From faeabdf1ada247ddbb4ae3104f9a026326730ede Mon Sep 17 00:00:00 2001
From: "Jeffrey C. Ollie" <jeff@ocjtech.us>
Date: Mon, 28 Sep 2026 03:24:36 -0500
Subject: [PATCH] push what CI builds to the niks3 cache

Follow the current workflow template: allow a manual run, give the job
an OIDC token, and finish by pushing what it built to the niks3 cache,
so that the locally built git and node copies are rebuilt only when
nixpkgs changes them. pinact looks actions up on GitHub, so it is told
to leave the niks3-push pin alone. Also fix the spelling of my name in
.pinact.yaml.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018KmvgNAfpeksNwE2jg6A3g
---
 .forgejo/workflows/build.yaml | 12 +++++++++++-
 .pinact.yaml                  |  7 ++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index be0c714..40481fb 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -2,11 +2,15 @@
 # SPDX-License-Identifier: MIT
 
 name: build nixos-runner
+
 on:
-  - push
+  push:
+  workflow_dispatch:
+
 jobs:
   build:
     runs-on: nixos-do-m
+    enable-openid-connect: true
     steps:
       - name: Checkout code
         uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -32,3 +36,9 @@ jobs:
       #     REPOSITORY: ${{ vars.DOCKER_USERNAME }}/nixos-runner
       #     USERNAME: ${{ vars.DOCKER_USERNAME }}
       #     PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Push to the cache
+        if: ${{ !cancelled() && forge.ref == 'refs/heads/main' }}
+        uses: https://git.jcollie.dev/jeff/niks3-push@3f85f501658e379783381291241c6f8315a92716
+        with:
+          server-url: https://niks3.jcollie.dev
diff --git a/.pinact.yaml b/.pinact.yaml
index aa85f2b..dc68e49 100644
--- a/.pinact.yaml
+++ b/.pinact.yaml
@@ -1,8 +1,13 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
 
-# SPDX-FileCopyrightText: © 2023 Jeffret C. Ollie
+# SPDX-FileCopyrightText: © 2023 Jeffrey C. Ollie
 # SPDX-License-Identifier: MIT
 
 version: 3
 files:
   - pattern: .forgejo/workflows/*.yaml
+ignore_actions:
+  # Not on GitHub, which is where pinact looks a version up; the commit is
+  # pinned by hand.
+  - name: https://git.jcollie.dev/jeff/niks3-push
+    ref: ".*"
-- 
2.51.2