S3 remote build cache with per-project content digests

[oyvindberg]

S3 remote build cache with per-project content digests

Depends on #544 (bleep build invalidated).

The CI dream

bleep remote-cache pull                                        # restore cached classes
bleep build invalidated --base origin/main | xargs bleep compile  # only compile what changed
bleep remote-cache push                                        # cache results for next run

What's included

Model layer:

• remote-cache config in bleep.yaml (URI + region)
• remoteCacheCredentials in ~/.config/bleep/config.yaml
• BLEEP_REMOTE_CACHE_S3_ACCESS_KEY_ID / BLEEP_REMOTE_CACHE_S3_SECRET_ACCESS_KEY env vars
• JSON schema updated

Per-project content digests (ProjectDigest):

• SHA-256 from project config + source content + resource content + transitive dep digests
• Uses git ls-tree for clean directories (precomputed hashes, no file I/O) — fast on large repos
• Falls back to filesystem hashing for dirty/generated files
• Filesystem hashing uses git-compatible blob hashes (SHA-1("blob <size>\0" + content)) so both paths produce identical digests
• Golden digest tests ensure stability across platforms and versions

S3 client:

• Manual AWS Signature V4 signing — zero new dependencies
• Works with any S3-compatible service (AWS S3, MinIO, Cloudflare R2)

Remote cache commands:

• bleep remote-cache pull — download + extract tar.gz archives per project
• bleep remote-cache push — tar.gz classes + zinc analysis, upload
• Resources affect the digest but are NOT cached (matches sbt's design)

Portable zinc analysis:

• ZincBridge now uses ReadWriteMappers with RootPaths (build dir, coursier cache, products dir)
• Analysis files contain relative paths (${0}/src/main/scala/Foo.scala) instead of absolute paths
• Portable across machines — no post-processing needed on pull

Credential management:

• bleep config remote-cache setup — interactive TUI prompt
• bleep config remote-cache clear — remove stored credentials
• Env vars work without any setup

Documentation:

• usage/remote-cache.mdx with setup, usage, GitHub Actions, GitLab CI, MinIO/R2 examples
• Sidebar updated

Config examples

bleep.yaml:

remote-cache:
  uri: s3://my-bleep-cache/builds
  region: eu-north-1

~/.config/bleep/config.yaml:

remoteCacheCredentials:
  accessKeyId: AKIA...
  secretAccessKey: wJal...

Or env vars:

export BLEEP_REMOTE_CACHE_S3_ACCESS_KEY_ID=AKIA...
export BLEEP_REMOTE_CACHE_S3_SECRET_ACCESS_KEY=wJal...

Test plan

• 9 ProjectDigest tests (golden stability, config/source/resource changes, transitive propagation, git/filesystem hash consistency)
• 11 BuildInvalidated tests (from Add bleep build invalidated command for CI-optimized rebuilds #544)
• 622 existing tests pass
• bleep compile clean build succeeds

🤖 Generated with Claude Code