ci: upload nix outputs to cachix

Author: SDAChess

.github/workflows/nix-ci.yml

@@ -12,7 +12,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -46,12 +45,17 @@ jobs:
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
-
-      - name: Enable Magic Nix Cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
-
-      - name: Build package
-        run: nix build ".#packages.${{ matrix.target.system }}.${{ matrix.package }}" --no-link --no-update-lock-file
+        with:
+          extra-conf: |
+            accept-flake-config = true
+
+      - name: Build and upload package
+        env:
+          CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+        run: |
+          : "${CACHIX_AUTH_TOKEN:?CACHIX_AUTH_TOKEN is required to upload to Cachix}"
+          nix run --inputs-from . nixpkgs#cachix -- watch-exec openshell -- \
+            nix build ".#packages.${{ matrix.target.system }}.${{ matrix.package }}" --no-link --no-update-lock-file
 
   test:
     name: Test ${{ matrix.check }} (${{ matrix.target.system }})
@@ -88,12 +92,17 @@ jobs:
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
-
-      - name: Enable Magic Nix Cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
-
-      - name: Run test
-        run: nix build ".#checks.${{ matrix.target.system }}.${{ matrix.check }}" --no-link --no-update-lock-file
+        with:
+          extra-conf: |
+            accept-flake-config = true
+
+      - name: Run and upload test
+        env:
+          CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+        run: |
+          : "${CACHIX_AUTH_TOKEN:?CACHIX_AUTH_TOKEN is required to upload to Cachix}"
+          nix run --inputs-from . nixpkgs#cachix -- watch-exec openshell -- \
+            nix build ".#checks.${{ matrix.target.system }}.${{ matrix.check }}" --no-link --no-update-lock-file
 
   lint:
     name: Lint ${{ matrix.lint }} (${{ matrix.target.system }})
@@ -131,9 +140,14 @@ jobs:
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
-
-      - name: Enable Magic Nix Cache
-        uses: DeterminateSystems/magic-nix-cache-action@main
-
-      - name: Run lint
-        run: nix build ".#checks.${{ matrix.target.system }}.${{ matrix.lint }}" --no-link --no-update-lock-file
+        with:
+          extra-conf: |
+            accept-flake-config = true
+
+      - name: Run and upload lint
+        env:
+          CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+        run: |
+          : "${CACHIX_AUTH_TOKEN:?CACHIX_AUTH_TOKEN is required to upload to Cachix}"
+          nix run --inputs-from . nixpkgs#cachix -- watch-exec openshell -- \
+            nix build ".#checks.${{ matrix.target.system }}.${{ matrix.lint }}" --no-link --no-update-lock-file

flake.nix

@@ -4,6 +4,13 @@
 {
   description = "OpenShell development environment";
 
+  nixConfig = {
+    extra-substituters = [ "https://openshell.cachix.org" ];
+    extra-trusted-public-keys = [
+      "openshell.cachix.org-1:OAr5MunsfH5PZvUsfD08OtGx5RtcwdNZGJdU5FqLm5w="
+    ];
+  };
+
   inputs = {
     flake-utils.url = "github:numtide/flake-utils";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
@@ -105,6 +112,8 @@
             llvmPackages.libclang
             # system dependency for openshell-prover
             z3
+            # caching utility
+            cachix
           ];
 
           env = {