push green meta builds to the attic cache and record cached

swarm-secret-client/src/builder.rs

@@ -2,8 +2,9 @@
 //! secret live in the store, and what each object holds.
 //!
 //! swarm-controller mints the forge token; the builder reads it, and its queue
-//! client secret, under its own certificate. Its read stanza in
-//! `swarm-bao.nix` names exactly these two paths.
+//! client secret, under its own certificate. It also reads the cache push
+//! token, which the operator writes. Its read stanza in `swarm-bao.nix` names
+//! exactly these three paths.
 
 use serde::{Deserialize, Serialize};
 
@@ -26,6 +27,30 @@ pub fn forge_token_path() -> Result<String, Error> {
     Ok(format!("{prefix}/forge/token"))
 }
 
+/// The path holding the token the builder pushes closures to the binary cache
+/// with, as an [`AtticPushToken`]. The operator writes it by hand: the cache is
+/// an instance outside the swarm, and no swarm unit mints the token.
+///
+/// Under the cache's own name segment rather than the builder's, since the
+/// token belongs to the cache's tenant.
+///
+/// # Errors
+/// Never in practice: the name segment is a constant. The `Result` is
+/// [`principal_prefix`]'s.
+pub fn attic_push_token_path() -> Result<String, Error> {
+    let prefix = principal_prefix(Kind::Service, "attic")?;
+    Ok(format!("{prefix}/push-token"))
+}
+
+/// What [`attic_push_token_path`] holds.
+///
+/// No `Debug`: `value` writes to the binary cache.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AtticPushToken {
+    /// The token, under the field name the operator writes.
+    pub value: String,
+}
+
 /// The path holding the queue client secret of the builder's OIDC client
 /// `client_id`, where `swarm-secret-publisher.nix` puts every swarm service's.
 ///
@@ -60,5 +85,9 @@ mod tests {
             client_secret_path("swarm-builder").expect("a plain id is legal"),
             "swarm/services/swarm-builder/oidc/client"
         );
+        assert_eq!(
+            attic_push_token_path().expect("a constant segment is legal"),
+            "swarm/services/attic/push-token"
+        );
     }
 }