Merge pull request #5 from zhaofengli/trust-runner-user

Make the runner user trusted by default

.github/workflows/ci.yml

@@ -56,6 +56,8 @@ jobs:
           log-directives: nix_installer=trace
           backtrace: full
           reinstall: true
+          extra-conf: |
+            use-sqlite-wal = true
       - name: Test `nix` with `$GITHUB_PATH`
         if: success() || failure()
         run: |
@@ -64,6 +66,11 @@ jobs:
           fortune
           nix store gc
           nix run nixpkgs#fortune
+      - name: Verify the generated nix.conf
+        run: |
+          cat -n /etc/nix/nix.conf
+          grep -E "^trusted-users = .*$USER" /etc/nix/nix.conf
+          grep -E "^use-sqlite-wal = true" /etc/nix/nix.conf
 
   run-x86_64-darwin:
     name: Run x86_64 Darwin
@@ -119,6 +126,8 @@ jobs:
           log-directives: nix_installer=trace
           backtrace: full
           reinstall: true
+          extra-conf: |
+            use-sqlite-wal = true
       - name: Test `nix` with `$GITHUB_PATH`
         if: success() || failure()
         run: |
@@ -126,4 +135,9 @@ jobs:
           nix profile install nixpkgs#fortune
           fortune
           nix store gc
-          nix run nixpkgs#fortune
+          nix run nixpkgs#fortune
+      - name: Verify the generated nix.conf
+        run: |
+          cat -n /etc/nix/nix.conf
+          grep -E "^trusted-users = .*$USER" /etc/nix/nix.conf
+          grep -E "^use-sqlite-wal = true" /etc/nix/nix.conf

action.yml

@@ -13,6 +13,9 @@ inputs:
   github-token:
     description: A GitHub Token for making authenticated requests (which have a higher rate-limit quota than unauthenticated requests)
     default: ${{ github.token }}
+  trust-runner-user:
+    description: Whether to make the runner user trusted by the Nix daemon
+    default: "true"
   channels:
     description: Channel(s) to add (eg `nixpkgs=https://nixos.org/channels/nixpkgs-unstable`)
     required: false
@@ -160,18 +163,21 @@ runs:
           echo "Set NIX_INSTALLER_NIX_PACKAGE_URL=$NIX_INSTALLER_NIX_PACKAGE_URL"
         fi
 
+        NIX_EXTRA_CONF=""
+        NEWLINE='
+        '
         if [ -n "${{ inputs.extra-conf }}" ]; then
-          if [ -n "${{ inputs.github-token }}" ]; then
-            export NIX_INSTALLER_EXTRA_CONF="${{ inputs.extra-conf }}access-tokens = github.com=${{ inputs.github-token }}"
-          else
-            export NIX_INSTALLER_EXTRA_CONF="${{ inputs.extra-conf }}"
-          fi
+          NIX_EXTRA_CONF="${{ inputs.extra-conf }}"
+        fi
+        if [ -n "${{ inputs.github-token }}" ]; then
+          NIX_EXTRA_CONF="${NIX_EXTRA_CONF:+$NIX_EXTRA_CONF$NEWLINE}access-tokens = github.com=${{ inputs.github-token }}"
+        fi
+        if [ "${{ inputs.trust-runner-user }}" == "true" ]; then
+          NIX_EXTRA_CONF="${NIX_EXTRA_CONF:+$NIX_EXTRA_CONF$NEWLINE}trusted-users = root $USER"
+        fi
+        if [ -n "$NIX_EXTRA_CONF" ]; then
+          export NIX_INSTALLER_EXTRA_CONF="$NIX_EXTRA_CONF"
           echo "Set NIX_INSTALLER_EXTRA_CONF=$NIX_INSTALLER_EXTRA_CONF"
-        else
-          if [ -n "${{ inputs.github-token }}" ]; then
-            export NIX_INSTALLER_EXTRA_CONF="access-tokens = github.com=${{ inputs.github-token }}"
-            echo "Set NIX_INSTALLER_EXTRA_CONF=$NIX_INSTALLER_EXTRA_CONF"
-          fi
         fi
 
         if [ -n "${{ inputs.mac-encrypt }}" ]; then