Wire Forge-native release infrastructure

.forgejo/workflows/publish-nix-cache.yml

@@ -0,0 +1,63 @@
+name: "Cache: Publish Nix"
+run-name: "Publish Nix Cache (${{ github.ref_name }})"
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".forgejo/workflows/publish-nix-cache.yml"
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "flake.lock"
+      - "flake.nix"
+      - "crates/**"
+      - "services/forgejo-nsc/**"
+      - "nixos/**"
+      - "Scripts/ci/ensure-nix.sh"
+      - "Scripts/ci/publish-nix-cache.sh"
+  workflow_dispatch:
+    inputs:
+      attrs:
+        description: Space-separated flake attrs to build and push
+        required: false
+        default: ".#burrow .#forgejo-nsc-dispatcher .#forgejo-nsc-autoscaler"
+      required:
+        description: Fail when the cache push token is missing
+        required: false
+        default: "false"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-nix-cache-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  publish:
+    name: Publish Nix Cache
+    runs-on: namespace-profile-linux-medium
+    timeout-minutes: 45
+    env:
+      BURROW_NIX_CACHE_SERVER_NAME: ${{ vars.BURROW_NIX_CACHE_SERVER_NAME || 'burrow' }}
+      BURROW_NIX_CACHE_SERVER_URL: ${{ vars.BURROW_NIX_CACHE_SERVER_URL || 'https://nix.burrow.net' }}
+      BURROW_NIX_CACHE_NAME: ${{ vars.BURROW_NIX_CACHE_NAME || 'burrow' }}
+      BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
+      BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
+      BURROW_NIX_CACHE_PUSH_TOKEN: ${{ secrets.BURROW_NIX_CACHE_PUSH_TOKEN }}
+      BURROW_NIX_CACHE_ATTRS: ${{ github.event.inputs.attrs || '.#burrow .#forgejo-nsc-dispatcher .#forgejo-nsc-autoscaler' }}
+      BURROW_NIX_CACHE_REQUIRED: ${{ github.event.inputs.required || 'false' }}
+    steps:
+      - name: Checkout
+        uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Ensure Nix
+        shell: bash
+        run: bash Scripts/ci/ensure-nix.sh
+
+      - name: Publish Cache Paths
+        shell: bash
+        run: nix develop .#ci -c Scripts/ci/publish-nix-cache.sh