mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
e1f6da7c42
## Summary Gate 1 only for desktop release caching: - replaces canary `rust-cache` use with explicit exact-key `actions/cache/restore` + `save` - computes keys after `cargo update --workspace`, including platform, target, Rust toolchain, Cargo manifests/locks, profile/features, and native-toolchain inputs - normalizes only the desktop package version so a trusted `main` canary can warm an otherwise identical release tag - excludes Tauri bundle directories, so installers and signed artifacts are never cached - adds a restore-only `cache-proof-*` tag workflow that fails unless tag scope sees the exact default-branch cache - adds contract tests that enforce no release-workflow cache change in Gate 1 `release.yml` is intentionally unchanged. A cache miss remains the current cold canary build; the release path cannot be affected by merging this PR. ## Validation - `scripts/test-desktop-release-cache-key.sh` - `scripts/test-desktop-release-cache-workflow.sh` - `scripts/test-release-ref-contract.sh` - Ruby YAML parse of all four changed workflows - `git diff --check` - pre-push `branch-skew` ## Post-merge proof plan 1. Run each canary cold on trusted `main`, recording cache size/save time and fresh artifact inventory. 2. Run each canary warm, requiring the exact-key hit and recording restore/build time. 3. Create a disposable `cache-proof-*` tag at that same trusted `main` SHA and dispatch **Desktop release cache tag-scope proof** from the tag. 4. Do not begin Gate 2 or modify `release.yml` unless the exact tag-scope restore succeeds and cache transfer economics are favorable. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
165 lines
7.4 KiB
YAML
165 lines
7.4 KiB
YAML
name: Desktop release cache tag-scope proof
|
|
|
|
# Dispatch from a cache-proof-* tag at the same trusted-main SHA warmed by all
|
|
# four canaries. Every job restores only and requires an exact cache hit.
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
macos:
|
|
name: Prove macOS ${{ matrix.target }} cache visibility
|
|
if: github.repository == 'block/buzz'
|
|
runs-on: macos-latest
|
|
timeout-minutes: 15
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- target: aarch64-apple-darwin
|
|
features: mesh-llm
|
|
- target: x86_64-apple-darwin
|
|
features: default
|
|
steps:
|
|
- name: Require cache proof tag
|
|
run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
|
- name: Patch proof dependency graph
|
|
run: |
|
|
cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
|
|
cd src-tauri && cargo update --workspace
|
|
- name: Resolve native toolchain identity
|
|
id: native_toolchain
|
|
run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT"
|
|
- name: Compute exact release cache key
|
|
id: rust_cache_key
|
|
env:
|
|
CACHE_TARGET: ${{ matrix.target }}
|
|
CACHE_FEATURES: ${{ matrix.features }}
|
|
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
|
run: |
|
|
KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target "$CACHE_TARGET" --features "$CACHE_FEATURES" --native-inputs "$NATIVE_TOOLCHAIN_ID")
|
|
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
|
- name: Restore exact default-branch cache from tag
|
|
id: rust_cache
|
|
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
target
|
|
desktop/src-tauri/target
|
|
!desktop/src-tauri/target/**/release/bundle
|
|
key: ${{ steps.rust_cache_key.outputs.key }}
|
|
- name: Require exact cache hit
|
|
env:
|
|
CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
|
|
CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
|
|
EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
|
|
run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'
|
|
|
|
linux:
|
|
name: Prove Linux cache visibility
|
|
if: github.repository == 'block/buzz'
|
|
runs-on: ubuntu-latest
|
|
container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
|
|
timeout-minutes: 15
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
steps:
|
|
- name: Require cache proof tag and install release native tools
|
|
run: |
|
|
[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends build-essential ca-certificates curl git libasound2-dev libayatana-appindicator3-dev libgtk-3-dev librsvg2-dev libssl-dev libwebkit2gtk-4.1-dev libxdo-dev patchelf pkg-config
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
- run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
|
- name: Patch proof dependency graph
|
|
run: |
|
|
cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
|
|
cd src-tauri && cargo update --workspace
|
|
- name: Resolve native toolchain identity
|
|
id: native_toolchain
|
|
run: echo "id=$(scripts/desktop-native-toolchain-id.sh linux)" >> "$GITHUB_OUTPUT"
|
|
- name: Compute exact release cache key
|
|
id: rust_cache_key
|
|
env:
|
|
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
|
run: |
|
|
KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-unknown-linux-gnu --features mesh-llm --native-inputs "$NATIVE_TOOLCHAIN_ID")
|
|
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
|
- name: Restore exact default-branch cache from tag
|
|
id: rust_cache
|
|
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
target
|
|
desktop/src-tauri/target
|
|
!desktop/src-tauri/target/**/release/bundle
|
|
key: ${{ steps.rust_cache_key.outputs.key }}
|
|
- name: Require exact cache hit
|
|
env:
|
|
CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
|
|
CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
|
|
EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
|
|
run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'
|
|
|
|
windows:
|
|
name: Prove Windows cache visibility
|
|
if: github.repository == 'block/buzz'
|
|
runs-on: windows-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Require cache proof tag
|
|
shell: bash
|
|
run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
- name: Patch proof dependency graph
|
|
shell: bash
|
|
run: |
|
|
cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
|
|
cd src-tauri && cargo update --workspace
|
|
- name: Resolve native toolchain identity
|
|
id: native_toolchain
|
|
shell: bash
|
|
run: echo "id=$(scripts/desktop-native-toolchain-id.sh windows)" >> "$GITHUB_OUTPUT"
|
|
- name: Compute exact release cache key
|
|
id: rust_cache_key
|
|
shell: bash
|
|
env:
|
|
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
|
run: |
|
|
KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-pc-windows-msvc --features default --native-inputs "$NATIVE_TOOLCHAIN_ID")
|
|
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
|
- name: Restore exact default-branch cache from tag
|
|
id: rust_cache
|
|
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
target
|
|
desktop/src-tauri/target
|
|
!desktop/src-tauri/target/**/release/bundle
|
|
key: ${{ steps.rust_cache_key.outputs.key }}
|
|
- name: Require exact cache hit
|
|
shell: bash
|
|
env:
|
|
CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
|
|
CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
|
|
EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
|
|
run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'
|