Skip to content

ci(release): make release SDK builds hermetic (skip cross-run caches) #1267

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Nathan Lu (NathanL15) wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci(release): make release SDK builds hermetic (skip cross-run caches) #1267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/_build-sdk.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,17 @@ on:
required: false
type: string
default: ""
hermetic:
description: >-
Build from clean state: skip every cross-run cache restore (ccache,
cargo target, CMake build tree). Release builds set this so shipped
binaries can never be assembled from stale cached outputs — the same
uniform-mtime hazard documented on the cargo cache below applies to
the ninja build tree, whose cache key hashes only configure inputs,
not the C/C++ sources.
required: false
type: boolean
default: false

permissions:
contents: read
Expand Down Expand Up @@ -79,6 +90,7 @@ jobs:
version_tag: ${{ inputs.version_tag }}

- name: Restore ccache
if: ${{ !inputs.hermetic }}
uses: actions/cache@v6
with:
path: ${{ github.workspace }}/.ccache
Expand All @@ -95,6 +107,7 @@ jobs:
# No restore-keys — a source change forces a clean rebuild instead of a
# fuzzy restore that would re-trigger the staleness.
- name: Restore cargo target
if: ${{ !inputs.hermetic }}
uses: actions/cache@v6
with:
path: |
Expand Down Expand Up @@ -127,6 +140,7 @@ jobs:
# configure-time inputs; a change there mints a new entry, while
# restore-keys lets unchanged-config runs reuse the previous tree.
- name: Restore CMake build dir
if: ${{ !inputs.hermetic }}
uses: actions/cache@v6
with:
path: sdk/build-${{ matrix.preset }}
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,12 @@ jobs:
with:
version_tag: ${{ needs.resolve-tag.outputs.tag }}
upload_artifact: true
# Release artifacts must be built from clean state, never assembled from
# restored ccache / cargo / ninja-tree caches: actions/cache restores
# uniform mtimes, so a restored build tree can defeat ninja's staleness
# detection and `cmake --install` then ships outputs compiled from an
# older commit under the new tag (see qualcomm/GenieX#1266).
hermetic: true

build-android-aar:
name: build-android-aar
Expand Down