From bb0ef7e7a2deecfa25c36b13582c1cfb53d49c5c Mon Sep 17 00:00:00 2001
From: 4evy <git@evy.pink>
Date: Mon, 13 Jul 2026 13:35:31 +0300
Subject: [PATCH] ci: restore eupkgs Cachix cache

---
 .github/actions/setup-nix/action.yml  | 38 ++++++++++++++++-----------
 .github/workflows/build-packages.yaml |  8 +++---
 README.md                             | 19 ++++++++++++--
 flake.nix                             |  7 +++++
 4 files changed, 52 insertions(+), 20 deletions(-)

diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
index ec61fa0..a1f9940 100644
--- a/.github/actions/setup-nix/action.yml
+++ b/.github/actions/setup-nix/action.yml
@@ -1,28 +1,36 @@
 name: 'Setup Nix'
-description: 'Install Nix and optionally configure the shared cache-nix-action'
+description: 'Install Nix and configure the eupkgs Cachix binary cache'
 
 inputs:
-  cache-key:
-    description: 'Distinctive segment for the cache primary key (leave empty to skip caching)'
+  cachix-cache:
+    description: 'Cachix cache name (leave empty to skip Cachix)'
+    required: false
+    default: 'eupkgs'
+  cachix-auth-token:
+    description: 'Cachix token used to push build results'
     required: false
     default: ''
-  cache-hash-files:
-    description: 'Newline-separated glob list passed to hashFiles() for the primary key suffix'
+  cachix-skip-push:
+    description: 'Only pull from Cachix, even when an auth token is provided'
     required: false
-    default: 'flake.lock'
+    default: 'true'
 
 runs:
   using: 'composite'
   steps:
     - uses: DeterminateSystems/nix-installer-action@v22
 
-    - if: inputs.cache-key != ''
-      uses: nix-community/cache-nix-action@v7
+    - name: Configure read-only Cachix access
+      if: inputs.cachix-cache != '' && inputs.cachix-auth-token == ''
+      uses: cachix/cachix-action@v17
+      with:
+        name: ${{ inputs.cachix-cache }}
+        skipPush: true
+
+    - name: Configure authenticated Cachix access
+      if: inputs.cachix-cache != '' && inputs.cachix-auth-token != ''
+      uses: cachix/cachix-action@v17
       with:
-        primary-key: nix-${{ runner.os }}-${{ inputs.cache-key }}-${{ hashFiles(inputs.cache-hash-files) }}
-        restore-prefixes-first-match: nix-${{ runner.os }}-${{ inputs.cache-key }}-
-        purge: true
-        purge-prefixes: nix-${{ runner.os }}-${{ inputs.cache-key }}-
-        purge-created: 0
-        purge-last-accessed: 604800
-        purge-primary-key: never
+        name: ${{ inputs.cachix-cache }}
+        authToken: ${{ inputs.cachix-auth-token }}
+        skipPush: ${{ inputs.cachix-skip-push }}
diff --git a/.github/workflows/build-packages.yaml b/.github/workflows/build-packages.yaml
index eaeeb94..ec08844 100644
--- a/.github/workflows/build-packages.yaml
+++ b/.github/workflows/build-packages.yaml
@@ -52,7 +52,7 @@ jobs:
       - name: Install Nix
         uses: ./.github/actions/setup-nix
         with:
-          cache-key: build-packages-detect
+          cachix-cache: ${{ vars.CACHIX_CACHE_NAME || 'eupkgs' }}
 
       - name: Detect packages
         id: detect
@@ -73,7 +73,7 @@ jobs:
       - name: Install Nix
         uses: ./.github/actions/setup-nix
         with:
-          cache-key: build-packages-flake-check
+          cachix-cache: ${{ vars.CACHIX_CACHE_NAME || 'eupkgs' }}
 
       - name: Check flake outputs without building packages
         run: nix flake check --accept-flake-config --impure --no-build
@@ -99,7 +99,9 @@ jobs:
       - name: Install Nix
         uses: ./.github/actions/setup-nix
         with:
-          cache-key: build-packages-${{ matrix.platform }}
+          cachix-cache: ${{ vars.CACHIX_CACHE_NAME || 'eupkgs' }}
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          cachix-skip-push: ${{ github.event_name == 'pull_request' }}
 
       - name: Build selected by-name packages
         shell: bash
diff --git a/README.md b/README.md
index d5a6fea..c51e0d5 100644
--- a/README.md
+++ b/README.md
@@ -7,8 +7,23 @@ although it can be used by other repos as well too
 
 ### Binary cache
 
-This flake does not configure a project binary cache. Builds use the substituters
-from your local Nix configuration.
+This flake advertises the public `eupkgs` Cachix cache through `nixConfig`:
+
+```nix
+extra-substituters = [ "https://eupkgs.cachix.org" ];
+extra-trusted-public-keys = [
+  "eupkgs.cachix.org-1:V9Y0HdASNNSU9U6EkXhR1j85bZGRtNgW7wSyTiQrwGU="
+];
+```
+
+Accept the flake configuration when Nix prompts to download prebuilt packages
+from Cachix instead of building them locally. For non-interactive use, pass
+`--accept-flake-config`. Multi-user Nix installations may require a trusted
+administrator to add the same substituter and public key system-wide.
+
+GitHub Actions pulls from this cache for all checks. Builds on `master` and
+manually dispatched builds also push successful results using the repository's
+`CACHIX_AUTH_TOKEN`; pull requests remain read-only.
 
 ### Add as a flake input
 
diff --git a/flake.nix b/flake.nix
index 49f497e..1c66b7b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,6 +3,13 @@
 {
   description = "EUVlok Packages - overlay for Nixpkgs";
 
+  nixConfig = {
+    extra-substituters = [ "https://eupkgs.cachix.org" ];
+    extra-trusted-public-keys = [
+      "eupkgs.cachix.org-1:V9Y0HdASNNSU9U6EkXhR1j85bZGRtNgW7wSyTiQrwGU="
+    ];
+  };
+
   inputs.nixpkgs.url = "github:NixOS/nixpkgs";
 
   outputs =