Fix Namespace Apple runner dispatch

Scripts/_burrow-flake.sh

@@ -27,7 +27,7 @@ burrow_prepare_flake_ref() {
   local resolved
   resolved="$(cd "${input}" && pwd)"
 
-  local cache_root="${HOME}/.cache/burrow"
+  local cache_root="${BURROW_FLAKE_CACHE_ROOT:-${HOME}/.cache/burrow}"
   mkdir -p "${cache_root}"
 
   local copy_root
@@ -37,6 +37,8 @@ burrow_prepare_flake_ref() {
   rsync -a \
     --delete \
     --exclude '.git' \
+    --exclude '.cache' \
+    --exclude '.derived-data' \
     --exclude '.direnv' \
     --exclude 'result' \
     --exclude 'burrow.sock' \

Scripts/ci/ensure-nsc.sh

@@ -31,7 +31,7 @@ if [[ "$os" != "linux" ]]; then
   exit 1
 fi
 
-version="${NSC_VERSION:-0.0.506}"
+version="${NSC_VERSION:-0.0.520}"
 expected_sha256=""
 case "${version}/${arch}" in
   0.0.506/amd64) expected_sha256="4a093e0269878a9514e7c00d99b88a924f307ad15fb9d1595ee5f6582f99a0f0" ;;

Scripts/provision-forgejo-nsc.sh

@@ -136,7 +136,20 @@ autoscaler_src="${REPO_ROOT}/services/forgejo-nsc/deploy/autoscaler.yaml"
 
 if [[ "${REFRESH_TOKEN}" -eq 1 || ! -s "${token_file}" ]]; then
   "${NSC_BIN}" auth check-login --duration 20m >/dev/null
-  "${NSC_BIN}" auth generate-dev-token --output_to "${token_file}" >/dev/null
+  token_name="${TOKEN_NAME_PREFIX}-namespace-$(date -u +%Y%m%dT%H%M%SZ)"
+  "${NSC_BIN}" token create \
+    --name "${token_name}" \
+    --description "Burrow Forgejo Namespace runner dispatcher" \
+    --expires_in "${NSC_TOKEN_EXPIRES_IN:-30d}" \
+    --grant '{"resource_type":"instance","resource_id":"*","actions":["create","destroy","dial_host","exec","get","list","refresh","ssh","wait"]}' \
+    --grant '{"resource_type":"instance/ingress","resource_id":"*","actions":["list","register"]}' \
+    --grant '{"resource_type":"instance/notification","resource_id":"*","actions":["list"]}' \
+    --grant '{"resource_type":"instance/o11y/logs","resource_id":"*","actions":["get"]}' \
+    --grant '{"resource_type":"cache/httpcache","resource_id":"*","actions":["ensure","read","write"]}' \
+    --grant '{"resource_type":"bazel/cache","resource_id":"*","actions":["ensure"]}' \
+    --grant '{"resource_type":"artifact","resource_id":"*","actions":["create","resolve","list"]}' \
+    --token_file "${token_file}" \
+    --output json >/dev/null
   chmod 600 "${token_file}"
 fi
 
@@ -155,6 +168,7 @@ forgejo_pat="$(
     -o StrictHostKeyChecking=accept-new \
     "${HOST}" \
     "set -euo pipefail; forgejo_bin=\$(systemctl show -p ExecStart forgejo.service --value | sed -E 's/^\\{ path=([^ ;]+).*/\\1/'); sudo -u forgejo \"\${forgejo_bin}\" --config /var/lib/forgejo/custom/conf/app.ini --custom-path /var/lib/forgejo/custom --work-path /var/lib/forgejo admin user generate-access-token --username '${CONTACT_USER}' --scopes all --raw --token-name '${token_name}'" \
+    | awk 'NF { line = $0 } END { print line }' \
     | tr -d '\r\n'
 )"