From 6cfc5044e8a1b518f71e2dde5d892b98b899630d Mon Sep 17 00:00:00 2001
From: Ali Caglayan <alizter@gmail.com>
Date: Thu, 25 Jun 2026 07:49:32 +0100
Subject: [PATCH] ci: use cachix for all nix jobs

Replace the per-job nix-community/cache-nix-action setup with a single
cachix/cachix-action step that pushes/pulls from the ocaml-dune cache.
Also adds cachix to nix jobs that previously had no caching at all
(nix-build, nix-test, fmt, doc, bootstrap, build-microbench).

The GitHub Actions cache backend repeatedly hit its spending limit
('Cache reservation failed: ...read only to prevent additional
charges'), at which point new saves failed and restores fell back to
stale prefix matches. cache-nix-action also accumulated one full-sized
entry per distinct '**/*.nix'/flake.lock hash, since it never purged
old prefix-matched entries on save. Cachix has no per-repo budget,
shares across branches and PRs, and avoids the duplicate-cache
problem.

Signed-off-by: Ali Caglayan <alizter@gmail.com>
---
 .github/workflows/workflow.yml    | 72 ++++++++++++++++++-------------
 .github/workflows/workflow.yml.in | 72 ++++++++++++++++++-------------
 2 files changed, 84 insertions(+), 60 deletions(-)

diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
index 36a4c19d7ac..0246266c9c0 100644
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/workflow.yml
@@ -34,6 +34,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix build
 
   nix-test:
@@ -47,6 +51,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop -i -s CI true -c make test
 
   fmt:
@@ -55,6 +63,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#fmt -c make fmt
 
   diff-on-checkout:
@@ -70,6 +82,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#doc -c make doc
         env:
           LC_ALL: C
@@ -85,6 +101,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop -i .#bootstrap-check -c make test-bootstrap-script
 
   nix-build-4-14:
@@ -98,12 +118,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 2G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop -i .#bootstrap-check_4_14 -c make release
 
   nix-build-ox:
@@ -119,12 +137,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 2G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop -i .#bootstrap-ox -c make release
 
 #
@@ -308,12 +324,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 5G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#rocq -c make test-rocq
 
   rocq-native:
@@ -323,12 +337,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 5G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#rocq-native -c make test-rocq-native
 
   wasm:
@@ -463,12 +475,10 @@ jobs:
       - uses: nixbuild/nix-quick-install-action@v35
         with:
           nix_conf: ${{ env.EXTRA_NIX_CONFIG }}
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 2G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - name: Build and test with OxCaml
         run: nix develop -i .#ox -c make test-ox
 
@@ -507,6 +517,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#microbench -c make dune build bench/micro
 
   utop-dev-tool-test:
@@ -515,12 +529,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 2G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - name: Set up a project, install utop as a dev tool, and run it
         shell: nix shell -c bash -e {0}
         run: |
diff --git a/.github/workflows/workflow.yml.in b/.github/workflows/workflow.yml.in
index 35f138530eb..9de3991ca7c 100644
--- a/.github/workflows/workflow.yml.in
+++ b/.github/workflows/workflow.yml.in
@@ -33,6 +33,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix build
 
   nix-test:
@@ -46,6 +50,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop -i -s CI true -c make test
 
   fmt:
@@ -54,6 +62,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#fmt -c make fmt
 
   diff-on-checkout:
@@ -69,6 +81,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#doc -c make doc
         env:
           LC_ALL: C
@@ -84,6 +100,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop -i .#bootstrap-check -c make test-bootstrap-script
 
   nix-build-4-14:
@@ -97,12 +117,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 2G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop -i .#bootstrap-check_4_14 -c make release
 
   nix-build-ox:
@@ -118,12 +136,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 2G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop -i .#bootstrap-ox -c make release
 
 #
@@ -307,12 +323,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 5G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#rocq -c make test-rocq
 
   rocq-native:
@@ -322,12 +336,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 5G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#rocq-native -c make test-rocq-native
 
   wasm:
@@ -462,12 +474,10 @@ jobs:
       - uses: nixbuild/nix-quick-install-action@v35
         with:
           nix_conf: ${{ env.EXTRA_NIX_CONFIG }}
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 2G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - name: Build and test with OxCaml
         run: nix develop -i .#ox -c make test-ox
 
@@ -506,6 +516,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
+      - uses: cachix/cachix-action@v15
+        with:
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - run: nix develop .#microbench -c make dune build bench/micro
 
   utop-dev-tool-test:
@@ -514,12 +528,10 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v35
-      - uses: nix-community/cache-nix-action@v7
+      - uses: cachix/cachix-action@v15
         with:
-          primary-key: |
-            nix-${{ runner.os }}-${{ github.job }}--${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ github.job }}--
-          gc-max-store-size-linux: 2G
+          name: ocaml-dune
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_OCAML_DUNE }}
       - name: Set up a project, install utop as a dev tool, and run it
         shell: nix shell -c bash -e {0}
         run: |