Merge pull request #52 from DeterminateSystems/untrusted

Behave well when  MNCA isn't trusted

.github/workflows/ci.yml

@@ -44,6 +44,29 @@ jobs:
       - name: Cache the store
         uses: ./
 
+  run-x86_64-linux-untrusted:
+    name: Run x86_64 Linux, Untrusted
+    runs-on: ubuntu-22.04
+    permissions:
+      id-token: "write"
+      contents: "read"
+    env:
+      ACTIONS_STEP_DEBUG: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          flakehub: true
+          extra-conf: |
+            narinfo-cache-negative-ttl = 0
+            trusted-users = root
+      - name: Cache the store
+        uses: ./
+      - name: Check the cache isn't enabled
+        run: |
+          [ $(nix config show substituters) == "https://cache.nixos.org/" ]
+
   run-x86_64-linux:
     name: Run x86_64 Linux
     runs-on: ubuntu-22.04