Add attic nix cache (#2274)

Author: palfrey

.github/actions/prepare-nix/action.yaml

@@ -1,6 +1,9 @@
 ---
 name: Prepare Nix
 description: "Common setup for all runs using Nix."
+inputs:
+  nativelink_attic_token:
+    required: true
 runs:
   using: "composite"
   steps:
@@ -13,13 +16,13 @@ runs:
       with:
         source-tag: v3.13.0
 
-    # FIXME(palfrey): Replace with better cache. Workers are currently taking minutes to upload data
-    # all the time, probably because we're at ~500GB of 10GB in the cache storage and it's breaking.
-    # We've tried Flakehub, but it doesn't work for us because it assumes "branches on an org repo"
-    # not our "fork and branch on your own repo" setup for it's auth so we can't currently use that.
-
-    # - name: Add Nix magic cache
-    #   uses: >- # https://github.com/DeterminateSystems/magic-nix-cache-action/releases/tag/v13
-    #     DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39
-    #   with:
-    #     source-tag: v0.1.6
+    - name: Setup attic cache
+      run: |
+        nix build nixpkgs#attic-client
+        # Note NATIVELINK_ATTIC_TOKEN is blank for PR builds as they don't have secret access
+        ./result/bin/attic login uc1-dev https://attic.uc1.scdev.nativelink.net/ $NATIVELINK_ATTIC_TOKEN
+        ./result/bin/attic use nativelink
+        ./result/bin/attic watch-store nativelink &
+      shell: bash
+      env:
+        NATIVELINK_ATTIC_TOKEN: ${{ inputs.nativelink_attic_token }}

.github/workflows/coverage.yaml

@@ -31,6 +31,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       # Ubuntu 24.04 restricts unprivileged user namespaces by default, which breaks
       # the worker tests that use namespaces (e.g. for sandboxing).

.github/workflows/custom-image.yaml

@@ -107,6 +107,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Upload image
         id: upload

.github/workflows/image.yaml

@@ -37,6 +37,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Test image
         run: |

.github/workflows/lre.yaml

@@ -39,6 +39,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Build example with ${{ matrix.toolchain }} toolchain
         env:
@@ -65,6 +67,8 @@ jobs:
 
 #       - name: Prepare Worker
 #         uses: ./.github/actions/prepare-nix
+#         with:
+#           nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
 #       - name: Start Kubernetes cluster
 #         run: >

.github/workflows/nix.yaml

@@ -35,6 +35,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Invoke Bazel build in Nix shell
         run: |
@@ -65,6 +67,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Invoke Cargo build in Nix shell
         run: >
@@ -88,6 +92,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Test nix run
         run: |
@@ -107,6 +113,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Test ${{ matrix.test-name }} run
         run: |

.github/workflows/pre-commit.yaml

@@ -25,6 +25,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Run pre-commit hooks
         run: nix flake check

.github/workflows/tagged_image.yaml

@@ -29,6 +29,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Test image
         run: |

.github/workflows/web.yaml

@@ -45,6 +45,8 @@ jobs:
 
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
       - name: Test Build
         if: github.event_name == 'pull_request'

flake.nix

@@ -525,6 +525,7 @@
               pkgs.lre.lre-cc.lre-cc-configs-gen
               pkgs.nativelink-tools.local-image-test
               pkgs.nativelink-tools.create-local-image
+              pkgs.attic-client
             ]
             ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
               pkgs.apple-sdk_14