Wire namespace caches and agenix secrets

.forgejo/workflows/build-site.yml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   site:
     name: Next.js Build
-    runs-on: [self-hosted, linux, x86_64, burrow-forge]
+    runs-on: namespace-profile-linux-medium
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -28,12 +28,27 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          cache_root="${HOME}/.cache/burrow"
-          mkdir -p "${cache_root}/npm"
-          echo "NPM_CONFIG_CACHE=${cache_root}/npm" >> "${GITHUB_ENV}"
+          cache_root="${NSC_CACHE_PATH:-${HOME}/.cache/burrow}"
+          shared_root="${NSC_SHARED_CACHE_PATH:-${cache_root}/shared}"
+          lane_root="${NSC_LANE_CACHE_PATH:-${cache_root}/lane/build-site}"
+          mkdir -p \
+            "${shared_root}/npm" \
+            "${shared_root}/xdg" \
+            "${lane_root}/next-cache"
+          echo "NPM_CONFIG_CACHE=${shared_root}/npm" >> "${GITHUB_ENV}"
+          echo "XDG_CACHE_HOME=${shared_root}/xdg" >> "${GITHUB_ENV}"
+          echo "NEXT_CACHE_DIR=${lane_root}/next-cache" >> "${GITHUB_ENV}"
+          df -h /nix "${shared_root}" "${lane_root}" || true
 
       - name: Build
         shell: bash
         run: |
           set -euo pipefail
-          nix develop .#ci -c bash -lc 'cd site && npm install && npm run build'
+          nix develop .#ci -c bash -lc '
+            mkdir -p site/.next
+            rm -rf site/.next/cache
+            ln -sfn "${NEXT_CACHE_DIR}" site/.next/cache
+            cd site
+            npm install
+            npm run build
+          '