Adding a substituter such as a Cachix cache through --option extra-substituters has no effect for a non-trusted user. Nix ignores substituters and public keys supplied by an untrusted caller, silently, and rebuilds from source. The build succeeds, so the only symptom is that it takes an hour.
A user is trusted if listed in trusted-users in the daemon's nix.conf, or if using a single-user installation with no daemon. Alternatively the substituter can be listed in trusted-substituters, which permits any user to opt into it, or added to the system-wide substituters and trusted-public-keys where it applies to everyone.
The flake-level nixConfig attribute has the same limitation and additionally prompts for confirmation on interactive use, so it cannot be relied on in CI. Confirm which substituters are actually in effect with nix config show substituters and nix config show trusted-public-keys, run as the same user that will do the build. Changing nix.conf requires restarting the daemon on multi-user installations.