ci: cache build:all with the remote task cache

The CI build job runs `vp run --cache build:all` against the remote task
cache when the VP_REMOTE_CACHE_URL repository variable is set: pushes to
main upload, pull requests and release runs only download.

- The root `build` runs packages in dependency order, @void/md last.
- @void/platform's runtime build writes `sourceRevision: null`; an uncached
  `build:stamp` step records the revision afterwards. @void/isr becomes a
  dev dependency, since the dispatch Worker bundles its build output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: wan9chi

.github/workflows/ci.yml

@@ -21,6 +21,14 @@ jobs:
     runs-on: ${{ matrix.os == 'ubuntu-latest' && github.repository == 'voidzero-dev/void' && 'blacksmith-4vcpu-ubuntu-2404' || matrix.os }}
     permissions:
       contents: read
+      # Remote cache uploads authenticate with a GitHub Actions OIDC token.
+      id-token: write
+    env:
+      # Remote task cache, on when the repository variable is set. Only pushes to main upload
+      # results; pull requests and release runs only download, so unreviewed code can't publish
+      # entries that main restores.
+      VP_REMOTE_CACHE_URL: ${{ vars.VP_REMOTE_CACHE_URL }}
+      VP_REMOTE_CACHE: ${{ !vars.VP_REMOTE_CACHE_URL && 'off' || (github.event_name == 'push' && github.ref == 'refs/heads/main') && 'read-write' || 'read' }}
     strategy:
       fail-fast: false
       matrix:
@@ -32,7 +40,7 @@ jobs:
       - uses: ./.github/actions/test-setup
       # Build every playground once per OS for complete build/type coverage.
       # Integration tests build their own selected fixtures in separate checkouts.
-      - run: vp run build:all
+      - run: vp run --cache build:all
       - run: vp run build:docs
       - run: node test/check-playground-build-artifacts.mjs
       - run: vp run check

.github/workflows/publish.yml

@@ -30,6 +30,9 @@ jobs:
     uses: ./.github/workflows/ci.yml
     permissions:
       contents: read
+      # ci.yml's build job requests an OIDC token for remote cache uploads, so its caller must
+      # grant it, though release runs only download.
+      id-token: write
 
   platform-ci:
     needs: validate-release

package.json

@@ -2,7 +2,7 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "build": "vp run --filter './packages/**' --parallel build",
+    "build": "vp run --filter './packages/**' --filter '!./packages/md' build && vp run --filter ./packages/md build",
     "build:core": "vp run --filter ./packages/deploy-core --filter ./packages/deploy-cloudflare --filter ./packages/edge --filter ./packages/isr --filter ./packages/platform --filter ./packages/void build",
     "build:docs": "vp run --filter ./docs build",
     "build:platform": "vp run --filter './platform/packages/**' build",

packages/platform/package.json

@@ -42,7 +42,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "vp pack && node scripts/build-runtime.mjs",
+    "build": "vp pack && node scripts/build-runtime.mjs && vp run build:stamp",
     "dev": "vp pack --watch",
     "typecheck": "tsc --noEmit"
   },
@@ -51,6 +51,7 @@
   },
   "devDependencies": {
     "@types/node": "catalog:",
+    "@void/isr": "workspace:*",
     "typescript": "catalog:",
     "vite-plus": "catalog:",
     "wrangler": "catalog:"

packages/platform/scripts/build-runtime.mjs

@@ -5,7 +5,6 @@ import { tmpdir } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { basename, dirname, join } from 'pathslash';
 import { buildSandboxController } from '../../../platform/packages/api/scripts/build-sandbox-controller.mjs';
-import { resolvePlatformSourceRevision } from './source-revision.mjs';
 
 const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
 const repositoryRoot = join(packageRoot, '..', '..');
@@ -139,7 +138,6 @@ try {
   });
   const packageJson = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
   const database = buildDatabaseManifest();
-  const sourceRevision = resolvePlatformSourceRevision({ repositoryRoot });
   const manifest = parsePlatformRuntimeManifest({
     artifacts,
     assets: {
@@ -165,7 +163,8 @@ try {
     platformVersion: packageJson.version,
     safetyProtocols: { sandboxDrain: 3 },
     schemaVersion: 2,
-    sourceRevision,
+    // scripts/stamp-source-revision.mjs records the revision after this cached build.
+    sourceRevision: null,
     usageProtocolVersion: PLATFORM_USAGE_PROTOCOL_VERSION,
   });
   writeFileSync(join(runtimeRoot, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`);

packages/platform/scripts/stamp-source-revision.mjs

@@ -0,0 +1,19 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { dirname, join } from 'pathslash';
+import { resolvePlatformSourceRevision } from './source-revision.mjs';
+
+// Records the source revision in the manifest that scripts/build-runtime.mjs wrote, so a new
+// revision reruns only this step and not the cached runtime build.
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+const repositoryRoot = join(packageRoot, '..', '..');
+const manifestPath = join(packageRoot, 'dist', 'runtime', 'manifest.json');
+const { parsePlatformRuntimeManifest } = await import(
+  pathToFileURL(join(packageRoot, 'dist', 'installer.mjs')).href
+);
+
+const manifest = parsePlatformRuntimeManifest({
+  ...JSON.parse(readFileSync(manifestPath, 'utf8')),
+  sourceRevision: resolvePlatformSourceRevision({ repositoryRoot }),
+});
+writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);

packages/platform/vite.config.ts

@@ -1,6 +1,17 @@
 import { defineConfig } from 'vite-plus';
 
 export default defineConfig({
+  run: {
+    tasks: {
+      // The last step of the `build` script: records the source revision in the runtime manifest.
+      // It isn't cached, so a new revision reruns only this step, and it gets the full
+      // environment, including VOID_PLATFORM_SOURCE_REVISION.
+      'build:stamp': {
+        command: 'node scripts/stamp-source-revision.mjs',
+        cache: false,
+      },
+    },
+  },
   pack: {
     entry: [
       'src/index.ts',

pnpm-lock.yaml

@@ -84,7 +84,7 @@ export default defineConfig({
       },
       'test:all': {
         command:
-          'vp fmt --check && vp lint && vp run build:all && node test/check-playground-build-artifacts.mjs && vp run lint:platform && vp run check && vp test run',
+          'vp fmt --check && vp lint && vp run --cache build:all && node test/check-playground-build-artifacts.mjs && vp run lint:platform && vp run check && vp test run',
         // `vp run` passes ONLY the env vars a task declares to that task — not the full environment.
         // Without this, the gated live Cloudflare e2e's credentials never reach `vp test run`, so it
         // skips even when the CI job injects them. `untrackedEnv` forwards them without folding them