ci/cache: Collect garbage before pushes

Run retention cleanup before uploading build results so inode
exhaustion cannot prevent CI from reaching its only garbage-collection
step.

.gitea/workflows/ci.yaml

@@ -37,6 +37,10 @@ jobs:
         env:
           HARMONIA_SSH_KEY: ${{ secrets.HARMONIA_SSH_KEY }}
         run: |
+          # Make room before pushing so a full cache cannot prevent the GC at
+          # the end of a successful run from ever being reached.
+          ci/push-to-cache.sh --gc
+
           nix eval --json --apply "builtins.attrNames" .#ci.x86_64-linux | jq -cr '.[]' | while read job; do
             echo "::group::Build $job"
             nix build --no-link .#ci.x86_64-linux."$job"

ci/push-to-cache.sh

@@ -10,6 +10,11 @@ remote_cmd() {
   ssh -i "$SSH_KEY" "$SSH_HOST" env HOME=/run/harmonia NIX_REMOTE="$REMOTE_STORE" "$@"
 }
 
+collect_garbage() {
+  echo "Collecting garbage..."
+  remote_cmd nix-collect-garbage --delete-older-than 60d
+}
+
 umask_old=$(umask)
 umask 0066
 echo "$HARMONIA_SSH_KEY" | base64 -d > "$SSH_KEY"
@@ -17,6 +22,12 @@ umask $umask_old
 
 mkdir -p ~/.ssh
 cp ci/known_hosts ~/.ssh/
+
+if [ "${1-}" = "--gc" ]; then
+  collect_garbage
+  exit
+fi
+
 path="$1"
 
 echo "Pushing $path to cache..."
@@ -26,6 +37,5 @@ if [ -n "$UPDATE_PROFILE" ]; then
   echo "Updating profile..."
   remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
 
-  echo "Collecting garbage..."
+  collect_garbage
-  remote_cmd nix-collect-garbage --delete-older-than 60d
 fi

docs/deployment.md

@@ -222,7 +222,9 @@ On pushes to `master`, this installs Determinate Nix on the runner (via
 Harmonia substituter as the boxes), runs `nix flake check --no-build`, then builds every attribute
 of `.#ci.x86_64-linux`: systems as `system-<name>`, homes as `home-<name>` (with `@` changed to
 `-at-`), packages as `package-<name>`, and the development `shell`. Each result is pushed to the
-Harmonia cache with [`ci/push-to-cache.sh`](../ci/push-to-cache.sh).
+Harmonia cache with [`ci/push-to-cache.sh`](../ci/push-to-cache.sh). Before the first push, the
+workflow collects cache paths older than its retention period so a full cache cannot prevent
+collection from being reached.
 
 It then builds `.#ciDrv.x86_64-linux`, a `linkFarm` of all CI attributes, and pushes it with
 `UPDATE_PROFILE=1`. That updates the `nixfiles` profile on the cache box and collects old paths