ci: cache SCA preparation artifacts - #423
Merged
Merged
Conversation
7 tasks
loveRhythm1990
self-requested a review
August 13, 2026 17:08
loveRhythm1990
approved these changes
Aug 13, 2026
XuPeng-SH
added a commit
to matrixorigin/matrixone
that referenced
this pull request
Aug 13, 2026
## What type of PR is this? - [ ] API-change - [ ] BUG - [x] Improvement - [ ] Documentation - [ ] Feature - [x] Test and CI - [ ] Code Refactoring ## Which issue(s) this PR fixes: issue #27076 ## What this PR does / why we need it: Extends the trusted main-branch SCA cache producer introduced by #27128. - warms exact-key native prerequisites (`thirdparties/install`, CPU `cgo` objects, `libmo`) for the SCA platform and compiler - warms the three static-check binaries with an exact Go/tool-recipe key - pins `molint` instead of resolving `@latest`, making the tool cache deterministic - verifies every cached artifact before publishing it - retains the existing Go module cache producer The corresponding reusable workflow remains restore-only, so `pull_request_target` runs cannot save or poison shared caches. Native artifacts intentionally have no restore prefix: a PR changing C/native inputs gets a cache miss and rebuilds from source. No static analysis is skipped. The expected saving is in the current 6–8 minute `Prepare ENV` phase. The cached payload is about 170 MB before compression (about 88 MB tools and 80 MB native artifacts). Companion consumer: matrixorigin/CI#423 ## Validation - workflow YAML parsed successfully - actionlint passed for the warm-cache workflow - producer/consumer cache keys and paths match mechanically - `make install-static-check-tools` completed successfully with the pinned `molint` - `make -n install-static-check-tools` shows all three expected fixed tool versions - `git diff --check` passed --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
fengttt
added a commit
that referenced
this pull request
Aug 14, 2026
… compose-based pessimistic BVT Upstream (#419-#423) landed two things this branch must integrate with: - The SCA job gained its own trusted actions/cache pipeline (module cache from matrixorigin/matrixone's sca-go-module-cache.yaml producer, native prerequisites keyed on compiler identity plus full native-input hashes, cached static-check tools). That mechanism subsumes this branch's SCA seed step — including the toolchain-ABI fingerprint this branch deliberately deferred — so the SCA seed is dropped, the nightly ci-builder publishes amd64 only (the arm64 leg existed solely for SCA), and the multi-arch manifest job goes away. - The pessimistic standalone BVT was rebuilt on the compose topology (its native launch build kept exceeding the job timeout). The old native-binary artifact consumer no longer applies; both BVT jobs now consume the shared build identically, assembling the runtime image from the artifact via Dockerfile.prebuilt with the same guarded fallback to the full in-docker build. The UT job keeps both the upstream Shanghai-proxy canary and this branch's cache seed; they are independent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Prepare ENVgolangci-lint,molint, andlicense-eyebinariesWhy
After #422 reduced
license-eye dep checkfrom more than 40 minutes to about 2 seconds, the remaining SCA setup still spends 6–8 minutes rebuilding native prerequisites and static-check tools for every PR.This change removes that repeated work without changing the runner or reducing checks.
make static-checkstill executes the completego vet, license header check, dependency license check, andgolangci-lintsuite.Native caches are exact-keyed by OS, architecture, compiler, and all relevant source inputs. They intentionally have no restore prefix, so native-changing PRs rebuild. Tool caches are exact-keyed by OS, architecture, Go version, and the static-tool recipe hash.
Trusted producer: matrixorigin/matrixone#27132
Merge order: merge matrixorigin/matrixone#27132 first so main can populate the caches, then merge this PR. This PR remains correct on cache miss if merged first, but will not become faster until the producer runs.
Validation
git diff --checkpassed