noel/act-node-docker
Watch
1
0
Fork
You've already forked act-node-docker
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat: seal sccache in the system CI image #9

Merged
noel merged 1 commit from feat/hermetic-sccache-1714 into main 2026-08-19 13:11:11 +00:00
Conversation 0 Commits 1 Files changed 3 +26 -6
noel commented 2026-08-19 13:10:45 +00:00
Owner

Outcome

Add sccache 0.17.0 to the existing networkless system CI derivative as one checksum-pinned sealed input. This enables Codewire host Rust jobs to use the same best-effort untrusted R2 object cache already proven for BuildKit, without injecting a downloader or a second cache service into jobs.

The source label and README also use the current canonical git.noel.sh host.

Security boundary

  • exact archive SHA-256: 67c4a96dd237c1f518f6b36083f270f9976d516f1e57fce891755ea782e50006
  • installation remains inside a --network=none sealed-input build step
  • the image contains only the cache client; jobs receive no cache credential by default
  • cache correctness remains Cargo/rustc input-addressed and every job remains disposable

Verification

  • ./test-system-hz-hermetic.sh
  • bash -n test-system-hz-hermetic.sh
  • git diff --check

A separate reviewed Infra promotion/pin is required before Codewire consumes this tool.

Ref: codewire/codewire#1714

## Outcome Add sccache 0.17.0 to the existing networkless system CI derivative as one checksum-pinned sealed input. This enables Codewire host Rust jobs to use the same best-effort untrusted R2 object cache already proven for BuildKit, without injecting a downloader or a second cache service into jobs. The source label and README also use the current canonical git.noel.sh host. ## Security boundary - exact archive SHA-256: 67c4a96dd237c1f518f6b36083f270f9976d516f1e57fce891755ea782e50006 - installation remains inside a --network=none sealed-input build step - the image contains only the cache client; jobs receive no cache credential by default - cache correctness remains Cargo/rustc input-addressed and every job remains disposable ## Verification - ./test-system-hz-hermetic.sh - bash -n test-system-hz-hermetic.sh - git diff --check A separate reviewed Infra promotion/pin is required before Codewire consumes this tool. Ref: codewire/codewire#1714
noel merged commit 2e1f6623b0 into main 2026-08-19 13:11:11 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
noel/act-node-docker!9
No description provided.