Wire runner caches and forge secrets through agenix

.forgejo/workflows/build-apple.yml

@@ -22,14 +22,17 @@ jobs:
       matrix:
         include:
           - platform: macOS
+            cache-id: macos
             destination: platform=macOS
             rust-targets: x86_64-apple-darwin,aarch64-apple-darwin
           - platform: iOS Simulator
+            cache-id: ios-simulator
             destination: platform=iOS Simulator,name=iPhone 17 Pro
             rust-targets: aarch64-apple-ios-sim,x86_64-apple-ios
     env:
       CARGO_INCREMENTAL: 0
       RUST_BACKTRACE: short
+      RUSTC_WRAPPER: sccache
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -65,12 +68,29 @@ jobs:
           echo "DEVELOPER_DIR=$selected" >> "$GITHUB_ENV"
           DEVELOPER_DIR="$selected" /usr/bin/xcodebuild -version || true
 
+      - name: Prepare Cache Dirs
+        shell: bash
+        run: |
+          set -euo pipefail
+          cache_root="${NSC_CACHE_PATH:-${HOME}/.cache/burrow}"
+          mkdir -p \
+            "${cache_root}/cargo" \
+            "${cache_root}/rustup" \
+            "${cache_root}/sccache" \
+            "${cache_root}/apple/PackageCache" \
+            "${cache_root}/apple/SourcePackages" \
+            "${cache_root}/apple/DerivedData/${{ matrix.cache-id }}"
+          echo "CARGO_HOME=${cache_root}/cargo" >> "${GITHUB_ENV}"
+          echo "RUSTUP_HOME=${cache_root}/rustup" >> "${GITHUB_ENV}"
+          echo "SCCACHE_DIR=${cache_root}/sccache" >> "${GITHUB_ENV}"
+          echo "APPLE_PACKAGE_CACHE=${cache_root}/apple/PackageCache" >> "${GITHUB_ENV}"
+          echo "APPLE_SOURCE_PACKAGES=${cache_root}/apple/SourcePackages" >> "${GITHUB_ENV}"
+          echo "APPLE_DERIVED_DATA=${cache_root}/apple/DerivedData/${{ matrix.cache-id }}" >> "${GITHUB_ENV}"
+
       - name: Install Rust
         shell: bash
         run: |
           set -euo pipefail
-          export RUSTUP_HOME="${HOME}/.rustup"
-          export CARGO_HOME="${HOME}/.cargo"
 
           if ! command -v rustup >/dev/null 2>&1; then
             curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.85.0
@@ -98,6 +118,9 @@ jobs:
           if ! command -v protoc >/dev/null 2>&1; then
             brew install protobuf
           fi
+          if ! command -v sccache >/dev/null 2>&1; then
+            brew install sccache
+          fi
 
       - name: Build
         shell: bash
@@ -111,9 +134,9 @@ jobs:
             -skipPackagePluginValidation \
             -skipMacroValidation \
             -onlyUsePackageVersionsFromResolvedFile \
-            -clonedSourcePackagesDirPath SourcePackages \
-            -packageCachePath "$PWD/PackageCache" \
-            -derivedDataPath "$PWD/DerivedData" \
+            -clonedSourcePackagesDirPath "$APPLE_SOURCE_PACKAGES" \
+            -packageCachePath "$APPLE_PACKAGE_CACHE" \
+            -derivedDataPath "$APPLE_DERIVED_DATA" \
             CODE_SIGNING_ALLOWED=NO \
             CODE_SIGNING_REQUIRED=NO \
             CODE_SIGN_IDENTITY="" \