runtime/signing/VTXO code touched.

Scope check:

  • Bumps cachix/install-nix-action from v27 → v31 in .github/workflows/cli.yml:57, .github/workflows/integration-test.yml:26, .github/workflows/release.yml:22.
  • Confirmed via gh api .../contents/.github/workflows?ref=a22567d that these are the only three workflows at the PR head; no install-nix-action usage was missed. (acme-test.yml on current master does not exist at this PR head, so no gap there — but note it will need its own bump if this branch gets rebased and acme-test.yml has since arrived on master with v27.)
  • Inputs (nix_path: nixpkgs=channel:nixos-25.11, extra_nix_config: experimental-features = nix-command flakes) remain supported in v31 — no schema change to the action's with: block.

Notes / non-blocking:

  1. v31 release notes flag two security advisories in the intervening Nix versions (GHSA-qc7j-jgf3-qmhg macOS privilege escalation on 2.30.0, and the Nix/Lix/Guix privesc series). Upgrading is the right call.
  2. Supply-chain posture unchanged: still pinning to a mutable major tag (@v31) rather than a commit SHA. Not a regression from v27, but worth considering pinning to a SHA + Dependabot updates if you want tamper-evident CI (the release notes themselves highlight that upstream now pins actions to hashes). Out of scope for this PR.
  3. release.yml runs privileged operations (git push to master, tag creation) after installing Nix — same trust boundary as before, so no new exposure.

No changes requested.

@aruokhai aruokhai closed this Sep 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/github_actions/cachix/install-nix-action-31 branch September 23, 2026 11:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arkana-ai-bot arkana-ai-bot arkana-ai-bot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@arkana-ai-bot @aruokhai