Swap garnix for cachix

Substituters in both flakes now point at argumentcomputer.cachix.org, and a
GitHub Actions workflow replaces garnix as the cache populator: it builds
each package and realizes the dev shell (with a cargo-zisk --version smoke
test), pushing store paths via cachix-action. The packages garnix.yaml
excluded (install-proving-key, build-image, run-zisk, zisk-shell) are
simply not built.

Requires the CACHIX_AUTH_TOKEN secret and WarpBuild runners; change
runs-on to ubuntu-latest if the latter aren't enabled for this repo.

Author: samuelburnham

.github/workflows/nix.yml

@@ -0,0 +1,39 @@
+name: Nix CI
+
+on:
+  push:
+    branches: main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  nix-build:
+    name: Nix Build
+    runs-on: warp-ubuntu-latest-x64-8x
+    steps:
+      - uses: actions/checkout@v6
+      - uses: cachix/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: cachix/cachix-action@v16
+        with:
+          name: argumentcomputer
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      # One step per package for separate logs; the store is shared across
+      # steps, so nothing rebuilds.
+      - run: nix build --print-build-logs --accept-flake-config .#cargo-zisk
+      - run: nix build --print-build-logs --accept-flake-config .#ziskemu
+      - run: nix build --print-build-logs --accept-flake-config .#zisk-home
+      - run: nix build --print-build-logs --accept-flake-config .#zisk-toolchain
+      - run: nix build --print-build-logs --accept-flake-config .#rustup-shim
+      # Realize the dev shell so it's verified and pushed to the cache,
+      # and smoke-test the toolchain entrypoint.
+      - run: nix develop --print-build-logs --accept-flake-config --command cargo-zisk --version

flake.nix

@@ -3,10 +3,10 @@
 
   nixConfig = {
     extra-substituters = [
-      "https://cache.garnix.io"
+      "https://argumentcomputer.cachix.org"
     ];
     extra-trusted-public-keys = [
-      "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+      "argumentcomputer.cachix.org-1:ovhbTx1V56BYDerOWInQvXKXl68LlhNwEA+n7EWk1m4="
     ];
   };
 

garnix.yaml

@@ -3,10 +3,10 @@
 
   nixConfig = {
     extra-substituters = [
-      "https://cache.garnix.io"
+      "https://argumentcomputer.cachix.org"
     ];
     extra-trusted-public-keys = [
-      "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+      "argumentcomputer.cachix.org-1:ovhbTx1V56BYDerOWInQvXKXl68LlhNwEA+n7EWk1m4="
     ];
   };