buzz/.github/workflows/desktop-release-cache-proof.yml at main · block/buzz · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
name: Desktop release cache tag-scope proof

# Dispatch from a cache-proof-* tag at the same trusted-main SHA warmed by all
# four canaries. Every job restores only and requires an exact cache hit.
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  macos:
    name: Prove macOS ${{ matrix.target }} cache visibility
    if: github.repository == 'block/buzz'
    runs-on: macos-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            features: mesh-llm
          - target: x86_64-apple-darwin
            features: default
    steps:
      - name: Require cache proof tag
        run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
      - name: Patch proof dependency graph
        run: |
          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
          cd src-tauri && cargo update --workspace
      - name: Resolve native toolchain identity
        id: native_toolchain
        run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT"
      - name: Compute exact release cache key
        id: rust_cache_key
        env:
          CACHE_TARGET: ${{ matrix.target }}
          CACHE_FEATURES: ${{ matrix.features }}
          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
        run: |
          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target "$CACHE_TARGET" --features "$CACHE_FEATURES" --native-inputs "$NATIVE_TOOLCHAIN_ID")
          echo "key=$KEY" >> "$GITHUB_OUTPUT"
      - name: Restore exact default-branch cache from tag
        id: rust_cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            desktop/src-tauri/target
            !desktop/src-tauri/target/**/release/bundle
          key: ${{ steps.rust_cache_key.outputs.key }}
      - name: Require exact cache hit
        env:
          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'

  linux:
    name: Prove Linux cache visibility
    if: github.repository == 'block/buzz'
    runs-on: ubuntu-latest
    container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
    timeout-minutes: 15
    defaults:
      run:
        shell: bash
    steps:
      - name: Require cache proof tag and install release native tools
        run: |
          [[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }
          apt-get update
          apt-get install -y --no-install-recommends build-essential ca-certificates curl git libasound2-dev libayatana-appindicator3-dev libgtk-3-dev librsvg2-dev libssl-dev libwebkit2gtk-4.1-dev libxdo-dev patchelf pkg-config
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
      - name: Patch proof dependency graph
        run: |
          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
          cd src-tauri && cargo update --workspace
      - name: Resolve native toolchain identity
        id: native_toolchain
        run: echo "id=$(scripts/desktop-native-toolchain-id.sh linux)" >> "$GITHUB_OUTPUT"
      - name: Compute exact release cache key
        id: rust_cache_key
        env:
          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
        run: |
          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-unknown-linux-gnu --features mesh-llm --native-inputs "$NATIVE_TOOLCHAIN_ID")
          echo "key=$KEY" >> "$GITHUB_OUTPUT"
      - name: Restore exact default-branch cache from tag
        id: rust_cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            desktop/src-tauri/target
            !desktop/src-tauri/target/**/release/bundle
          key: ${{ steps.rust_cache_key.outputs.key }}
      - name: Require exact cache hit
        env:
          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'

  windows:
    name: Prove Windows cache visibility
    if: github.repository == 'block/buzz'
    runs-on: windows-latest
    timeout-minutes: 15
    steps:
      - name: Require cache proof tag
        shell: bash
        run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Patch proof dependency graph
        shell: bash
        run: |
          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
          cd src-tauri && cargo update --workspace
      - name: Resolve native toolchain identity
        id: native_toolchain
        shell: bash
        run: echo "id=$(scripts/desktop-native-toolchain-id.sh windows)" >> "$GITHUB_OUTPUT"
      - name: Compute exact release cache key
        id: rust_cache_key
        shell: bash
        env:
          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
        run: |
          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-pc-windows-msvc --features default --native-inputs "$NATIVE_TOOLCHAIN_ID")
          echo "key=$KEY" >> "$GITHUB_OUTPUT"
      - name: Restore exact default-branch cache from tag
        id: rust_cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            desktop/src-tauri/target
            !desktop/src-tauri/target/**/release/bundle
          key: ${{ steps.rust_cache_key.outputs.key }}
      - name: Require exact cache hit
        shell: bash
        env:
          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'