workflows: never push source to cachix

Pushing the source path to cachix is pointless, because the only source
we're using is Nixpkgs - and that will always be available already via
checkout. No need to ever substitute it, so no need to push it either.

(cherry picked from commit 2400bdf0d4)

.github/workflows/build.yml

@@ -65,6 +65,7 @@ jobs:
           name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
           extraPullNames: nixpkgs-ci
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: -source$
 
       - run: nix-env --install -f pinned -A nix-build-uncached
 

.github/workflows/check.yml

@@ -116,6 +116,7 @@ jobs:
           name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
           extraPullNames: nixpkgs-ci
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: -source$
 
       - name: Build codeowners validator
         run: nix-build trusted/ci --arg nixpkgs ./pinned -A codeownersValidator