fix(ci): separate Nix cache population from branch checks

.agents/skills/watch-github-actions/SKILL.md

@@ -145,6 +145,11 @@ The public diagnostic intentionally omits them; detailed review needs an
 approved private destination. Helpers must come from the workflow revision,
 not from the candidate under scan.
 
+`setup-nix` always uses read-only Cachix access. `Populate Nix Cache` is the only
+cache writer and runs after pushes to `main`. If it fails because its credential
+is missing, follow the environment setup in `CI.md#nix-cache-access`; never add
+a Cachix write token to repository or organization secrets.
+
 `setup-nix` retries development-shell preparation once when `prepare-shell`
 is enabled. Inspect both attempts in the job log; `setup-rust` assumes the
 shell has already been prepared. Cargo, lint, and test commands are not retried.

.github/actions/setup-nix/action.yml

@@ -2,14 +2,9 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Setup Nix
-description: Install Determinate Nix, configure Cachix, and optionally prepare the development shell
+description: Install Determinate Nix, configure read-only Cachix access, and optionally prepare the development shell
 
 inputs:
-  cachix-auth-token:
-    description: Token used to write build outputs to Cachix
-    required: false
-    default: ""
-
   prepare-shell:
     description: Prepare the development shell, retrying once on failure
     required: false
@@ -30,8 +25,7 @@ runs:
     - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
       with:
         name: openshell
-        authToken: ${{ inputs.cachix-auth-token }}
-        skipPush: ${{ inputs.cachix-auth-token == '' }}
+        skipPush: true
 
     - name: Prepare Nix development shell
       if: inputs.prepare-shell == 'true'

.github/workflows/branch-checks.yml

@@ -192,7 +192,6 @@ jobs:
 
       - uses: ./.github/actions/setup-nix
         with:
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
           prepare-shell: "true"
           shell-installable: .#devShells.x86_64-linux.default
 
@@ -211,7 +210,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - name: Format
         shell: nix develop -c bash -euo pipefail {0}
@@ -233,7 +231,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - name: Verify Cargo lockfiles
         shell: nix develop -c bash -euo pipefail {0}
@@ -261,7 +258,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - uses: ./.github/actions/setup-rust
         with:
@@ -298,7 +294,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - uses: ./.github/actions/setup-rust
         with:
@@ -329,7 +324,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - uses: ./.github/actions/setup-rust
         with:
@@ -365,7 +359,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - uses: ./.github/actions/setup-rust
         with:
@@ -415,7 +408,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - uses: ./.github/actions/setup-rust
         with:
@@ -440,7 +432,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - uses: ./.github/actions/setup-rust
         with:
@@ -467,7 +458,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - uses: ./.github/actions/setup-rust
         with:
@@ -524,6 +514,7 @@ jobs:
 
       - name: Test release qualification summary
         run: mise run test:qualification-summary
+
   go:
     name: Go SDK
     needs: pr_metadata

.github/workflows/branch-e2e.yml

@@ -108,8 +108,6 @@ jobs:
     uses: ./.github/workflows/build-binaries.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-gateway-plain:
     name: openshell-gateway driver-free (${{ matrix.triple }})
@@ -134,7 +132,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - uses: ./.github/actions/build-rust-binary
         with:
           package: openshell-gateway
@@ -175,7 +172,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - uses: ./.github/actions/build-rust-binary
         with:
           package: ${{ matrix.package }}
@@ -191,8 +187,6 @@ jobs:
     uses: ./.github/workflows/build-vm-driver.yml
     with:
       cargo-version: ${{ needs.version.outputs.cargo }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-images:
     needs: [pr_metadata, build-binaries]

.github/workflows/build-binaries.yml

@@ -17,9 +17,6 @@ on:
         required: false
         type: string
         default: ""
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: true
 
 permissions:
   contents: read
@@ -52,7 +49,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - uses: ./.github/actions/build-rust-binary
         with:
           package: ${{ env.PACKAGE }}

.github/workflows/build-vm-driver.yml

@@ -17,9 +17,6 @@ on:
         required: false
         type: string
         default: ""
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: true
 
 permissions:
   contents: read
@@ -54,7 +51,6 @@ jobs:
       - uses: ./.github/actions/setup-nix
         with:
           prepare-shell: "true"
-          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - name: Download openshell-sandbox
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/cachix.yml

@@ -0,0 +1,67 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Populate Nix Cache
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cachix-write
+  cancel-in-progress: false
+
+jobs:
+  populate:
+    if: github.repository == 'NVIDIA/OpenShell' && github.event_name == 'push' && github.ref == 'refs/heads/main'
+    # Configure this environment to allow only the main branch BEFORE adding
+    # its secret. Ref checks in YAML cannot protect a repository-wide secret.
+    environment: cachix-write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - system: x86_64-linux
+            runner: ubuntu-24.04
+          - system: aarch64-linux
+            runner: ubuntu-24.04-arm
+          - system: aarch64-darwin
+            runner: macos-15-xlarge
+    # Keep credential-bearing work on fresh GitHub-hosted runners.
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    steps:
+      - name: Require the environment credential
+        env:
+          CACHIX_WRITE_TOKEN: ${{ secrets.CACHIX_WRITE_TOKEN }}
+        run: |
+          if [ -z "$CACHIX_WRITE_TOKEN" ]; then
+            echo "::error::Configure the cachix-write environment as documented in CI.md."
+            exit 1
+          fi
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+
+      - uses: DeterminateSystems/determinate-nix-action@e847f25223456b3058e12f7fc9d777b6a6f25060 # v3.23.2
+        with:
+          github-token: ${{ github.token }}
+          summarize: false
+
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: openshell
+          authToken: ${{ secrets.CACHIX_WRITE_TOKEN }}
+
+      - name: Build the development shell and VM runtime
+        env:
+          NIX_SYSTEM: ${{ matrix.system }}
+        run: |
+          # HTTP 416 is not retried by Nix; restart the build once on failure.
+          nix build --no-link ".#devShells.${NIX_SYSTEM}.default" .#vm-runtime || \
+            nix build --no-link ".#devShells.${NIX_SYSTEM}.default" .#vm-runtime

.github/workflows/release-build.yml

@@ -27,9 +27,6 @@ on:
       source_sha:
         description: Source commit resolved from the release tag
         value: ${{ jobs.compute-versions.outputs.source_sha }}
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
 
 permissions:
   contents: read
@@ -116,8 +113,6 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       supervisor-image-tag: ${{ needs.compute-versions.outputs.semver }}
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-vm-driver:
     needs: [compute-versions, build-binaries]
@@ -128,8 +123,6 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       supervisor-image-tag: ${{ needs.compute-versions.outputs.semver }}
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   package-binaries:
     needs: [compute-versions, build-binaries, build-vm-driver]

.github/workflows/release-dev.yml

@@ -68,8 +68,6 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       supervisor-image-tag: dev
       checkout-ref: ${{ github.sha }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   build-vm-driver:
     needs: [compute-versions, build-binaries]
@@ -80,8 +78,6 @@ jobs:
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
       supervisor-image-tag: dev
       checkout-ref: ${{ github.sha }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   package-binaries:
     needs: [build-binaries, build-vm-driver]

.github/workflows/release-prerelease.yml

@@ -28,8 +28,6 @@ jobs:
     with:
       release-tag: ${{ inputs.tag || github.ref_name }}
       is-prerelease: true
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   publish:
     name: Publish
@@ -66,7 +64,6 @@ jobs:
       is-prerelease: true
     secrets:
       CODEX_SECURITY_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   notify-prerelease-success:
     name: Notify Prerelease Success

.github/workflows/release-qualification.yml

@@ -21,8 +21,6 @@ on:
     secrets:
       CODEX_SECURITY_API_KEY:
         required: true
-      CACHIX_AUTH_TOKEN:
-        required: false
 
 permissions:
   contents: read
@@ -51,8 +49,6 @@ jobs:
         ghcr.io/nvidia/openshell/gateway:${{ inputs.source-sha }}
         ghcr.io/nvidia/openshell/sandbox:${{ inputs.source-sha }}
         ghcr.io/nvidia/openshell/supervisor:${{ inputs.source-sha }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   prepare-integration:
     permissions:

.github/workflows/release-tag.yml

@@ -26,8 +26,6 @@ jobs:
     with:
       release-tag: ${{ inputs.tag || github.ref_name }}
       is-prerelease: false
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   qualify:
     name: Qualify
@@ -45,7 +43,6 @@ jobs:
       is-prerelease: false
     secrets:
       CODEX_SECURITY_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   publish:
     name: Publish

.github/workflows/security-scan.yml

@@ -40,9 +40,6 @@ on:
         description: Newline-separated packaged Helm chart OCI references for Trivy
         default: ""
         type: string
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
 
 permissions:
   contents: read
@@ -73,8 +70,6 @@ jobs:
       ignore-unfixed: false
       images: ${{ inputs.images }}
       charts: ${{ inputs.charts }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
   cargo-deny:
     name: Cargo Deny
@@ -95,5 +90,3 @@ jobs:
     with:
       candidate_ref: ${{ inputs.candidate_ref }}
       fail-on-findings: ${{ inputs.fail-on-static-findings }}
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}