Harmonize GHA workflows a little, add nix-bincache.rory.gay to trusted list to make github go brr

.github/workflows/build-docker.yml

@@ -26,7 +26,11 @@ jobs:
       - uses: actions/checkout@v6
       - uses: cachix/install-nix-action@v31
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
+          extra_nix_config: |
+            system-features = nixos-test benchmark big-parallel kvm
+            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-bincache.rory.gay:663PIW8xxgIImxLcsokODWI2PHFWXvzJEfjX6TaIjxQ=
+            trusted-substituters = https://cache.nixos.org https://nix-bincache.rory.gay
+
       - name: Build the docker image
         run: nix build .#containers.x86_64-linux.docker.${{ matrix.package }}
       - run: docker load < result

.github/workflows/dependabot-nix-update.yml

@@ -14,10 +14,15 @@ jobs:
       contents: write
     steps:
       - name: Check Out Code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            system-features = nixos-test benchmark big-parallel kvm
+            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-bincache.rory.gay:663PIW8xxgIImxLcsokODWI2PHFWXvzJEfjX6TaIjxQ=
+            trusted-substituters = https://cache.nixos.org https://nix-bincache.rory.gay
 
       - name: Update Nix Flake
         run: nix flake update --extra-experimental-features 'nix-command flakes'

.github/workflows/nix-build.yml

@@ -9,11 +9,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - uses: cachix/install-nix-action@v31
       with:
-        nix_path: nixpkgs=channel:nixos-unstable
-    #- uses: DeterminateSystems/magic-nix-cache-action@v13
+        extra_nix_config: |
+          system-features = nixos-test benchmark big-parallel kvm
+          trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-bincache.rory.gay:663PIW8xxgIImxLcsokODWI2PHFWXvzJEfjX6TaIjxQ=
+          trusted-substituters = https://cache.nixos.org https://nix-bincache.rory.gay
+
     - run: nix build -L -j auto
     - run: nix develop --command echo OK
     - run: nix flake check -vL -j auto

.github/workflows/style.yml

@@ -8,7 +8,6 @@ on:
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
     strategy:
@@ -17,7 +16,7 @@ jobs:
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@v5
       with: