mirror of
https://github.com/block/buzz.git
synced 2026-10-27 04:30:52 +00:00
ci: add guarded desktop release cache prewarm (#4575)
## Summary Gate 1 only for desktop release caching: - replaces canary `rust-cache` use with explicit exact-key `actions/cache/restore` + `save` - computes keys after `cargo update --workspace`, including platform, target, Rust toolchain, Cargo manifests/locks, profile/features, and native-toolchain inputs - normalizes only the desktop package version so a trusted `main` canary can warm an otherwise identical release tag - excludes Tauri bundle directories, so installers and signed artifacts are never cached - adds a restore-only `cache-proof-*` tag workflow that fails unless tag scope sees the exact default-branch cache - adds contract tests that enforce no release-workflow cache change in Gate 1 `release.yml` is intentionally unchanged. A cache miss remains the current cold canary build; the release path cannot be affected by merging this PR. ## Validation - `scripts/test-desktop-release-cache-key.sh` - `scripts/test-desktop-release-cache-workflow.sh` - `scripts/test-release-ref-contract.sh` - Ruby YAML parse of all four changed workflows - `git diff --check` - pre-push `branch-skew` ## Post-merge proof plan 1. Run each canary cold on trusted `main`, recording cache size/save time and fresh artifact inventory. 2. Run each canary warm, requiring the exact-key hit and recording restore/build time. 3. Create a disposable `cache-proof-*` tag at that same trusted `main` SHA and dispatch **Desktop release cache tag-scope proof** from the tag. 4. Do not begin Gate 2 or modify `release.yml` unless the exact tag-scope restore succeeds and cache transfer economics are favorable. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
This commit is contained in:
Wes
164
.github/workflows/desktop-release-cache-proof.yml
vendored
Normal file
164
.github/workflows/desktop-release-cache-proof.yml
vendored
Normal file
@@ -0,0 +1,164 @@
|
||||
name: Desktop release cache tag-scope proof
|
||||
|
||||
# Dispatch from a cache-proof-* tag at the same trusted-main SHA warmed by all
|
||||
# four canaries. Every job restores only and requires an exact cache hit.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
macos:
|
||||
name: Prove macOS ${{ matrix.target }} cache visibility
|
||||
if: github.repository == 'block/buzz'
|
||||
runs-on: macos-latest
|
||||
timeout-minutes: 15
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- target: aarch64-apple-darwin
|
||||
features: mesh-llm
|
||||
- target: x86_64-apple-darwin
|
||||
features: default
|
||||
steps:
|
||||
- name: Require cache proof tag
|
||||
run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
||||
- name: Patch proof dependency graph
|
||||
run: |
|
||||
cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
|
||||
cd src-tauri && cargo update --workspace
|
||||
- name: Resolve native toolchain identity
|
||||
id: native_toolchain
|
||||
run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT"
|
||||
- name: Compute exact release cache key
|
||||
id: rust_cache_key
|
||||
env:
|
||||
CACHE_TARGET: ${{ matrix.target }}
|
||||
CACHE_FEATURES: ${{ matrix.features }}
|
||||
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
||||
run: |
|
||||
KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target "$CACHE_TARGET" --features "$CACHE_FEATURES" --native-inputs "$NATIVE_TOOLCHAIN_ID")
|
||||
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
||||
- name: Restore exact default-branch cache from tag
|
||||
id: rust_cache
|
||||
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
- name: Require exact cache hit
|
||||
env:
|
||||
CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
|
||||
CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
|
||||
EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
|
||||
run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'
|
||||
|
||||
linux:
|
||||
name: Prove Linux cache visibility
|
||||
if: github.repository == 'block/buzz'
|
||||
runs-on: ubuntu-latest
|
||||
container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
|
||||
timeout-minutes: 15
|
||||
defaults:
|
||||
run:
|
||||
shell: bash
|
||||
steps:
|
||||
- name: Require cache proof tag and install release native tools
|
||||
run: |
|
||||
[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }
|
||||
apt-get update
|
||||
apt-get install -y --no-install-recommends build-essential ca-certificates curl git libasound2-dev libayatana-appindicator3-dev libgtk-3-dev librsvg2-dev libssl-dev libwebkit2gtk-4.1-dev libxdo-dev patchelf pkg-config
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
- run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
||||
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
||||
- name: Patch proof dependency graph
|
||||
run: |
|
||||
cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
|
||||
cd src-tauri && cargo update --workspace
|
||||
- name: Resolve native toolchain identity
|
||||
id: native_toolchain
|
||||
run: echo "id=$(scripts/desktop-native-toolchain-id.sh linux)" >> "$GITHUB_OUTPUT"
|
||||
- name: Compute exact release cache key
|
||||
id: rust_cache_key
|
||||
env:
|
||||
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
||||
run: |
|
||||
KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-unknown-linux-gnu --features mesh-llm --native-inputs "$NATIVE_TOOLCHAIN_ID")
|
||||
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
||||
- name: Restore exact default-branch cache from tag
|
||||
id: rust_cache
|
||||
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
- name: Require exact cache hit
|
||||
env:
|
||||
CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
|
||||
CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
|
||||
EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
|
||||
run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'
|
||||
|
||||
windows:
|
||||
name: Prove Windows cache visibility
|
||||
if: github.repository == 'block/buzz'
|
||||
runs-on: windows-latest
|
||||
timeout-minutes: 15
|
||||
steps:
|
||||
- name: Require cache proof tag
|
||||
shell: bash
|
||||
run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Patch proof dependency graph
|
||||
shell: bash
|
||||
run: |
|
||||
cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
|
||||
cd src-tauri && cargo update --workspace
|
||||
- name: Resolve native toolchain identity
|
||||
id: native_toolchain
|
||||
shell: bash
|
||||
run: echo "id=$(scripts/desktop-native-toolchain-id.sh windows)" >> "$GITHUB_OUTPUT"
|
||||
- name: Compute exact release cache key
|
||||
id: rust_cache_key
|
||||
shell: bash
|
||||
env:
|
||||
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
||||
run: |
|
||||
KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-pc-windows-msvc --features default --native-inputs "$NATIVE_TOOLCHAIN_ID")
|
||||
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
||||
- name: Restore exact default-branch cache from tag
|
||||
id: rust_cache
|
||||
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
- name: Require exact cache hit
|
||||
shell: bash
|
||||
env:
|
||||
CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
|
||||
CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
|
||||
EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
|
||||
run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'
|
||||
66
.github/workflows/linux-canary.yml
vendored
66
.github/workflows/linux-canary.yml
vendored
@@ -7,8 +7,8 @@ name: Linux Canary
|
||||
# Design notes vs. signed-macos-canary.yml:
|
||||
# - fix-appimage.sh is run without signing env vars; the script detects
|
||||
# their absence and skips re-signing, repacking only (documented inline).
|
||||
# - mold linker added (rui314/setup-mold) to reduce link time, matching
|
||||
# the Linux Rust CI jobs in ci.yml.
|
||||
# - Build tools match release.yml; cache keys derive the concrete linker and
|
||||
# native library identity rather than assuming the moving runner image.
|
||||
# - pnpm store restore/save pattern mirrors ci.yml:149-196.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
@@ -83,18 +83,6 @@ jobs:
|
||||
|
||||
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
||||
|
||||
- uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
|
||||
|
||||
# Rust cache covering both the workspace sidecar build and the Tauri
|
||||
# crate build. shared-key scoped to linux-canary-release so canary runs
|
||||
# warm each other without colliding with CI's debug-profile keys.
|
||||
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
|
||||
with:
|
||||
workspaces: |
|
||||
.
|
||||
desktop/src-tauri
|
||||
shared-key: linux-canary-release
|
||||
|
||||
- name: Install appimagetool
|
||||
run: |
|
||||
case "$(uname -m)" in
|
||||
@@ -154,6 +142,38 @@ jobs:
|
||||
cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
|
||||
cd src-tauri && cargo update --workspace
|
||||
|
||||
- name: Resolve native toolchain identity
|
||||
id: native_toolchain
|
||||
run: echo "id=$(scripts/desktop-native-toolchain-id.sh linux)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Compute this after cargo update so the key describes the graph that is
|
||||
# actually compiled. The helper normalizes only Buzz Desktop's release
|
||||
# version, allowing a canary to warm an otherwise identical tag build.
|
||||
- name: Compute exact release cache key
|
||||
id: rust_cache_key
|
||||
env:
|
||||
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
||||
run: |
|
||||
KEY=$(scripts/desktop-release-cache-key.py \
|
||||
--platform "$RUNNER_OS" \
|
||||
--target x86_64-unknown-linux-gnu \
|
||||
--features mesh-llm \
|
||||
--native-inputs "$NATIVE_TOOLCHAIN_ID")
|
||||
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
||||
echo "Release cache key: $KEY"
|
||||
|
||||
- name: Restore exact release Cargo cache
|
||||
id: rust_cache
|
||||
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
|
||||
- name: Generate non-updating bundle config
|
||||
run: |
|
||||
cat > desktop/src-tauri/tauri.canary.conf.json <<'JSON'
|
||||
@@ -190,6 +210,24 @@ jobs:
|
||||
fi
|
||||
bash desktop/scripts/fix-appimage.sh "${APPIMAGES[0]}"
|
||||
|
||||
- name: Measure release Cargo cache inputs
|
||||
if: always()
|
||||
run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true
|
||||
|
||||
# Only this trusted, main-bound canary writes the cache. Excluding bundle
|
||||
# output prevents installers from entering it.
|
||||
- name: Save exact release Cargo cache
|
||||
if: steps.rust_cache.outputs.cache-hit != 'true'
|
||||
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
|
||||
- name: Save pnpm store cache
|
||||
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
|
||||
126
.github/workflows/macos-intel-canary.yml
vendored
Normal file
126
.github/workflows/macos-intel-canary.yml
vendored
Normal file
@@ -0,0 +1,126 @@
|
||||
name: macOS Intel Canary
|
||||
|
||||
# Produces an unsigned Intel DMG from trusted main. Its release-equivalent
|
||||
# Cargo state warms the distinct x86_64 release target without signing or
|
||||
# publishing anything.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: Build macOS Intel canary
|
||||
if: github.repository == 'block/buzz'
|
||||
runs-on: macos-latest
|
||||
timeout-minutes: 60
|
||||
env:
|
||||
TARGET: x86_64-apple-darwin
|
||||
steps:
|
||||
- name: Require main
|
||||
env:
|
||||
SOURCE_REF: ${{ github.ref }}
|
||||
run: |
|
||||
if [[ "$SOURCE_REF" != "refs/heads/main" ]]; then
|
||||
echo "::error::Canary builds must run from main; got $SOURCE_REF"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
||||
|
||||
- name: Add Rust target
|
||||
run: rustup target add "$TARGET"
|
||||
|
||||
- name: Install desktop dependencies
|
||||
run: just desktop-install-ci
|
||||
|
||||
- name: Derive and patch canary version
|
||||
run: |
|
||||
BASE_VERSION=$(node -p "require('./desktop/package.json').version")
|
||||
VERSION="${BASE_VERSION%%-*}-intel-test.${GITHUB_RUN_NUMBER}"
|
||||
cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
|
||||
cd src-tauri && cargo update --workspace
|
||||
|
||||
- name: Resolve native toolchain identity
|
||||
id: native_toolchain
|
||||
run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Compute exact release cache key
|
||||
id: rust_cache_key
|
||||
env:
|
||||
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
||||
run: |
|
||||
KEY=$(scripts/desktop-release-cache-key.py \
|
||||
--platform "$RUNNER_OS" \
|
||||
--target "$TARGET" \
|
||||
--features default \
|
||||
--native-inputs "$NATIVE_TOOLCHAIN_ID")
|
||||
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
||||
echo "Release cache key: $KEY"
|
||||
|
||||
- name: Restore exact release Cargo cache
|
||||
id: rust_cache
|
||||
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
|
||||
- name: Generate non-updating bundle config
|
||||
run: |
|
||||
cat > desktop/src-tauri/tauri.canary.conf.json <<'JSON'
|
||||
{"bundle":{"createUpdaterArtifacts":false,"macOS":{"minimumSystemVersion":"10.15"}}}
|
||||
JSON
|
||||
|
||||
- name: Build Intel sidecars
|
||||
run: |
|
||||
cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
|
||||
./scripts/bundle-sidecars.sh "$TARGET"
|
||||
|
||||
- name: Build unsigned Intel DMG
|
||||
run: cd desktop && pnpm tauri build --verbose --no-sign --target "$TARGET" --bundles dmg --config src-tauri/tauri.canary.conf.json
|
||||
env:
|
||||
CMAKE_POLICY_VERSION_MINIMUM: "3.5"
|
||||
MACOSX_DEPLOYMENT_TARGET: "10.15"
|
||||
CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
|
||||
TAURI_BUNDLER_DMG_IGNORE_CI: "true"
|
||||
|
||||
- name: Locate fresh Intel DMG
|
||||
id: artifact
|
||||
run: |
|
||||
DMG=$(find "desktop/src-tauri/target/${TARGET}/release/bundle/dmg" -name '*.dmg' -type f | head -1)
|
||||
[[ -n "$DMG" ]] || { echo "::error::No Intel DMG found"; exit 1; }
|
||||
echo "dmg=$DMG" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Upload Intel canary
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
||||
with:
|
||||
name: buzz-macos-intel-canary-${{ github.sha }}
|
||||
path: ${{ steps.artifact.outputs.dmg }}
|
||||
if-no-files-found: error
|
||||
retention-days: 7
|
||||
|
||||
- name: Measure release Cargo cache inputs
|
||||
if: always()
|
||||
run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true
|
||||
|
||||
- name: Save exact release Cargo cache
|
||||
if: steps.rust_cache.outputs.cache-hit != 'true'
|
||||
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
60
.github/workflows/signed-macos-canary.yml
vendored
60
.github/workflows/signed-macos-canary.yml
vendored
@@ -34,16 +34,6 @@ jobs:
|
||||
|
||||
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
||||
|
||||
# Rust cache covering both the workspace sidecar build and the Tauri
|
||||
# crate build. shared-key scoped to macos-canary-release so canary runs
|
||||
# warm each other without colliding with CI's debug-profile keys.
|
||||
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
|
||||
with:
|
||||
workspaces: |
|
||||
.
|
||||
desktop/src-tauri
|
||||
shared-key: macos-canary-release
|
||||
|
||||
- name: Get pnpm store directory
|
||||
id: pnpm-cache
|
||||
run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
|
||||
@@ -78,6 +68,38 @@ jobs:
|
||||
cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
|
||||
cd src-tauri && cargo update --workspace
|
||||
|
||||
- name: Resolve native toolchain identity
|
||||
id: native_toolchain
|
||||
run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Compute this after cargo update so the key describes the graph that is
|
||||
# actually compiled. The helper normalizes only Buzz Desktop's release
|
||||
# version, allowing a canary to warm an otherwise identical tag build.
|
||||
- name: Compute exact release cache key
|
||||
id: rust_cache_key
|
||||
env:
|
||||
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
||||
run: |
|
||||
KEY=$(scripts/desktop-release-cache-key.py \
|
||||
--platform "$RUNNER_OS" \
|
||||
--target aarch64-apple-darwin \
|
||||
--features mesh-llm \
|
||||
--native-inputs "$NATIVE_TOOLCHAIN_ID")
|
||||
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
||||
echo "Release cache key: $KEY"
|
||||
|
||||
- name: Restore exact release Cargo cache
|
||||
id: rust_cache
|
||||
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
|
||||
- name: Generate non-updating bundle config
|
||||
run: |
|
||||
cat > desktop/src-tauri/tauri.canary.conf.json <<'JSON'
|
||||
@@ -210,6 +232,24 @@ jobs:
|
||||
if-no-files-found: error
|
||||
retention-days: 7
|
||||
|
||||
- name: Measure release Cargo cache inputs
|
||||
if: always()
|
||||
run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true
|
||||
|
||||
# Only this trusted, main-bound canary writes the cache. Excluding bundle
|
||||
# output prevents installers or signed artifacts from entering it.
|
||||
- name: Save exact release Cargo cache
|
||||
if: steps.rust_cache.outputs.cache-hit != 'true'
|
||||
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
|
||||
- name: Save pnpm store cache
|
||||
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
|
||||
68
.github/workflows/windows-canary.yml
vendored
68
.github/workflows/windows-canary.yml
vendored
@@ -46,24 +46,9 @@ jobs:
|
||||
shell: bash
|
||||
run: rustup target add "$TARGET"
|
||||
|
||||
# Rust cache covering both the workspace sidecar build and the Tauri
|
||||
# crate build. shared-key scoped to windows-canary-release so canary
|
||||
# runs warm each other without colliding with CI's debug-profile key
|
||||
# (CI windows job does clippy/check, not --release).
|
||||
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
|
||||
with:
|
||||
workspaces: |
|
||||
.
|
||||
desktop/src-tauri
|
||||
shared-key: windows-canary-release
|
||||
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: 24.14.1
|
||||
# Disable setup-node's built-in cache: we manage the pnpm store cache
|
||||
# explicitly below (restore before install, save after) to mirror the
|
||||
# pattern used by ci.yml and to keep caching logic consistent across
|
||||
# all three canary workflows.
|
||||
package-manager-cache: false
|
||||
|
||||
- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
|
||||
@@ -108,6 +93,40 @@ jobs:
|
||||
cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
|
||||
cd src-tauri && cargo update --workspace
|
||||
|
||||
- name: Resolve native toolchain identity
|
||||
id: native_toolchain
|
||||
shell: bash
|
||||
run: echo "id=$(scripts/desktop-native-toolchain-id.sh windows)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Compute this after cargo update so the key describes the graph that is
|
||||
# actually compiled. The helper normalizes only Buzz Desktop's release
|
||||
# version, allowing a canary to warm an otherwise identical tag build.
|
||||
- name: Compute exact release cache key
|
||||
id: rust_cache_key
|
||||
shell: bash
|
||||
env:
|
||||
NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
|
||||
run: |
|
||||
KEY=$(scripts/desktop-release-cache-key.py \
|
||||
--platform "$RUNNER_OS" \
|
||||
--target x86_64-pc-windows-msvc \
|
||||
--features default \
|
||||
--native-inputs "$NATIVE_TOOLCHAIN_ID")
|
||||
echo "key=$KEY" >> "$GITHUB_OUTPUT"
|
||||
echo "Release cache key: $KEY"
|
||||
|
||||
- name: Restore exact release Cargo cache
|
||||
id: rust_cache
|
||||
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
|
||||
- name: Generate non-updating bundle config
|
||||
shell: bash
|
||||
run: |
|
||||
@@ -152,6 +171,25 @@ jobs:
|
||||
if-no-files-found: error
|
||||
retention-days: 7
|
||||
|
||||
- name: Measure release Cargo cache inputs
|
||||
if: always()
|
||||
shell: bash
|
||||
run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true
|
||||
|
||||
# Only this trusted, main-bound canary writes the cache. Excluding bundle
|
||||
# output prevents installers from entering it.
|
||||
- name: Save exact release Cargo cache
|
||||
if: steps.rust_cache.outputs.cache-hit != 'true'
|
||||
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
desktop/src-tauri/target
|
||||
!desktop/src-tauri/target/**/release/bundle
|
||||
key: ${{ steps.rust_cache_key.outputs.key }}
|
||||
|
||||
- name: Save pnpm store cache
|
||||
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
||||
with:
|
||||
|
||||
34
scripts/desktop-native-toolchain-id.sh
Executable file
34
scripts/desktop-native-toolchain-id.sh
Executable file
@@ -0,0 +1,34 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
platform=${1:?usage: desktop-native-toolchain-id.sh <macos|linux|windows>}
|
||||
case "$platform" in
|
||||
macos)
|
||||
{
|
||||
sw_vers
|
||||
xcodebuild -version
|
||||
xcrun --sdk macosx --show-sdk-path
|
||||
xcrun --sdk macosx --show-sdk-version
|
||||
xcrun clang --version
|
||||
} ;;
|
||||
linux)
|
||||
{
|
||||
cat /etc/os-release
|
||||
dpkg-query -W -f='${Package}=${Version}\n' \
|
||||
build-essential libasound2-dev libayatana-appindicator3-dev \
|
||||
libgtk-3-dev librsvg2-dev libssl-dev libwebkit2gtk-4.1-dev \
|
||||
libxdo-dev patchelf pkg-config
|
||||
gcc -dumpfullversion -dumpversion
|
||||
gcc -dumpmachine
|
||||
ld --version
|
||||
} ;;
|
||||
windows)
|
||||
{
|
||||
cmd.exe //c ver
|
||||
powershell.exe -NoProfile -Command '$vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"; & $vswhere -latest -products * -property installationVersion; Get-ChildItem "${env:ProgramFiles}\Microsoft Visual Studio\2022" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Name; Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\Include" -Directory | Select-Object -ExpandProperty Name; Get-ChildItem "${env:ProgramFiles}\Microsoft Visual Studio\2022\*\VC\Tools\MSVC" -Directory | Select-Object -ExpandProperty Name'
|
||||
cmake --version
|
||||
} ;;
|
||||
*)
|
||||
echo "unsupported native toolchain platform: $platform" >&2
|
||||
exit 1 ;;
|
||||
esac | tr -d '\r' | python3 -c 'import hashlib, sys; print(hashlib.sha256(sys.stdin.buffer.read()).hexdigest())'
|
||||
85
scripts/desktop-release-cache-key.py
Executable file
85
scripts/desktop-release-cache-key.py
Executable file
@@ -0,0 +1,85 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Compute an exact, version-agnostic Cargo release cache key."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import hashlib
|
||||
import pathlib
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
ROOT = pathlib.Path(__file__).resolve().parents[1]
|
||||
DESKTOP_MANIFEST = pathlib.Path("desktop/src-tauri/Cargo.toml")
|
||||
DESKTOP_LOCK = pathlib.Path("desktop/src-tauri/Cargo.lock")
|
||||
|
||||
|
||||
def normalized(path: pathlib.Path, data: bytes) -> bytes:
|
||||
text = data.decode()
|
||||
if path == DESKTOP_MANIFEST:
|
||||
text, count = re.subn(
|
||||
r'(?ms)(^\[package\].*?^version\s*=\s*)"[^"]+"',
|
||||
r'\1"<desktop-version>"',
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
if count != 1:
|
||||
raise ValueError(f"could not normalize package version in {path}")
|
||||
elif path == DESKTOP_LOCK:
|
||||
text, count = re.subn(
|
||||
r'(?ms)(^name = "buzz-desktop"\nversion = )"[^"]+"',
|
||||
r'\1"<desktop-version>"',
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
if count != 1:
|
||||
raise ValueError(f"could not normalize package version in {path}")
|
||||
return text.encode()
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("--platform", required=True)
|
||||
parser.add_argument("--target", required=True)
|
||||
parser.add_argument("--features", default="default")
|
||||
parser.add_argument("--native-inputs", required=True)
|
||||
args = parser.parse_args()
|
||||
|
||||
manifest_output = subprocess.check_output(
|
||||
["git", "ls-files", "*Cargo.toml"], cwd=ROOT, text=True
|
||||
)
|
||||
paths = [ROOT / path for path in manifest_output.splitlines()]
|
||||
paths += [ROOT / "Cargo.lock", ROOT / DESKTOP_LOCK, ROOT / "rust-toolchain.toml"]
|
||||
cargo_config = ROOT / ".cargo/config.toml"
|
||||
if cargo_config.exists():
|
||||
paths.append(cargo_config)
|
||||
|
||||
digest = hashlib.sha256()
|
||||
descriptors = {
|
||||
"schema": "desktop-rust-release-v1",
|
||||
"platform": args.platform,
|
||||
"target": args.target,
|
||||
"profile": "release",
|
||||
"features": args.features,
|
||||
"native-inputs": args.native_inputs,
|
||||
"rustc": subprocess.check_output(["rustc", "-Vv"], text=True).strip(),
|
||||
}
|
||||
for name, value in sorted(descriptors.items()):
|
||||
digest.update(f"{name}\0{value}\0".encode())
|
||||
|
||||
for absolute in sorted(set(paths)):
|
||||
relative = absolute.relative_to(ROOT)
|
||||
digest.update(str(relative).encode() + b"\0")
|
||||
digest.update(normalized(relative, absolute.read_bytes()) + b"\0")
|
||||
|
||||
print(f"desktop-rust-release-v1-{args.platform}-{args.target}-{digest.hexdigest()}")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
raise SystemExit(main())
|
||||
except (OSError, ValueError, subprocess.CalledProcessError) as error:
|
||||
print(f"error: {error}", file=sys.stderr)
|
||||
raise SystemExit(1)
|
||||
29
scripts/test-desktop-release-cache-key.sh
Executable file
29
scripts/test-desktop-release-cache-key.sh
Executable file
@@ -0,0 +1,29 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
repo_root=$(cd "$(dirname "$0")/.." && pwd)
|
||||
key_script="scripts/desktop-release-cache-key.py"
|
||||
tmp=$(mktemp -d)
|
||||
trap 'rm -rf "$tmp"' EXIT
|
||||
cp -R "$repo_root"/. "$tmp/repo"
|
||||
cd "$tmp/repo"
|
||||
|
||||
args=(--platform Linux --target x86_64-unknown-linux-gnu --features mesh-llm --native-inputs ubuntu-24.04-mold)
|
||||
original=$("$key_script" "${args[@]}")
|
||||
python3 - <<'PY'
|
||||
from pathlib import Path
|
||||
manifest = Path("desktop/src-tauri/Cargo.toml")
|
||||
manifest.write_text(manifest.read_text().replace('version = "0.5.4"', 'version = "9.8.7"', 1))
|
||||
lock = Path("desktop/src-tauri/Cargo.lock")
|
||||
text = lock.read_text()
|
||||
start = text.index('name = "buzz-desktop"')
|
||||
version = text.index('version = "0.5.4"', start)
|
||||
lock.write_text(text[:version] + 'version = "9.8.7"' + text[version + len('version = "0.5.4"'):])
|
||||
PY
|
||||
version_only=$("$key_script" "${args[@]}")
|
||||
[[ "$original" == "$version_only" ]] || { echo "desktop version changed cache key" >&2; exit 1; }
|
||||
printf '\n# dependency input\n' >> crates/buzz-acp/Cargo.toml
|
||||
dependency_changed=$("$key_script" "${args[@]}")
|
||||
[[ "$original" != "$dependency_changed" ]] || { echo "dependency manifest did not change cache key" >&2; exit 1; }
|
||||
[[ "$original" == desktop-rust-release-v1-Linux-x86_64-unknown-linux-gnu-* ]] || { echo "unexpected key: $original" >&2; exit 1; }
|
||||
echo "desktop release cache key contract passed"
|
||||
77
scripts/test-desktop-release-cache-workflow.sh
Executable file
77
scripts/test-desktop-release-cache-workflow.sh
Executable file
@@ -0,0 +1,77 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
root=$(cd "$(dirname "$0")/.." && pwd)
|
||||
release="$root/.github/workflows/release.yml"
|
||||
proof="$root/.github/workflows/desktop-release-cache-proof.yml"
|
||||
canaries=(
|
||||
"$root/.github/workflows/signed-macos-canary.yml"
|
||||
"$root/.github/workflows/macos-intel-canary.yml"
|
||||
"$root/.github/workflows/windows-canary.yml"
|
||||
"$root/.github/workflows/linux-canary.yml"
|
||||
)
|
||||
|
||||
if grep -q 'desktop-rust-release-v1\|desktop-release-cache-key' "$release"; then
|
||||
echo "Gate 1 must not alter the release cache path" >&2
|
||||
exit 1
|
||||
fi
|
||||
for workflow in "${canaries[@]}"; do
|
||||
grep -q 'refs/heads/main' "$workflow"
|
||||
grep -q 'desktop-native-toolchain-id.sh' "$workflow"
|
||||
grep -q 'steps.native_toolchain.outputs.id' "$workflow"
|
||||
grep -q 'actions/cache/restore@' "$workflow"
|
||||
grep -q 'actions/cache/save@' "$workflow"
|
||||
grep -q 'steps.rust_cache.outputs.cache-hit' "$workflow"
|
||||
grep -q '!desktop/src-tauri/target/\*\*/release/bundle' "$workflow"
|
||||
if grep -q 'restore-keys:.*desktop-rust\|Swatinem/rust-cache' "$workflow"; then
|
||||
echo "release Cargo cache must use split actions with no fallback: $workflow" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
# GitHub expressions must enter cache-key steps through env, never by direct
|
||||
# interpolation into generated shell scripts. This blocks shell injection if a
|
||||
# matrix or upstream output ever becomes attacker-controlled.
|
||||
python3 - "$proof" "${canaries[@]}" <<'PY'
|
||||
import pathlib
|
||||
import re
|
||||
import sys
|
||||
|
||||
for filename in sys.argv[1:]:
|
||||
text = pathlib.Path(filename).read_text()
|
||||
steps = re.findall(
|
||||
r"(?ms)^ - name: Compute exact release cache key\n(.*?)(?=^ - (?:name:|uses:)|\Z)",
|
||||
text,
|
||||
)
|
||||
if not steps:
|
||||
raise SystemExit(f"cache-key step missing: {filename}")
|
||||
for step in steps:
|
||||
run = re.search(r"(?ms)^ run: \|\n(.*?)(?=^ \S|\Z)", step)
|
||||
if not run:
|
||||
raise SystemExit(f"cache-key run block missing: {filename}")
|
||||
if "${{" in run.group(1):
|
||||
raise SystemExit(f"GitHub expression interpolated into cache-key shell: {filename}")
|
||||
if "NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}" not in step:
|
||||
raise SystemExit(f"native toolchain output not passed through env: {filename}")
|
||||
PY
|
||||
|
||||
# Producer/proof coverage must match all four release targets and features.
|
||||
for target in aarch64-apple-darwin x86_64-apple-darwin x86_64-unknown-linux-gnu x86_64-pc-windows-msvc; do
|
||||
grep -q -- "$target" "$proof" || { echo "proof missing $target" >&2; exit 1; }
|
||||
done
|
||||
grep -q -- '--features mesh-llm' "$proof"
|
||||
grep -q -- '--features default' "$proof"
|
||||
[[ $(grep -c 'actions/cache/save@' "$proof") -eq 0 ]]
|
||||
[[ $(grep -c 'Require exact cache hit' "$proof") -eq 3 ]]
|
||||
grep -q 'refs/tags/cache-proof-' "$proof"
|
||||
|
||||
# Linux producer must match release's default linker, not the CI-only mold path.
|
||||
if grep -q 'setup-mold\|ubuntu-24.04-mold' "$root/.github/workflows/linux-canary.yml"; then
|
||||
echo "Linux cache producer diverges from the release linker" >&2
|
||||
exit 1
|
||||
fi
|
||||
if grep -q 'setup-mold' "$release"; then
|
||||
echo "release linker changed; re-review cache equivalence" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "desktop release cache workflow contract passed"
|
||||
@@ -54,6 +54,8 @@ grep -q 'verify-release-ref\.sh' "$repo_root/.github/workflows/release.yml"
|
||||
grep -q 'verify-release-ref\.sh' "$repo_root/.github/workflows/docker.yml"
|
||||
grep -q 'test-release-ref-contract\.sh' "$repo_root/.github/workflows/ci.yml"
|
||||
"$repo_root/scripts/test-signed-canary-contract.sh"
|
||||
"$repo_root/scripts/test-desktop-release-cache-key.sh"
|
||||
"$repo_root/scripts/test-desktop-release-cache-workflow.sh"
|
||||
auto_tag="$repo_root/.github/workflows/auto-tag-on-release-pr-merge.yml"
|
||||
grep -q 'actions/create-github-app-token@' "$auto_tag"
|
||||
grep -q 'client-id:.*vars\.BUZZ_RELEASE_TAGGER_CLIENT_ID' "$auto_tag"
|
||||
|
||||
Reference in New Issue
Block a user