GitHub Cache storgage backend

[blaggacao]

Scenario:

• Run attic as a GH service
• Watch the store
• Push all newly built things to GH Cache
  • So that the next run / build (e.g. on the same branch) is quick

Goal:

• Speed up incremental builds in CI

Non Goals:

• Be a "traditional nix cache"

While the cache interface isn't public, it's a hack, but the interface is also not too complicated

Works well with https://github.com/DevPalace/phoenix-ci (i.e. std-action) design tenets of a pre-evaluation phase and potentially shareable build results between parallel runs.

cc @gytis-ivaskevicius @nrdxp

[zhaofengli]

This has been implemented in https://github.com/DeterminateSystems/magic-nix-cache which is a purpose-built Nix binary cache server backed by the GitHub Actions Cache.

Making Attic aware of the semantics specific to GitHub Actions Cache (specifically, branch isolation and cache expiry) would be messy.

However, it would be beneficial for Attic to support the GitHub Container Registry as a backend which is more suited for public binary distribution over a longer term. Using OCI registries to distribute non-container artifacts isn't new (e.g., Homebrew and specifically for Nix, oranc). Further reading: NixOS/nix#8400

[Janik-Haag]

• Watch the store
• Push all newly built things to GH Cache
  • So that the next run / build (e.g. on the same branch) is quick

Something like this would still be awesome for other stuff like for example: woodpecker-ci supports something called services, where you can spin up a container that just runs as long as the worker is running. So you could run a semi-persistent container that you can access over the network between pipeline runs. I would love to be able to have a pre-configured attic server running there and use a custom nix container image that uses the attic cache hosted as a service as it's primary binary cache and automatically pushes every newly built object. I also wouldn't care about branch isolation too much since I can just use the normal nix oci image or use another image that is not allowed to push but instead only pull from the cache.

edit: I also found out that https://nixos.org/manual/nix/stable/advanced-topics/post-build-hook exists which would also be a feasible option