Repository navigation
Cache native CI dependencies while rebuilding current Server outputs - #826
Conversation
|
Security review of exact The hosted central-policy preflight rejected all three new restore blocks because their broad For useful cross-commit PR reuse without accepting an untrusted cache writer, use one exact shared key (no The scoped paths exclude Cargo credentials/config, action/image references are immutable, and I found no separate secret or permission expansion. I will re-review the corrected exact head. |
|
Security re-review of corrected exact head The broad restore prefix and commit-specific key are gone. All readers now use one exact key covering runner OS/architecture, the pinned workflow/toolchain/build flags, lockfile, root manifest, Cargo configuration, and every vendored dependency input. PR and merge-group runs remain restore-only; only a successful protected-main Hosted central action-policy validation has passed on this exact head. The existing aggregate/partition contract step has also passed; broader cold runtime qualification and measured warm speedup remain owning delivery gates, not security-review claims. |
|
At current head Cold Shared run 40593626884 is not passing. At 22:45 UTC, it has two executed failures:
Normal job-log retrieval was unavailable while the run was active, and a direct completed-job log download timed out. No runtime/fixture cause is inferred from those transport failures, and no rerun, check relaxation or merge has been requested. The remaining matrix jobs continue. Next: classify the retained failures, combine the independently owned #824 workflow changes through the normal path, then obtain clean protected qualification, a successful main cache seed and an equivalent warm measurement. No timing improvement is claimed yet. |
|
|
General qualification update: head The previous head's startup failures were the adapter-only test's obsolete workflow-wide cache count. The corrected test scopes those existing safety assertions to the adapter job. All 2,561 startup comparator tests, 41 partition tests, 74 workflow-isolation tests, central action policy and the full isolation checker pass on this head, combined with merged #824. Next: let merge-group qualification complete, verify a successful main-only cache seed, then compare an equivalent warm run. The cold success proves qualification, not a speedup; no runtime improvement is claimed yet. |
|
Merged #826 is now qualified on main The main native-tests writer job 122557876595 saved the trusted cache successfully. Cache API metadata confirms a 270,100,378-byte entry scoped to Warm measurement is underway on the same commit. First repeat the writer to confirm a cache hit, then repeat the slowest database native-tests job ( |
|
Merged through the normal queue as
The writer's compiler log contains 200 unique compiled crate names cold and 5 warm; the workspace package is compiled twice in both attempts. The warm writer restored the main cache and skipped saving under the existing exact-hit condition. This demonstrates dependency reuse while preserving a fresh workspace build. Hosted runner variation and one repeated sample per job limit the timing conclusion. These are job measurements, not a full-pipeline or sustained-throughput benchmark. Evidence: cold main run, attempt 1, warm writer, attempt 2, warm PostgreSQL job, attempt 3. General resumed one product PR at a time and will use actual CI queue/run times to preserve the CI-first delivery rule. Required checks, matrices, coverage and merge-queue limits were retained. |
|
Security post-merge delta review of exact merge 5c41317: no additional security finding. I compared the previously cleared head ea3b84e with final PR head 86e232d, then compared the cache workflow and cache contract test between that head and the merge tree. The native cache restore/save key, paths, package-clean ordering, and protected-main-only writer logic are unchanged. The later cache-test change only scopes the pre-existing adapter-cache assertions to the adapter job now that the workflow also contains the separately reviewed native cache; the other workflow delta is the independently qualified #824 fixture integration. The two cache files in the final head and merge tree are identical. The final PR checks, protected merge-group qualification, and 43-job main run passed. This closes the exact-tree cache trust review and supplements the earlier corrected-head review; timing conclusions remain General delivery evidence, not a Security claim. |
The artifact summary keeps a test report's last 64 KiB. The comparator report is about 450 KiB, so #826's one failing test (reported early) was missing from its retained summary, and the failure needed a local reproduction to find. When a test summary is cut to its tail, the summary also writes <report>.failures.txt: every TAP `not ok` line with its diagnostic block, within the same per-file and total limits, recorded with derived_from and the failure count. A whole report or a passing one gets no excerpt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shared Server fixture jobs repeatedly compile the same locked native dependencies. In run 40572465856, native-test jobs took 537–1,024 seconds, with 449–923 seconds in their combined bootstrap/build/test step. Those combined timings include tests and setup, so they do not isolate compiler time.
Restore Cargo registry/git dependencies and target dependencies in all three native job families. Only successful
mainpush native tests save a cache. Exact keys include OS, architecture, lockfile, Cargo manifest, vendored crates, Cargo configuration, and workflow/compiler configuration, with no fallback prefixes. Each job removes the current Server package's cached outputs before building, and the writer removes them before saving, so current source and provenance are rebuilt. PRs and merge groups only restore caches. Existing jobs, matrices, commands, checks, permissions, and resource limits are preserved.Validation on current head
86e232d0fd160863abcdee4d30bc3d1a7d21a450, combined with merged #824 (d3aec375): all 2,561 startup comparator tests across 59 files passed, all 41 aggregate/partition tests passed, all 74 workflow-isolation policy tests passed, and central action policy plus the full Docker workflow-isolation check passed. A before/after workflow comparison confirms existing jobs, matrices, commands, limits and permissions are preserved relative to that main. The partition contract recognizes cache restoration and package cleanup as preparation shared by every part. The adapter-cache test keeps its original safety checks within the adapter job; its obsolete workflow-wide cache count previously rejected the new native caches before fixture startup.Cold qualification passed: 56 successful checks and one skipped. Merged through the normal queue as
5c41317e2c546bda0441c1f6585f6adca5079753; merge-group checks and all 43 cold main jobs passed. The main writer seeded a 270,100,378-byte cache. Same-commit warm repeats passed: the slowest PostgreSQL native-tests job fell from 952 to 759 seconds (20.3%); the writer's Cargo test-build phase fell from 164 to 110 seconds and compiled crates from 200 to 5, while its whole job varied from 462 to 498 seconds. No whole-pipeline or sustained-throughput speedup is claimed. No Rust build or test ran locally. Full timing conditions and authoritative hosted evidence are recorded in the final benchmark comment.Related: #325, measured CI handoff.