*: configure nix binary cache

Add a [nix binary cache using S3 as the
backend](https://nix.dev/manual/nix/2.25/store/types/s3-binary-cache-store) for
CI builds. This shaves about 3m30s off each CI job.

Author: chrisseto

ci/docker/entrypoint.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# NB: Only our CI agents push to this cache but we don't have PKI (e.g.
+# signing) setup for them.
+## So we mark the cache as trusted to skip signature verifications.
+CACHE="s3://redpanda-nix-cache-k8s-m6id12xlarge?region=us-west-2&trusted=true"
+
+nix develop --option extra-substituters "$CACHE" --impure --command "$@"
+EXIT_CODE="$?"
+
+echo "--- Pushing to :nix: cache"
+nix copy --to "$CACHE" .#devshell
+
+exit "$EXIT_CODE"

ci/docker/nix.Dockerfile

@@ -18,4 +18,6 @@ RUN echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf \
 	# easier to disable this check entirely:
 	&& git config --global --add safe.directory '*'
 
-ENTRYPOINT ["nix", "develop", "--impure", "--command"]
+COPY ci/docker/entrypoint.sh /
+
+ENTRYPOINT ["bash", "/entrypoint.sh"]

ci/scripts/run-in-nix-docker.sh

@@ -33,7 +33,7 @@ fi
 set -e
 
 # BUILDKITE environment variables are used by `buildkite-agent` cli to upload artifact
-printenv | grep '^BUILDKITE.*=' > env-file-for-buildkite
+printenv | { grep '^BUILDKITE.*=' || true; } > env-file-for-buildkite
 
 # Build the base image and grab the SHA.
 IMAGE_SHA=$(docker build --quiet -f ./ci/docker/nix.Dockerfile .)

flake.nix

@@ -36,6 +36,10 @@
         {
           formatter = pkgs.nixpkgs-fmt;
 
+          # Make it possible to reference the devshell context from standard
+          # nix commands. e.g. nix copy .#devshell.
+          packages.devshell = self'.devShells.default;
+
           devshells.default = {
             env = [
               { name = "GOROOT"; value = "${pkgs.go_1_24}/share/go"; }

taskfiles/ci.yml

@@ -9,10 +9,7 @@ tasks:
     - task: set-aio-max
     - task: set-inotify-watches
     - task: set-inotify-instances
-    - task: configure-git-private-repo
     - cmd: "mkdir -p {{.SRC_DIR}}/artifacts"
-    # Fetch the release branches for our git based linters.
-    - cmd: git fetch origin release/v2.4.x
 
   lint:
     cmds:
@@ -24,6 +21,7 @@ tasks:
   test:unit:
     cmds:
       - defer: 'buildkite-agent artifact upload "{{.SRC_DIR}}/artifacts/*"'
+      - 'echo "--- Running unit tests"'
       - task: :test:unit
         vars:
           GO_TEST_RUNNER: 'gotestsum --junitfile=artifacts/unit-tests.xml --'
@@ -33,6 +31,7 @@ tasks:
     cmds:
       - defer: 'kind delete clusters --all'
       - defer: 'buildkite-agent artifact upload "{{.SRC_DIR}}/artifacts/*"'
+      - 'echo "--- Running integration tests"'
       - task: :test:integration
         vars:
           GO_TEST_RUNNER: 'gotestsum --junitfile=artifacts/integration-tests.xml --'
@@ -42,6 +41,7 @@ tasks:
     cmds:
       - defer: 'kind delete clusters --all'
       - defer: 'buildkite-agent artifact upload "{{.SRC_DIR}}/artifacts/*"'
+      - 'echo "--- Running acceptance tests"'
       - task: :test:acceptance
         vars:
           GO_TEST_RUNNER: 'gotestsum --junitfile=artifacts/acceptance-tests.xml --'
@@ -66,16 +66,6 @@ tasks:
         vars:
           KUTTL_CONFIG_FILE: kuttl-v2-test.yaml
 
-  configure-git-private-repo:
-    internal: true
-    env:
-      GITHUB_TOKEN:
-        sh: echo "${GITHUB_TOKEN:-$GITHUB_API_TOKEN}"
-    cmds:
-      - git config --global url."https://$GITHUB_TOKEN@github.com/".insteadOf "https://github.com/"
-    preconditions:
-      - test -n "$GITHUB_API_TOKEN" || test -n "$GITHUB_TOKEN"
-
   run-kuttl-tests:
     cmds:
       - defer: