Add support for GitHub caching of Nix builds.

[Zimmi48]

Tests the new GitHub Action provided by Determinate Systems. Cf. https://determinate.systems/posts/magic-nix-cache. This is tested from a fork, on purpose. The pull_request workflow for a PR opened from a fork cannot push to Cachix.

[Zimmi48]

This can apparently be a new source of spurious failures: https://github.com/coq-community/coq-nix-toolbox/actions/runs/5543815473/jobs/10120402552?pr=154

This happened for about 1% of all the builds.

EDIT: this actually looks fixed in v2 of the action.

[Zimmi48]

The only place where the binary cache would have been really useful did not work:

Post job cleanup.
  2023-07-13T13:47:50.310814Z  INFO magic_nix_cache::api: Workflow finished
    at magic-nix-cache/src/api.rs:50

  2023-07-13T13:47:50.315797Z  INFO magic_nix_cache::api: Pushing 244 new paths
    at magic-nix-cache/src/api.rs:59

disabling binary cache 'http://127.0.0.1:37515/' for 60 seconds
error: unable to download 'http://127.0.0.1:37515/5a176fhdpfa5m4yh4fgq36halxvj77f0.narinfo': HTTP error 418

       response body:

       GitHub API error: API error (429 Too Many Requests): StructuredApiError { message: "Request was blocked due to exceeding usage of resource 'Count' in namespace ''." }
  2023-07-13T13:47:51.272960Z ERROR magic_nix_cache::util: Failed to upload batch: ExitStatus(unix_wait_status(256))
    at magic-nix-cache/src/util.rs:79

got an exception:
HTTPError: Response code 500 (Internal Server Error)
not considering this a failure: finishing the upload is optional, anyway.

And in the dependent job:

disabling binary cache 'http://127.0.0.1:37515/' for 60 seconds
error: unable to download 'http://127.0.0.1:37515/r3v4140sxv1pwfas8zpqffbjljzdayf5.narinfo': HTTP error 418

       response body:

       GitHub API error: API error (429 Too Many Requests): StructuredApiError { message: "Request was blocked due to exceeding usage of resource 'Count' in namespace ''." }
these 2 derivations will be built:
  /nix/store/6hh4ddp733f18zighzgps5i8vd6g4p4y-setupHook.sh.drv
  /nix/store/f5hfh0kmwmsd0pz3gx7v8cxcbss8rsds-coq-dev.drv

It's not clear that this caching mechanism will be resilient to the large number of jobs that we spawn in the Coq Nix Toolbox repository, but it might still be useful on other projects.

[Zimmi48]

As a first step, it could be worth adding GitHub caching only for the workflows who do not have write-access to a Cachix.
As a second step, we would also add the GitHub caching for workflows that do not define the needed secret (PRs from forks) using an if clause for the step.

[CohenCyril]

@Zimmi48 I hadn't seen this. Do you think we should update and merge?

[Zimmi48]

We should probably evaluate how it behaves again. According to my last comment, it was not clear whether this was a good idea in the general case, which is how it is implemented now. So this should probably have been a draft.