Repository navigation
ci: cache Rust builds in R2, written from the merge queue - #5685
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every job that used the Actions cache now reads the private mbx-moq-dev R2 bucket instead, and the macOS and Windows platform jobs gain a cache. Only cache.yml writes, with a key held in a `cache-write` Environment that only `main` can deploy to. It now warms x86 Linux, macOS, and Windows alongside ARM64 Linux, since the 10 GB budget no longer decides which platforms get a cache. The bucket and lifecycle rule are checked in under infra/mbx; the tokens and Environment are maintainer steps documented in infra/README.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Quest outcome: the implementation is complete and the PR stays a draft. Before it can merge, a maintainer has to run the four bootstrap steps listed in the description (bucket and lifecycle rule, two R2 tokens, the (Written by Claude Opus 5.5) |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Jobs on main and in its merge queue now publish what they compile to R2, in the cache-write Environment, and pull requests only read. cache.yml keeps only the dev shell push. mbx 1.25.0's MBX_REMOTE_TRUST_WRITES lets the queue and Nightly's schedule write, since mbx alone trusts only protected pushes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kixelated
changed the title
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 24 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Keeps mbx-r2.md and platform-queue.md deleted and points their links at mbx-r2-verify.md and release-gates.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolves the conflicts with #6038 (cloud CI only in the merge queue): cache.yml drops the Rust warm, Check and Test keep their queue-only gating and write from the merge queue, and OBS, which now runs only for release, drops its writer Environment. WASM, newly called by Nightly, names the Environment and inherits secrets so its main run writes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 640ea54858
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
A missing access key id or secret on its own was treated like a fork's empty credentials, so a broken secret built every reader cold without an error. Only both empty is the fork case now; one empty fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Take #5685's dev-shell-only cache.yml and push it to nix.moq.dev from cache-write. List the mbx and nix infra side by side, and point the Nightly tooling test and the remaining quest links at the nix composite and nix-cache-verify.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Moves the Rust build cache from the Actions cache to a private R2 bucket (
mbx-moq-dev), using mbx's S3 backend, and writes it from the merge queue andmaininstead of a post-merge warm. Completesquest/m0/ci/mbx-r2.md.Problem
The Actions cache is 10 GB per repository and scoped by branch, so only
maincould write a cache that pull requests read, through a separate warm incache.ymlthat rebuilt everything after each merge. That warm was ARM64 only (x86, macOS, and Windows did not fit the budget) and ran a second full build of code the queue had just built.Approach
mainand in its merge queue. A queued PR is about to becomemain, so its code is trusted likemain's (maintainer decision, 2026-10-19). Each such job names thecache-writeEnvironment withenvironment: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/gh-readonly-queue/main/')) && 'cache-write' || '' }}, which matches the Environment's branch policies formainand the queue. Other jobs get no Environment and read with the repository's read key. Since ci: run cloud CI only in the merge queue #6038, main PRs run no cloud CI, so the writers are Check and Test (queue), and onmainNightly's own jobs (nightly, tests, media-engines, audio-quality, sizes, which include theobs cirow), the workflows Nightly calls that use the cache (Platform's macOS and Windows, X11, WASM), and the scheduled Interop and TS runs. Readers are release PRs and pushes, and every writer before it publishes..github/actions/rust-cache: mbx 1.24.0 -> 1.25.0. It derives the writer decision fromgithub.refitself, so thewriteinput is gone. For writers it exportsMBX_REMOTE_MODE=read-writeandMBX_REMOTE_TRUST_WRITES=true(new in mbx 1.25.0, feat(cache): add remote.trust_writes for CI systems mbx does not detect jdx/mr-boxington#724). Without it mbx forces read-only for anything but a push to a protected branch, which excludesmerge_groupandschedule. Bypassing mbx's policy is deliberate: the Environment is the boundary. mr-boxington-action stays at v1.7.2, its newest release; it passesMBX_REMOTE_MODEthrough whenremote-modeis unset.mbx doctor, and a writer that does not come outeffective read-writefails. Missing credentials on a reader (fork or Dependabot PRs intorelease) give a warning and a cold build.cache.ymlkeeps only the Nix dev-shell Cachix push, now triggered byflake.nix,flake.lock, andnix/**. The ARM64, x86, macOS, and Windows Rust warms are deleted. It no longer needs the Environment.alert.ymlis unchanged, since Cache stays a CI-only workflow.GITHUB_PATH, so jobs on the runner's rustup toolchain also go through mbx.releasenow), and release-rs (releaseis not a writer ref).infra/mbx: a wrangler package withlifecycle.json(expire objects after 30 days, abort multipart uploads after 1 day), plusjust infra mbx createandjust infra mbx lifecycle.infra/README.mddocuments the bootstrap and the writer rule.mbx-r2.md;mbx-r2-verify.mdis a condition quest that measures hits, restore time, and expiry once the queue has written.Dropped: the
writeinput on the rust-cache action. It always equalled "this ref ismainor its queue", so callers only declare the Environment.Maintainer actions
Done 2026-10-19: the bucket and lifecycle rule, both R2 tokens, the
cache-writeEnvironment with themainandgh-readonly-queue/main/*policies, and the repository and Environment secrets.Impact
None on the public API or wire. CI and infra only.
Merge with #6038
That PR landed first: main PRs report Check and Test skipped, Platform left the queue for Nightly, OBS dropped its
mainpush, and Nightly calls more workflows. The merge oforigin/mainresolves it so both hold:cache.yml: no Rust warm (this PR), so ci: run cloud CI only in the merge queue #6038's edits to the deleted warm steps go too.check.yml: ci: run cloud CI only in the merge queue #6038's queue-only gating andCI_BASEstand; Check and Test keep the writer Environment, which now applies only to merge groups.obs.yml: it runs only forrelease, which never writes, so the writer Environment line is dropped and it reads. Nightly'sobs cirow writes onmaininstead.wasm.yml: Nightly now calls it onmain, where the action requires the write key, so it names the Environment and Nightly passessecrets: inherit, like X11 and Platform. Without this, Nightly's WASM job would fail atCache credentials.platform.yml,infra/README.md, andmbx-r2-verify.mdno longer say the queue runs macOS and Windows or that main PRs read.Checks
just checkandjust gh checkpass after the merge (actionlint, alert coverage, check-runs, quest, markdown and justfile lints), and so dobun test sh/gh/setup.test.tsandbun sh/gh/queue.test.ts.MBX_REMOTE_TRUST_WRITESis read from the environment (#[usage(env = ...)], the same path asMBX_REMOTE_S3_ENDPOINT), thattrust_writesreturns the configured mode before the GitHub check, and thatmbx doctorreportsconfigured <mode>, effective <mode>.8dac66ea1f: pull request jobs with the emptyenvironment:name start normally with the repository read key. io_uring'sCheck the cachereportedremote: pass: s3://mbx-moq-dev (Linux-ARM64) is compatibleandpolicy: configured read-only, effective read-onlyon mbx 1.25.0.Decisions
Warm x86, macOS, and Windows from. Replaced by the queue-writer decision: the queue andmainmainpublish what they build, and no separate warm runs. Trade-off: the queue builds only what its diff selects, so an object that expires is rebuilt by the next queue ormainjob that builds it, and a queue entry in between pays that compile.mbx-r2-verifymeasures how often.main(Nightly, scheduled runs) write; release PRs and every writer read. The cache now mainly speeds up the queue itself, each entry reading what earlier entries and Nightly published, which is the critical pathqueue-onlyleft.mainso a queue entry never pays for an expired object. Rejected: it is the second full build this PR removes, andmbx-r2-verifymeasures whether the rebuilds matter.queue-onlydecided main PRs run no cloud CI.Suggested follow-ups
cache-writeEnvironment also admits themoq-boy-v*,moq-c-v*,moq-cli-v*,moq-gst-v*, andmoq-relay-v*tags. No workflow here names the Environment on a tag, butinfra/README.mdsays onlymainand the queue can deploy to it; drop those policies or document why they exist.video.yml(x86 nix) andaudio-quality.yml(ARM nix).cpp.yml,android.yml, and the release dry runs build with rustup or cross targets that nothing writes yet.environment: {name: ..., deployment: false}would stop each writer job creating a deployment record; it needs checking that branch policies still apply without a deployment.nix-cachecan reuse this Environment and bootstrap pattern.(Written by Claude Opus 5.5)
🤖 Generated with Claude Code