Adjust K nix caching (#4844)

Currently, the K repository caches two nix build on
k-framework-binary.cachix.org for `kup`: `k` and
`k.openssl.procps.secp256k1`. While a proper build seems to be cached
for `k`, the build for `k.openssl.procps.secp256k1` seems to be
different than requested by kup. This kind of issue had been observed
and fixed previously for kup packages.

To debug this, I download dependencies that were pushed to the nix cache
k-framework.cachix.org. But the K repository does not yet push
dependencies to this cache. Therefore, this repository adjusts the
GitHub release workflow to also push nix build dependencies to
k-framework.cachix.org.

In addition, caching is introduced for the package
`k.openssl.secp256k1`, which is a version that users are instructed to
install in, e.g., the [kontrol
repository](https://github.com/runtimeverification/kontrol/blob/d38d674a9b7dc1715d72803ee9b001a485a575c5/README.md?plain=1#L25).
This is why version should be cashed in the nix binary cache as well.

---------

Co-authored-by: automergerpr-permission-manager[bot] <190534181+automergerpr-permission-manager[bot]@users.noreply.github.com>

Author: juliankuners

.github/workflows/release.yml

@@ -85,8 +85,60 @@ jobs:
           script: |
             export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH"
             kup publish --verbose k-framework-binary .#k --keep-days 180
+            kup publish --verbose k-framework-binary .#k.openssl.secp256k1 --keep-days 180
             kup publish --verbose k-framework-binary .#k.openssl.procps.secp256k1 --keep-days 180
 
+  cachix-release-dependencies:
+    name: 'k-framework cachix release'
+    strategy:
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            os: ubuntu-24.04
+          - runner: MacM1
+            os: self-macos-12
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
+    steps:
+      - name: 'Check out code'
+        uses: actions/checkout@v4
+
+      - name: 'Install Nix'
+        if: ${{ !startsWith(matrix.os, 'self') }}
+        uses: cachix/install-nix-action@v22
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.13.3/install
+          extra_nix_config: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            substituters = http://cache.nixos.org https://hydra.iohk.io
+            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
+
+      - name: 'Install Cachix'
+        if: ${{ !startsWith(matrix.os, 'self') }}
+        uses: cachix/cachix-action@v14
+        with:
+          name: k-framework-binary
+
+      - name: 'Build and cache K and K dependencies'
+        uses: workflow/nix-shell-action@v3
+        env:
+          GC_DONT_GC: 1
+          CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_PUBLIC_TOKEN }}
+        with:
+          packages: jq
+          script: |
+            K=$(nix build --extra-experimental-features 'nix-command flakes' .#k --json | jq -r '.[].outputs | to_entries[].value')
+            DRV_K=$(nix-store --query --deriver ${K})
+            nix-store --query --requisites --include-outputs ${DRV_K} | cachix push k-framework
+
+            K_OPENSSL_SECP256K1=$(nix build --extra-experimental-features 'nix-command flakes' .#k.openssl.secp256k1 --json | jq -r '.[].outputs | to_entries[].value')
+            DRV_K_OPENSSL_SECP256K1=$(nix-store --query --deriver ${K_OPENSSL_SECP256K1})
+            nix-store --query --requisites --include-outputs ${DRV_K_OPENSSL_SECP256K1} | cachix push k-framework
+
+            K_OPENSSL_PROCPS_SECP256K1=$(nix build --extra-experimental-features 'nix-command flakes' .#k.openssl.procps.secp256k1 --json | jq -r '.[].outputs | to_entries[].value')
+            DRV_K_OPENSSL_PROCPS_SECP256K1=$(nix-store --query --deriver ${K_OPENSSL_PROCPS_SECP256K1})
+            nix-store --query --requisites --include-outputs ${DRV_K_OPENSSL_PROCPS_SECP256K1} | cachix push k-framework
+
   pyk-build-wheel:
     name: 'Pyk: Build Python wheel'
     runs-on: ubuntu-24.04
@@ -456,7 +508,7 @@ jobs:
     name: 'Publish Release'
     runs-on: [self-hosted, linux, normal]
     environment: production
-    needs: [cachix-release, macos-test, source-tarball, ubuntu-jammy, ubuntu-noble, set-release-id]
+    needs: [cachix-release, cachix-release-dependencies, macos-test, source-tarball, ubuntu-jammy, ubuntu-noble, set-release-id]
     steps:
       - name: 'Check out code'
         uses: actions/checkout@v4