chore(ci): pre-warm edge layer on substrate bump + shared-remote-ready sccache (CIRISServer#285, CIRISEdge#216) - #360
Open
emooreatx wants to merge 2 commits into
Open
Conversation
…ote-ready sccache (CIRISServer#285, CIRISEdge#216) Two mitigations for the cross-repo cold-rebuild blast radius #285 measured (server's installer at 14m26s recompiling edge v13.1.2 cold via the same version-keyed persist-layer fallback; N× across jobs×platforms). Mitigation B — warm-release-cache.yml (BENEFITS THE NEXT RELEASE RUN, no infra): A dedicated workflow, in its OWN concurrency group, that fires on a Cargo.toml push whose diff touches the centipede key inputs (edge `^version =`, or a persist/verify tag) and CIRISCache-saves the linux-x86_64 + linux-aarch64 release layers ASAP. Fixes the two reasons ci.yml's own save doesn't warm in time: (1) ci.yml's main-push run and the release TAG run share a SHA-keyed cancel-in-progress group, so the tag run CANCELS the main run that would have saved the layer; (2) the surviving tag run only saves at the END of its ~20m wheel matrix — after downstream, triggered by the same bump, already started cold-building. Mirrors CIRISServer's warm-release-cache.yml. Warms the two linux layers the installer/Docker/persist restore; macOS/Windows stay on ci.yml's save (desktop-wheel-only). Mitigation A — .github/actions/setup-sccache (READY, pending a backend): A composite that points sccache at a SHARED REMOTE (WebDAV) when the `SCCACHE_WEBDAV_ENDPOINT` secret is present, else falls back to today's per-repo GHA backend byte-for-byte (secret absent ⇒ "" ⇒ GHA branch — safe, zero behavior change until provisioned). All four sccache sites (wheel, bench, android, warm) route through it. Provisioning is one org secret (Cloudflare R2 / any WebDAV, pointed at from every centipede repo) — that flips within-run + cross-repo dedup on, collapsing the N× multiplier. This is the remote half of #216; the GHA half already landed (4fa02b3). Net: the next substrate cut warms edge's layer out-of-band before the tag run and downstream need it; the shared-remote multiplier-killer is one secret from live. Validated: yaml parse + actionlint clean (both workflows + the composite); warm build command is the ci.yml pyo3-full/bench feature set (compiles clean, links libpython like `cargo test --features pyo3`). Refs: CIRISServer#285, CIRISEdge#216, #238, #229. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D1dESkHmchUHZvedVdx4Ln
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
… eval'd the doc prose A composite action.yml has no `secrets` context; the expression syntax in the input DESCRIPTIONS (intended as human docs) was evaluated as a live template value at load time, so every job routing through the composite failed with "Unrecognized named-value: secrets" (bench/android/wheel). actionlint passes it (valid syntax; invalid-context only at GitHub eval time). Descriptions are now plain text; the only expressions left are the valid inputs.* refs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D1dESkHmchUHZvedVdx4Ln
emooreatx
added a commit
that referenced
this pull request
Aug 3, 2026
…ce-clean persist v28.1.0→v28.2.0 (6ac441c); verify stays v12.5.0 (persist's own pin, matched). The cut is a consumer GAIN — the node-state observability surface (node_state_json + 7 new bindings) is server-facing (CIRISServer#356/#360); edge's asks were checks, both clean: - §2 consent-revocation proxy shrink (the fourth and last retraction- fold): read-time; edge holds no proxy delegations for non-enrolled subjects; all suites pass the tightened walk. - §3 cfg-gated-helper drift pattern: edge's default-features configuration builds in CI (the core lane) and locally — the class persist carried invisibly for three releases is gated here. Gates: superset clippy -D warnings; lib 778/844/780; conformance vectors 10/10; genesis bootstrap 6/6; field_conformance vs restamp. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012MqRfBEZ3CHfbMt6E2yw48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two mitigations for the cross-repo cold-rebuild blast radius #285 measured (installer 14m26s recompiling edge v13.1.2 cold; N× across jobs×platforms).
B —
warm-release-cache.yml— benefits the next release run, no infraFires on a
Cargo.tomlpush whose diff touches the centipede key inputs (edge^version =, or a persist/verify tag) and CIRISCache-saves the linux-x86_64 + linux-aarch64 release layers ASAP, in its own concurrency group. Fixes why ci.yml's own save doesn't warm in time:cancel-in-progressgroup → the tag run cancels the main run that would have saved the layer.Mirrors CIRISServer's
warm-release-cache.yml. Warms the two linux layers the installer/Docker/persist restore; macOS/Windows stay on ci.yml's save.A —
.github/actions/setup-sccache— ready, pending a backendComposite that points sccache at a shared remote (WebDAV) when
SCCACHE_WEBDAV_ENDPOINTis set, else falls back to today's per-repo GHA backend byte-for-byte (absent secret ⇒""⇒ GHA — safe, zero behavior change). All four sccache sites route through it. Provisioning is one org secret (Cloudflare R2 / any WebDAV, pointed at from every centipede repo) → within-run + cross-repo dedup, collapsing the N×. This is the remote half of #216 (GHA half landed in 4fa02b3).Validation
YAML parse + actionlint clean (both workflows + composite). Warm build uses the ci.yml pyo3-full/bench feature set (
transport-http transport-reticulum pyo3) — compiles clean, links libpython likecargo test --features pyo3(noextension-module, which only affects edge's own final cdylib link, not the deps downstream restores).Activation note
When a WebDAV/R2 backend is provisioned, add
SCCACHE_WEBDAV_ENDPOINT(+SCCACHE_WEBDAV_TOKEN) as org secrets on every centipede repo — no code change needed.Refs: CIRISServer#285, CIRISEdge#216, #238, #229.
🤖 Generated with Claude Code