Skip to content

Commit 081d3d4

Browse files
indietypindietyp
authored
SRE-134: Configure sccache with Cloudflare R2 for Rust caching (#8039)
1 parent 53d3051 commit 081d3d4

File tree

10 files changed

+105
-7
lines changed

10 files changed

+105
-7
lines changed

‎.github/actions/install-sccache/action.yml‎

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,49 @@
11
name: Install sccache
22
description: Setup sccache for Rust project caching
3+
inputs:
4+
vault_address:
5+
description: The URL of the Vault server
6+
required: true
37

48
runs:
59
using: composite
610
steps:
11+
- name: Retrieve secrets
12+
id: secrets
13+
uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
14+
with:
15+
exportToken: true
16+
url: ${{ inputs.vault_address }}
17+
method: jwt
18+
role: dev
19+
secrets: |
20+
infrastructure/data/github/actions/secrets sccache_r2_account_id | SCCACHE_ACCOUNT_ID ;
21+
infrastructure/data/github/actions/secrets sccache_r2_bucket | SCCACHE_BUCKET ;
22+
infrastructure/data/github/actions/secrets sccache_r2_access_key_id | SCCACHE_AWS_ACCESS_KEY_ID ;
23+
infrastructure/data/github/actions/secrets sccache_r2_secret_access_key | SCCACHE_AWS_SECRET_ACCESS_KEY ;
24+
725
- name: Setup sccache
826
uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
927

10-
- name: Configure sccache
11-
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
12-
with:
13-
script: |
14-
core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
15-
core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
28+
- name: Start sccache server
29+
env:
30+
SCCACHE_BUCKET: ${{ env.SCCACHE_BUCKET }}
31+
SCCACHE_ENDPOINT: https://${{ env.SCCACHE_ACCOUNT_ID }}.r2.cloudflarestorage.com
32+
SCCACHE_REGION: auto
33+
SCCACHE_LOG: debug
34+
SCCACHE_ERROR_LOG: /tmp/sccache.log
35+
SCCACHE_S3_USE_SSL: "true"
36+
SCCACHE_S3_KEY_PREFIX: "hashintel/hash/"
37+
SCCACHE_S3_SERVER_SIDE_ENCRYPTION: "false"
38+
SCCACHE_S3_ENABLE_VIRTUAL_HOST_STYLE: "false"
39+
AWS_ACCESS_KEY_ID: ${{ env.SCCACHE_AWS_ACCESS_KEY_ID }}
40+
AWS_SECRET_ACCESS_KEY: ${{ env.SCCACHE_AWS_SECRET_ACCESS_KEY }}
41+
AWS_EC2_METADATA_DISABLED: "true"
42+
shell: bash
43+
run: |
44+
sccache --start-server
1645
1746
- name: Inject sccache variables into environment
1847
shell: bash
1948
run: |
20-
echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
2149
echo "RUSTC_WRAPPER=${SCCACHE_PATH}" >> $GITHUB_ENV

‎.github/actions/install-tools/action.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ inputs:
55
token:
66
description: GitHub token for authentication
77
required: true
8+
vault_address:
9+
description: The URL of the Vault server
10+
required: true
811
rust:
912
description: Should Rust be installed? Can either be `"true"` or `true`
1013
default: "true"
@@ -43,3 +46,5 @@ runs:
4346
- name: "Install sccache"
4447
if: ${{ inputs.rust == true || inputs.rust == 'true' }}
4548
uses: ./.github/actions/install-sccache
49+
with:
50+
vault_address: ${{ inputs.vault_address }}

‎.github/workflows/ai-pr-review.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,8 @@ jobs:
121121
needs: check-conditions
122122
if: needs.check-conditions.outputs.should_review == 'true'
123123
runs-on: ubuntu-24.04
124+
permissions:
125+
id-token: write
124126
steps:
125127
- name: Checkout source code
126128
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -131,6 +133,7 @@ jobs:
131133
uses: ./.github/actions/install-tools
132134
with:
133135
token: ${{ secrets.GITHUB_TOKEN }}
136+
vault_address: ${{ secrets.VAULT_ADDR }}
134137
rust: false
135138

136139
- name: Warm up repository

‎.github/workflows/bench.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ jobs:
3434
needs: [optimize-ci]
3535
if: needs.optimize-ci.outputs.skip == 'false'
3636
runs-on: ubuntu-24.04
37+
permissions:
38+
id-token: write
3739
outputs:
3840
unit: ${{ steps.packages.outputs.unit }}
3941
integration: ${{ steps.packages.outputs.integration }}
@@ -47,6 +49,7 @@ jobs:
4749
uses: ./.github/actions/install-tools
4850
with:
4951
token: ${{ secrets.GITHUB_TOKEN }}
52+
vault_address: ${{ secrets.VAULT_ADDR }}
5053
rust: false
5154

5255
- name: Determine changed packages
@@ -90,6 +93,7 @@ jobs:
9093
uses: ./.github/actions/install-tools
9194
with:
9295
token: ${{ secrets.GITHUB_TOKEN }}
96+
vault_address: ${{ secrets.VAULT_ADDR }}
9397

9498
- name: Prune repository
9599
if: github.event_name == 'pull_request'
@@ -129,6 +133,7 @@ jobs:
129133
uses: ./.github/actions/install-tools
130134
with:
131135
token: ${{ secrets.GITHUB_TOKEN }}
136+
vault_address: ${{ secrets.VAULT_ADDR }}
132137

133138
- name: Prune repository
134139
uses: ./.github/actions/prune-repository
@@ -209,6 +214,7 @@ jobs:
209214
uses: ./.github/actions/install-tools
210215
with:
211216
token: ${{ secrets.GITHUB_TOKEN }}
217+
vault_address: ${{ secrets.VAULT_ADDR }}
212218

213219
- name: Prune repository
214220
if: github.event_name == 'pull_request'
@@ -290,6 +296,7 @@ jobs:
290296
uses: ./.github/actions/install-tools
291297
with:
292298
token: ${{ secrets.GITHUB_TOKEN }}
299+
vault_address: ${{ secrets.VAULT_ADDR }}
293300

294301
- name: Prune repository
295302
uses: ./.github/actions/prune-repository

‎.github/workflows/canary-release.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ jobs:
1111
uses: ./.github/actions/install-tools
1212
with:
1313
token: ${{ secrets.GITHUB_TOKEN }}
14+
vault_address: ${{ secrets.VAULT_ADDR }}
1415

1516
- name: Warm up repository
1617
uses: ./.github/actions/warm-up-repo

‎.github/workflows/deploy.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ concurrency:
1919
jobs:
2020
setup:
2121
runs-on: ubuntu-24.04
22+
permissions:
23+
id-token: write
2224
outputs:
2325
sourcemaps: ${{ steps.packages.outputs.sourcemaps }}
2426
steps:
@@ -31,6 +33,7 @@ jobs:
3133
uses: ./.github/actions/install-tools
3234
with:
3335
token: ${{ secrets.GITHUB_TOKEN }}
36+
vault_address: ${{ secrets.VAULT_ADDR }}
3437
rust: false
3538

3639
- name: Determine changed packages
@@ -74,6 +77,7 @@ jobs:
7477
uses: ./.github/actions/install-tools
7578
with:
7679
token: ${{ secrets.GITHUB_TOKEN }}
80+
vault_address: ${{ secrets.VAULT_ADDR }}
7781

7882
- name: Prune repository
7983
uses: ./.github/actions/prune-repository

‎.github/workflows/lint.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ concurrency:
1919
jobs:
2020
setup:
2121
runs-on: ubuntu-24.04
22+
permissions:
23+
id-token: write
2224
outputs:
2325
packages: ${{ steps.packages.outputs.packages }}
2426
steps:
@@ -31,6 +33,7 @@ jobs:
3133
uses: ./.github/actions/install-tools
3234
with:
3335
token: ${{ secrets.GITHUB_TOKEN }}
36+
vault_address: ${{ secrets.VAULT_ADDR }}
3437
rust: false
3538

3639
- name: Determine changed packages
@@ -45,6 +48,7 @@ jobs:
4548
package:
4649
name: Package
4750
permissions:
51+
id-token: write
4852
contents: read
4953
security-events: write
5054
needs: [setup]
@@ -66,6 +70,7 @@ jobs:
6670
uses: ./.github/actions/install-tools
6771
with:
6872
token: ${{ secrets.GITHUB_TOKEN }}
73+
vault_address: ${{ secrets.VAULT_ADDR }}
6974

7075
- name: Prune repository
7176
uses: ./.github/actions/prune-repository
@@ -177,6 +182,7 @@ jobs:
177182
global:
178183
name: Global
179184
permissions:
185+
id-token: write
180186
contents: read
181187
checks: write
182188
pull-requests: write
@@ -192,6 +198,7 @@ jobs:
192198
uses: ./.github/actions/install-tools
193199
with:
194200
token: ${{ secrets.GITHUB_TOKEN }}
201+
vault_address: ${{ secrets.VAULT_ADDR }}
195202

196203
- name: Warm up repository
197204
uses: ./.github/actions/warm-up-repo

‎.github/workflows/publish-blocks-to-preview.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ jobs:
1515
pick-blocks:
1616
name: Pick blocks
1717
runs-on: ubuntu-24.04
18+
permissions:
19+
id-token: write
1820
outputs:
1921
block-dir-names: ${{ steps.list-block-dir-names.outputs.block-dir-names }}
2022
steps:
@@ -24,6 +26,7 @@ jobs:
2426
uses: ./.github/actions/install-tools
2527
with:
2628
token: ${{ secrets.GITHUB_TOKEN }}
29+
vault_address: ${{ secrets.VAULT_ADDR }}
2730

2831
- name: Warm up repository
2932
uses: ./.github/actions/warm-up-repo
@@ -39,6 +42,8 @@ jobs:
3942
process:
4043
name: Publish
4144
runs-on: ubuntu-24.04
45+
permissions:
46+
id-token: write
4247
needs:
4348
- pick-blocks
4449
strategy:
@@ -53,6 +58,7 @@ jobs:
5358
uses: ./.github/actions/install-tools
5459
with:
5560
token: ${{ secrets.GITHUB_TOKEN }}
61+
vault_address: ${{ secrets.VAULT_ADDR }}
5662

5763
- name: Warm up repository
5864
uses: ./.github/actions/warm-up-repo

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ jobs:
1010
release:
1111
runs-on: ubuntu-latest
1212
if: github.repository == 'hashintel/hash'
13+
permissions:
14+
id-token: write
1315

1416
steps:
1517
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -20,6 +22,7 @@ jobs:
2022
uses: ./.github/actions/install-tools
2123
with:
2224
token: ${{ secrets.GITHUB_TOKEN }}
25+
vault_address: ${{ secrets.VAULT_ADDR }}
2326

2427
- name: Warm up repository
2528
uses: ./.github/actions/warm-up-repo

‎.github/workflows/test.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ jobs:
3333

3434
setup:
3535
runs-on: ubuntu-24.04
36+
permissions:
37+
id-token: write
3638
outputs:
3739
unit-tests: ${{ steps.packages.outputs.unit-tests }}
3840
integration-tests: ${{ steps.packages.outputs.integration-tests }}
@@ -49,6 +51,7 @@ jobs:
4951
uses: ./.github/actions/install-tools
5052
with:
5153
token: ${{ secrets.GITHUB_TOKEN }}
54+
vault_address: ${{ secrets.VAULT_ADDR }}
5255
rust: false
5356

5457
- name: Determine changed packages
@@ -129,6 +132,7 @@ jobs:
129132
uses: ./.github/actions/install-tools
130133
with:
131134
token: ${{ secrets.GITHUB_TOKEN }}
135+
vault_address: ${{ secrets.VAULT_ADDR }}
132136

133137
- name: Prune repository
134138
uses: ./.github/actions/prune-repository
@@ -198,6 +202,33 @@ jobs:
198202
run: |
199203
turbo run test:miri --filter "${{ matrix.name }}"
200204
205+
- name: Show sccache logs
206+
if: always() && steps.tests.outputs.has-rust == 'true'
207+
run: |
208+
grep "CannotCache" /tmp/sccache.log | while IFS= read -r line; do
209+
# Extract reason - format as "reason1 (reason2)" if comma-separated, otherwise just "reason"
210+
if echo "$line" | grep -qE 'CannotCache\([^,]+, [^)]+\):'; then
211+
reason=$(echo "$line" | sed -E 's/.*CannotCache\(([^,]+), ([^)]+)\):.*/\1 (\2)/')
212+
else
213+
reason=$(echo "$line" | sed -E 's/.*CannotCache\(([^)]+)\):.*/\1/')
214+
fi
215+
216+
# Extract crate name if present
217+
if echo "$line" | grep -q '"--crate-name"'; then
218+
crate=$(echo "$line" | sed -E 's/.*"--crate-name", "([^"]+)".*/\1/')
219+
else
220+
crate="<no crate name>"
221+
fi
222+
223+
# Extract args
224+
args=$(echo "$line" | sed -E 's/.*CannotCache\([^)]+\): (\[.+\])$/\1/')
225+
226+
echo ""
227+
echo "reason: $reason"
228+
echo "crate: $crate"
229+
echo "args: $args"
230+
done
231+
201232
build:
202233
name: Build
203234
permissions:
@@ -235,6 +266,8 @@ jobs:
235266
fail-fast: false
236267
if: needs.setup.outputs.integration-tests != '{"name":[],"include":[]}' && needs.optimize-ci.outputs.skip == 'false'
237268
runs-on: ubuntu-24.04
269+
permissions:
270+
id-token: write
238271
steps:
239272
- name: Checkout
240273
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -246,6 +279,7 @@ jobs:
246279
uses: ./.github/actions/install-tools
247280
with:
248281
token: ${{ secrets.GITHUB_TOKEN }}
282+
vault_address: ${{ secrets.VAULT_ADDR }}
249283

250284
- name: Prune repository
251285
uses: ./.github/actions/prune-repository

0 commit comments

Comments
 (0)