Wire runner caches and forge secrets through agenix

.forgejo/workflows/build-apple.yml

@@ -22,14 +22,17 @@ jobs:
       matrix:
         include:
           - platform: macOS
+            cache-id: macos
             destination: platform=macOS
             rust-targets: x86_64-apple-darwin,aarch64-apple-darwin
           - platform: iOS Simulator
+            cache-id: ios-simulator
             destination: platform=iOS Simulator,name=iPhone 17 Pro
             rust-targets: aarch64-apple-ios-sim,x86_64-apple-ios
     env:
       CARGO_INCREMENTAL: 0
       RUST_BACKTRACE: short
+      RUSTC_WRAPPER: sccache
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -65,12 +68,29 @@ jobs:
           echo "DEVELOPER_DIR=$selected" >> "$GITHUB_ENV"
           DEVELOPER_DIR="$selected" /usr/bin/xcodebuild -version || true
 
+      - name: Prepare Cache Dirs
+        shell: bash
+        run: |
+          set -euo pipefail
+          cache_root="${NSC_CACHE_PATH:-${HOME}/.cache/burrow}"
+          mkdir -p \
+            "${cache_root}/cargo" \
+            "${cache_root}/rustup" \
+            "${cache_root}/sccache" \
+            "${cache_root}/apple/PackageCache" \
+            "${cache_root}/apple/SourcePackages" \
+            "${cache_root}/apple/DerivedData/${{ matrix.cache-id }}"
+          echo "CARGO_HOME=${cache_root}/cargo" >> "${GITHUB_ENV}"
+          echo "RUSTUP_HOME=${cache_root}/rustup" >> "${GITHUB_ENV}"
+          echo "SCCACHE_DIR=${cache_root}/sccache" >> "${GITHUB_ENV}"
+          echo "APPLE_PACKAGE_CACHE=${cache_root}/apple/PackageCache" >> "${GITHUB_ENV}"
+          echo "APPLE_SOURCE_PACKAGES=${cache_root}/apple/SourcePackages" >> "${GITHUB_ENV}"
+          echo "APPLE_DERIVED_DATA=${cache_root}/apple/DerivedData/${{ matrix.cache-id }}" >> "${GITHUB_ENV}"
+
       - name: Install Rust
         shell: bash
         run: |
           set -euo pipefail
-          export RUSTUP_HOME="${HOME}/.rustup"
-          export CARGO_HOME="${HOME}/.cargo"
 
           if ! command -v rustup >/dev/null 2>&1; then
             curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.85.0
@@ -98,6 +118,9 @@ jobs:
           if ! command -v protoc >/dev/null 2>&1; then
             brew install protobuf
           fi
+          if ! command -v sccache >/dev/null 2>&1; then
+            brew install sccache
+          fi
 
       - name: Build
         shell: bash
@@ -111,9 +134,9 @@ jobs:
             -skipPackagePluginValidation \
             -skipMacroValidation \
             -onlyUsePackageVersionsFromResolvedFile \
-            -clonedSourcePackagesDirPath SourcePackages \
-            -packageCachePath "$PWD/PackageCache" \
-            -derivedDataPath "$PWD/DerivedData" \
+            -clonedSourcePackagesDirPath "$APPLE_SOURCE_PACKAGES" \
+            -packageCachePath "$APPLE_PACKAGE_CACHE" \
+            -derivedDataPath "$APPLE_DERIVED_DATA" \
             CODE_SIGNING_ALLOWED=NO \
             CODE_SIGNING_REQUIRED=NO \
             CODE_SIGN_IDENTITY="" \

.forgejo/workflows/build-rust.yml

@@ -17,6 +17,10 @@ jobs:
   rust:
     name: Cargo Test
     runs-on: [self-hosted, linux, x86_64, burrow-forge]
+    env:
+      CARGO_INCREMENTAL: 0
+      RUSTC_WRAPPER: sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -24,8 +28,21 @@ jobs:
           token: ${{ github.token }}
           fetch-depth: 0
 
+      - name: Prepare Cache Dirs
+        shell: bash
+        run: |
+          set -euo pipefail
+          cache_root="${HOME}/.cache/burrow"
+          mkdir -p "${cache_root}/cargo" "${cache_root}/sccache"
+          echo "CARGO_HOME=${cache_root}/cargo" >> "${GITHUB_ENV}"
+          echo "SCCACHE_DIR=${cache_root}/sccache" >> "${GITHUB_ENV}"
+
       - name: Test
         shell: bash
         run: |
           set -euo pipefail
-          nix develop .#ci -c cargo test --workspace --all-features
+          nix develop .#ci -c bash -lc '
+            sccache --zero-stats >/dev/null 2>&1 || true
+            cargo test --workspace --all-features
+            sccache --show-stats || true
+          '

.forgejo/workflows/build-site.yml

@@ -24,6 +24,14 @@ jobs:
           token: ${{ github.token }}
           fetch-depth: 0
 
+      - name: Prepare Cache Dirs
+        shell: bash
+        run: |
+          set -euo pipefail
+          cache_root="${HOME}/.cache/burrow"
+          mkdir -p "${cache_root}/npm"
+          echo "NPM_CONFIG_CACHE=${cache_root}/npm" >> "${GITHUB_ENV}"
+
       - name: Build
         shell: bash
         run: |