Repository navigation
Conversation
wan9chi
force-pushed
the
feat/remote-cache-build-all
branch
from
October 19, 2026 06:47
57dcba9 to
a2fc5b4
Compare
wan9chi
added a commit
to voidzero-dev/vite-plus-remote-cache-cloudflare
that referenced
this pull request
Oct 19, 2026
…ith void (#17) ## Motivation [voidzero-dev/void#492](voidzero-dev/void#492) caches every task `build:all` runs, and its PR CI should show remote cache reuse before it merges. void#492 already makes same-repository PR runs read-write, but the production cache only accepts uploads from default-branch `push` jobs, so those PR uploads get `403 write_policy`. The decision is to let void's same-repository PR CI upload to its namespace (`https://voidzero-remote-cache.voidzero-docs.workers.dev/projects/void`) for now. Every other namespace keeps the main-branch-push-only policy. ## Design - **Opt-in per namespace, off by default.** Migration `0002_pull_requests.sql` adds `scopes.pull_requests` (0/1, default 0) and recreates the `changed_policy` trigger with that column, so turning the opt-in on or off bumps `policy_version` and stops uploads admitted under the old policy. - **Write policy (`src/auth.ts`).** `push` tokens work as before. For an opted-in namespace, a `pull_request` token passes the same audience, `repository_id`, `repository_owner_id`, and `repository_visibility: public` checks, and also needs: - `ref` matching `refs/pull/<number>/merge` - `ref_type` `branch` - `base_ref` equal to the registered default branch's short name (`main`, not `refs/heads/main`) These are the values GitHub signs for a PR's merge-branch run: see the [`ref` description](https://docs.github.com/en/actions/reference/workflows-and-actions/variables) ("for pull request events except `pull_request_target` that were not merged, it is `refs/pull/<pr_number>/merge`"), `GITHUB_BASE_REF` ("for example, `main`"), the [OIDC claim reference](https://docs.github.com/en/actions/reference/security/oidc), and the decoded `pull_request` token in [github/actions-oidc-debugger](https://github.com/github/actions-oidc-debugger) (`"ref": "refs/pull/27/merge"`, `"ref_type": "branch"`, `"base_ref": "main"`). `pull_request_target`, `workflow_run`, tags, PRs to other branches, the `closed` run of a merged PR (whose `ref` is the base branch), and workflows in fork repositories are still denied. - **Configuration.** A `.github/production-repositories.jsonc` entry can now be `{ "repository": "owner/repo", "pullRequests": true }` as well as `"owner/repo"`, which means `pullRequests: false`. Only `void` uses the object form. `pnpm ci:deploy production` sets every namespace's opt-in from the list on each run, the same way it already handles `enabled`/`writes_enabled`. Self-hosters use `pnpm operator policy --pull-requests on|off`, or `setup --pull-requests on` when creating a namespace. `status` already prints the full row. - **Staging** keeps `pull_requests = 0`, so PR staging runs still check that PR tokens are rejected. - **Logging.** Verified writes now also log `event_name` and `head_ref`. `base_ref` always equals the default branch, and the PR number is already in `workflow_ref`. ## Risk PR entries share the namespace with default-branch entries. Code from any same-repository PR, including Renovate dependency branches, runs before review and can publish an entry that a later default-branch build restores. That's why the opt-in is off by default and only on for void. The README, self-hosting guide, e2e plan, and RFC describe it as interim and link the long-term fix, #16 (scope pull request uploads to the pull request). The server can't tell fork PRs from same-repository PRs: fork PR runs carry the base repository's IDs. It relies on GitHub not granting `id-token: write` to fork PR workflows. GitHub only does that when "Send write tokens to workflows from pull requests" is enabled, a setting it offers for private repositories only. The docs state this dependency. ## After merge Production changes only after a maintainer runs **Actions → Remote cache production** on `main`. That run applies migration 0002 and enables PR uploads for `void`. Its log should print `Enabled pull request uploads for namespace void`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The CI build job runs `vp run --cache build:all` against the remote task cache when the VP_REMOTE_CACHE_URL repository variable is set: pushes to main upload, pull requests and release runs only download. - The root `build` runs packages in dependency order, @void/md last. - @void/platform's runtime build writes `sourceRevision: null`; an uncached `build:stamp` step records the revision afterwards. @void/isr becomes a dev dependency, since the dispatch Worker bundles its build output. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wan9chi
force-pushed
the
feat/remote-cache-build-all
branch
from
November 11, 2026 11:20
d9e4832 to
8d6ec91
Compare
wan9chi
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CI's build job runs
vp run build:all, 41 package and playground builds, from scratch on every run. This caches them withvp runand its remote task cache, so PRs reuse what main has built.Changes
build:allis cached in CI. The build job runsvp run --cache build:all.vp runtracks the files each build reads, so the builds need no input config.buildscript no longer uses--parallel, so no build reads a dependency's output while it's being restored.@void/mdbuilds last, since it andvoiddepend on each other.@void/platformnow depends on@void/isr, whose build output it bundles.build:stamptask then writes the commit. The stamp can't be cached, because its output is the commit itself, which is new on every commit.Numbers
From 448 CI runs of void's commits from Oct 19 to Nov 7:
build:all4.4 h saved in total.