Zoltan Kochan
27be1a9a5a
The Clippy and Doc tasks declare `outputs: []`, so `pnpm pipeline` caches their results, keyed on every file in the repository plus `RUSTFLAGS` (and `RUSTDOCFLAGS` for Doc). Their jobs no longer pass `--no-cache`. A new `remote-cache` composite action points the pipeline at Vercel Remote Cache. It runs only in the merge queue and on pushes to main, which also sign and publish their results, so the Vercel token never reaches pull request code. The push to main tests the tree the merge queue already tested, so its Clippy and Doc rows restore the results instead of recompiling. The action does nothing until the token, team, and public key are configured. The credentials live in the remote-cache environment, which only main and the merge queue branches can use, so a workflow on a pushed branch cannot read the signing key. Dylint keeps `--no-cache`: its run on main saves the build cache pull requests restore, and a cache hit would leave that cache stale.
55 lines
2.0 KiB
YAML
55 lines
2.0 KiB
YAML
name: Remote task cache
|
|
|
|
description: >
|
|
Point `pnpm pipeline` at the Vercel Remote Cache. Configured only in the
|
|
merge queue and on pushes to main, which also publish their results, so the
|
|
Vercel token never reaches pull request code. Does nothing while the token,
|
|
team, or public key is unset. Run it after pnpm is installed.
|
|
|
|
inputs:
|
|
token:
|
|
description: A Vercel access token scoped to the team that owns the cache
|
|
required: true
|
|
team:
|
|
description: The Vercel team ID or slug
|
|
required: true
|
|
public-key:
|
|
description: Base64 P-256 SubjectPublicKeyInfo DER key the results are verified with
|
|
required: true
|
|
private-key:
|
|
description: Base64 P-256 PKCS#8 DER key the published results are signed with
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Configure the remote task cache
|
|
if: ${{ github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
|
|
shell: bash
|
|
env:
|
|
TOKEN: ${{ inputs.token }}
|
|
TEAM: ${{ inputs.team }}
|
|
PUBLIC_KEY: ${{ inputs.public-key }}
|
|
PRIVATE_KEY: ${{ inputs.private-key }}
|
|
BUILDER_ID: ${{ github.workflow }}/${{ github.job }}/${{ runner.os }}
|
|
run: |
|
|
if [ -z "$TOKEN" ] || [ -z "$TEAM" ] || [ -z "$PUBLIC_KEY" ]; then
|
|
echo "The remote task cache is not configured for this repository."
|
|
exit 0
|
|
fi
|
|
pnpm config set //vercel.com/api/:_authToken "$TOKEN"
|
|
{
|
|
echo "PNPM_REMOTE_CACHE_URL=https://vercel.com/api"
|
|
echo "PNPM_REMOTE_CACHE_TEAM=$TEAM"
|
|
echo "PNPM_REMOTE_CACHE_ORG=pnpm"
|
|
echo "PNPM_REMOTE_CACHE_TRUSTED_KEYS={\"pnpm-ci\":\"$PUBLIC_KEY\"}"
|
|
} >> "$GITHUB_ENV"
|
|
if [ -n "$PRIVATE_KEY" ]; then
|
|
{
|
|
echo "PNPM_REMOTE_CACHE_PUBLISH=true"
|
|
echo "PNPM_REMOTE_CACHE_KEY_ID=pnpm-ci"
|
|
echo "PNPM_REMOTE_CACHE_PRIVATE_KEY=$PRIVATE_KEY"
|
|
echo "PNPM_REMOTE_CACHE_BUILDER_ID=$BUILDER_ID"
|
|
} >> "$GITHUB_ENV"
|
|
fi
|