Skip to content

ci: release triggers (main push + dispatch version) and GHA-backed sccache#2

Merged
Itsusinn merged 10 commits into
mainfrom
ci/release-and-sccache
Jun 9, 2026
Merged

ci: release triggers (main push + dispatch version) and GHA-backed sccache#2
Itsusinn merged 10 commits into
mainfrom
ci/release-and-sccache

Conversation

@Itsusinn

@Itsusinn Itsusinn commented Jun 9, 2026

Copy link
Copy Markdown
Member

What

Two CI changes in .github/workflows/build.yml.

1. release-libs triggers & tag

Trigger Release tag
push to main latest (rolling)
workflow_dispatch with version=vX.Y.Z vX.Y.Z
workflow_dispatch with empty version latest 
if: (github.event_name == 'push' && github.ref_name == 'main') || github.event_name == 'workflow_dispatch'

The tag is chosen from github.event.inputs.version, passed via an env var (not inlined) to avoid shell injection from the dispatch input.

2. Windows sccache → GitHub Actions cache backend

Rewritten after Watfaq/clash-android. Replaces choco install sccache + a pwsh version-detection step + a manual actions/cache of ~/AppData/Local/Mozilla/sccache with:

env:
  SCCACHE_GHA_ENABLED: "true"
  SCCACHE_VERSION: "v0.12.0"
...
- uses: mozilla-actions/sccache-action@v0.0.10
  with:
    version: ${{ env.SCCACHE_VERSION }}
- run: |
    sccache -z
    just compile windows/${{ matrix.arch }}
    sccache -s

SCCACHE_GHA_ENABLED=true makes sccache store objects in the Actions cache service directly — no manual cache key / version / chromium-version bookkeeping. The build script already passes cc_wrapper=<sccache> to gn on Windows, so ninja uses it as the compiler wrapper.

Net: −39 / +13 lines.

Notes for reviewer

  • The 0.12.0 pin (previously arm64-only, the validated version) is kept and now applied to both windows arches.
  • The windows job's Get Chromium version step is now unused (it only fed the old sccache cache key) — left in for now, harmless; can drop if preferred.
  • Only Windows uses sccache; linux/darwin/android still use ccache + actions/cache. Could be unified onto sccache+GHA later.
  • GHA cache is capped at ~10 GB/repo shared with the existing out build caches; watch for eviction churn.

🤖 Generated with Claude Code

Itsusinn and others added 10 commits June 9, 2026 15:47
@Itsusinn @claude
ci: release on main push + workflow_dispatch version, and GHA-backed …
9d6df7b 
…sccache

release-libs:
- Trigger on push to main (tag `latest`) and on workflow_dispatch, where
  inputs.version becomes the release tag (falls back to `latest` if empty).
- Pass the version via env var to avoid shell injection from the input.

Windows sccache:
- Replace `choco install sccache` + version detection + manual actions/cache
  of the sccache dir with `mozilla-actions/sccache-action` and
  SCCACHE_GHA_ENABLED=true (GitHub Actions cache backend).
- Keep the 0.12.0 pin (validated for windows/arm64) for both arches.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: unify all platforms on sccache + GitHub Actions cache
3dbdf6c 
Switch linux, darwin, android and linux-musl from ccache + actions/cache
to the same sccache + GHA backend already used by Windows:

- Top-level env sets SCCACHE_GHA_ENABLED=true and SCCACHE_VERSION for all
  jobs; drop the now-redundant per-job (windows) env.
- Each build job uses mozilla-actions/sccache-action and wraps the build
  with `sccache -z` / `sccache -s`; remove the ccache install, the manual
  actions/cache of the ccache dir, and the ccache stat steps.
- build-cronet.rs: cc_wrapper now prefers sccache, falling back to ccache
  (previously it only looked for ccache on non-Windows hosts, so without
  this the build would silently run with no compiler cache).

Note: GHA cache is ~10 GB/repo shared across all jobs and the `out`
build-artifact caches — watch for eviction churn.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: always use the latest sccache
79cd830 
Drop the SCCACHE_VERSION pin (v0.12.0) and the per-step version input;
mozilla-actions/sccache-action installs the latest release by default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: drive the build matrix from .github/target.toml
d30a243 
Collapse the five near-duplicate per-platform jobs (linux, linux-musl,
darwin, windows, android) into a single matrix-driven `build` job, after
rust-proxy/workflows + Itsusinn/tuic:

- .github/target.toml lists every target (os, target, name, optional libc).
- A `prepare` job converts it with `toml2json | jaq -c '.target'` and exposes
  it as a job output.
- `build` consumes it via `matrix.include: ${{ fromJSON(...) }}`, with the
  per-OS bits (apt/brew/choco ninja, musl zstd, Debian keyring) selected by
  `runner.os` / target conditions. One step set for all 29 targets.
- release-libs now needs [build].

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: drop the out/ build cache; install ninja via setup-ninja action
b0c3022 
- Remove the actions/cache of naiveproxy/src/out and every
  `steps.build-cache.outputs.cache-hit != 'true'` gate (and the
  now-unused "Get naiveproxy commit" step that only fed the cache key).
  Compiler caching is handled entirely by sccache + GHA, so the coarse
  full-output cache is redundant; the build always runs now.
- Replace the per-OS apt/brew/choco ninja installs with
  seanmiddleditch/gha-setup-ninja@v6 (cross-platform). Keep a musl-only
  zstd install for the OpenWrt SDK extraction.

Note: without the out/ cache, an unchanged push no longer skips the build
instantly — it re-runs, sped up by warm sccache.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: rely on preinstalled ninja, drop setup-ninja action
b77952f 
All runner images (ubuntu-24.04/22.04, macos-15, windows-2022) ship
ninja 1.13.2, so no install step is needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: sccache local-disk mode + packed per-target actions/cache
573ec6f 
The ghac backend created one cache entry per compiled object; on a build
this large GitHub's cache service throttled every write (last run: 2459
misses == 2459 write errors, ~0 effective caching).

Switch to sccache local-disk mode (SCCACHE_DIR under runner.temp,
SCCACHE_CACHE_SIZE=2G) and persist the whole cache dir as a single
actions/cache blob per target (key by matrix.name + script hash + run_id,
with restore-keys), following rust-proxy/workflows. One cache op per job
instead of thousands.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: size each target's sccache cache to 10GiB / target count
375b9af 
Compute SCCACHE_CACHE_SIZE in the prepare job as 10240M / number of
targets (currently 29 -> 353M) and pass it to the build job, so all
per-target caches sum within the 10 GB GHA quota and stop evicting each
other. Auto-adjusts as targets are added/removed in target.toml.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: pin sccache to 0.12.0 for win/arm64 (latest breaks asm)
b5193aa 
sccache 0.15.0 mishandles BoringSSL's assembler output paths on
windows/arm64 (assemblerToPreprocess -> "failed to zip up compiler
outputs", obj not found), failing the build. Pin only that target to the
last known-good 0.12.0 via a per-target sccache_version field in
target.toml; every other target stays on latest.

(The local-disk + packed actions/cache change is confirmed working here:
this run showed 0 cache write errors.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn @claude
ci: fix sccache version input — empty (not 'latest') means latest
fadd728 
The sccache-action uses the version input verbatim as the release tag, so
`version: latest` requested releases/download/latest/... -> 404, failing
every non-pinned target. Pass empty instead (matrix.sccache_version),
which triggers the action's fetch-latest path. win/arm64 keeps its
v0.12.0 pin.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@Itsusinn
Itsusinn merged commit 7d90a6c into main Jun 9, 2026
31 checks passed
@Itsusinn
Itsusinn deleted the ci/release-and-sccache branch June 9, 2026 15:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Itsusinn