Store Path Signing

[zhaofengli]

Right now, nix-actions-cache does not handle signing and leaves everything to Nix. In the bundled GitHub Action, it may be beneficial to provide an option to perform nix store sign with a secret.

We should investigate whether this is necessary/helpful. To quote GitHub's documentations on cache restrictions:

Workflow runs cannot restore caches created for child branches or sibling branches. For example, a cache created for the child feature-b branch would not be accessible to a workflow run triggered on the parent main branch. Similarly, a cache created for the feature-a branch with the base main would not be accessible to its sibling feature-c branch with the base main. Workflow runs also cannot restore caches created for different tag names. For example, a cache created for the tag release-a with the base main would not be accessible to a workflow run triggered for the tag release-b with the base main.

When a cache is created by a workflow run triggered on a pull request, the cache is created for the merge ref (refs/pull/.../merge). Because of this, the cache will have a limited scope and can only be restored by re-runs of the pull request. It cannot be restored by the base branch or other pull requests targeting that base branch.

If I understand correctly, workflows on untrusted PR branches will not be able to pollute the cache view from other branches.