ci: keep Depot cache namespace inert

.agents/skills/manage-ci/references/current-inventory.md

@@ -105,10 +105,10 @@ from that same catalog.
 - `prepare-static-abi-input`: portable static ABI archive.
 - `compose-product-input`: exact host/runtime verification and composition.
 - `restore-smoke-inputs`: product/model extraction for consumers.
-- `select-ci-runners`: provider labels, Depot cache permission, and the
-  provider-derived `allow_native_github_cache` output. Depot-selected direct
-  PRs set it to false; hosted PR and trusted main/release/manual selections
-  retain native GitHub cache behavior.
+- `select-ci-runners`: provider labels, cache permissions, and the
+  provider-derived `allow_native_github_cache` / `allow_depot_remote_cache`
+  outputs. Every Depot selection sets both outputs to false; hosted PR,
+  release, and cache-warmer selections retain native GitHub cache behavior.
 - `configure-sccache-gha`: event/provider-derived compiler-cache setup.
 - `capture-sccache-stats`: machine-readable cache evidence.
 
@@ -124,7 +124,9 @@ under `ci/` or this inventory.
 Artifacts are correctness boundaries; caches only accelerate regeneration.
 PR artifacts generally retain for one day. Protected same-repository and fork
 lanes cannot publish shared trusted-main caches, and Depot cache access is
-denied. Large Cargo target caches restore trusted-main entries but remain
+denied. The Depot namespace is intentionally unused by trusted workflows;
+purge/expiry is required before PR activation, and an inert proxy is not
+authority-isolation proof. Large Cargo target caches restore trusted-main entries but remain
 restore-only on PRs. Exact Linux static ABI, Swift ABI, macOS Metal unit ABI,
 and Windows native ABI caches may publish into GitHub's isolated PR merge-ref
 scope for same-PR reruns. The Website slice is the sole publisher for the
@@ -170,10 +172,10 @@ Relevant repository variable names include `DEPOT_RUNNERS_ENABLED`,
 `DEPOT_PR_CANARY_REF` (absent by default; one exact
 `refs/pull/<number>/merge` ref only). The latter is a bounded selector
 canary, not a cache-isolation proof or a replacement for the global PR gate.
-The eligible five-lane Depot-PR graph now disables every native GitHub cache
+The eligible five-lane Depot graph now disables every native GitHub cache
 consumer (explicit cache actions, setup-* package caches, rust-cache, static /
-Metal / Windows / Swift ABI caches and Windows SDK cache toggles) when that
-output is false; cache misses rebuild normally. This checked-in mode does not
+Metal / Windows / Swift ABI caches and Windows SDK cache toggles) and Depot
+remote cache when those outputs are false; cache misses rebuild normally. This checked-in mode does not
 prove the absence of ambient Depot/WebDAV authority, so the runtime sentinel
 and no-secret/no-token canaries remain required. Other variables include `CUDA_VERSION`,
 `VULKAN_SDK_VERSION`, smoke configuration variables, and release/deployment

.github/actions/audit-depot-pr-isolation/action.yml

@@ -9,6 +9,12 @@ inputs:
   depot_selected:
     description: Whether the centralized runner policy selected a Depot executor.
     required: true
+  allow_native_github_cache:
+    description: Central cache policy output for native GitHub Actions cache APIs.
+    required: true
+  allow_depot_remote_cache:
+    description: Central cache policy output for Depot's remote cache.
+    required: true
 
 runs:
   using: composite
@@ -18,20 +24,45 @@ runs:
       env:
         INPUT_ORIGINAL_EVENT_NAME: ${{ inputs.original_event_name }}
         INPUT_DEPOT_SELECTED: ${{ inputs.depot_selected }}
+        INPUT_ALLOW_NATIVE_GITHUB_CACHE: ${{ inputs.allow_native_github_cache }}
+        INPUT_ALLOW_DEPOT_REMOTE_CACHE: ${{ inputs.allow_depot_remote_cache }}
       run: |
         set -euo pipefail
         original_event="${INPUT_ORIGINAL_EVENT_NAME:-${GITHUB_EVENT_NAME:-}}"
-        if [[ "$original_event" != "pull_request" &&
-              "$original_event" != "pull_request_target" ]]; then
-          exit 0
-        fi
-
         depot_selected="${INPUT_DEPOT_SELECTED:-}"
         if [[ "$depot_selected" != "true" && "$depot_selected" != "false" ]]; then
-          echo "depot_selected must be true or false, got: $depot_selected" >&2
+          echo "depot_selected must be true or false (depot_selected)" >&2
+          exit 1
+        fi
+        allow_native_github_cache="${INPUT_ALLOW_NATIVE_GITHUB_CACHE:-}"
+        if [[ "$allow_native_github_cache" != "true" &&
+              "$allow_native_github_cache" != "false" ]]; then
+          echo "allow_native_github_cache must be true or false (allow_native_github_cache)" >&2
+          exit 1
+        fi
+        allow_depot_remote_cache="${INPUT_ALLOW_DEPOT_REMOTE_CACHE:-}"
+        if [[ "$allow_depot_remote_cache" != "true" &&
+              "$allow_depot_remote_cache" != "false" ]]; then
+          echo "allow_depot_remote_cache must be true or false (allow_depot_remote_cache)" >&2
           exit 1
         fi
 
+        if [[ "$depot_selected" == "true" &&
+              "$allow_native_github_cache" != "false" ]]; then
+          echo "Depot selection requires native GitHub cache disabled (allow_native_github_cache)" >&2
+          exit 1
+        fi
+        if [[ "$depot_selected" == "true" &&
+              "$allow_depot_remote_cache" != "false" ]]; then
+          echo "Depot selection requires remote cache disabled (allow_depot_remote_cache)" >&2
+          exit 1
+        fi
+
+        if [[ "$original_event" != "pull_request" &&
+              "$original_event" != "pull_request_target" ]]; then
+          exit 0
+        fi
+
         forbidden_names=(
           DEPOT_CACHE_TOKEN
           DEPOT_TOKEN
@@ -45,50 +76,91 @@ runs:
           SCCACHE_WEBDAV_TOKEN
           SCCACHE_WEBDAV_USERNAME
           SCCACHE_WEBDAV_PASSWORD
+          SCCACHE_BUCKET
+          SCCACHE_ENDPOINT
           TURBO_TOKEN
           TURBO_API
           TURBO_TEAM
           GOCACHEPROG
+          REGISTRY_TOKEN
+          REGISTRY_USERNAME
+          REGISTRY_PASSWORD
+          REGISTRY_AUTH_TOKEN
+          NPM_TOKEN
+          NODE_AUTH_TOKEN
+          CARGO_REGISTRIES_CRATES_IO_TOKEN
         )
         for name in "${forbidden_names[@]}"; do
           if [[ -n "${!name:-}" ]]; then
-            echo "PR runner received forbidden credential/cache authority: $name" >&2
+            echo "PR runner received forbidden credential/cache authority ($name)" >&2
             exit 1
           fi
         done
 
-        for endpoint_name in ACTIONS_CACHE_URL ACTIONS_RESULTS_URL; do
+        endpoint_host() {
+          local endpoint="$1"
+          local authority="${endpoint#*://}"
+          authority="${authority%%[/?#]*}"
+          printf '%s' "$authority"
+        }
+
+        is_github_endpoint() {
+          local endpoint="$1"
+          local endpoint_lower
+          endpoint_lower="$(printf '%s' "$endpoint" | tr '[:upper:]' '[:lower:]')"
+          local authority
+          authority="$(endpoint_host "$endpoint_lower")"
+          [[ "$endpoint_lower" == https://* ]] || return 1
+          [[ "$authority" != *"@"* ]] || return 1
+          [[ "$authority" =~ ^([a-z0-9-]+\.)*actions\.githubusercontent\.com(:[0-9]{1,5})?$ ]]
+        }
+
+        is_loopback_endpoint() {
+          local endpoint="$1"
+          local endpoint_lower
+          endpoint_lower="$(printf '%s' "$endpoint" | tr '[:upper:]' '[:lower:]')"
+          # Loopback proxies require a numeric TCP port and an explicit path.
+          if [[ ! "$endpoint_lower" =~ ^https?://(localhost|127\.0\.0\.1|\[::1\]):([0-9]{1,5})/[^[:space:]]*$ ]]; then
+            return 1
+          fi
+          local port="${BASH_REMATCH[2]}"
+          (( port >= 1 && port <= 65535 ))
+        }
+
+        for endpoint_name in ACTIONS_CACHE_URL ACTIONS_RESULTS_URL ACTIONS_RUNTIME_URL; do
           endpoint="${!endpoint_name:-}"
           if [[ -z "$endpoint" ]]; then
             continue
           fi
           endpoint_lower="$(printf '%s' "$endpoint" | tr '[:upper:]' '[:lower:]')"
           if [[ "$endpoint_lower" == *depot.dev* ]]; then
-            echo "PR runner received a Depot Actions endpoint: $endpoint_name" >&2
+            echo "PR runner received a Depot Actions endpoint ($endpoint_name)" >&2
             exit 1
           fi
-          if [[ "$endpoint_lower" =~ ^https?://[^/]*@ ]]; then
-            echo "PR runner received an Actions endpoint with URL userinfo: $endpoint_name" >&2
+          authority="$(endpoint_host "$endpoint_lower")"
+          if [[ "$authority" == *"@"* ]]; then
+            echo "PR runner received an Actions endpoint with URL userinfo ($endpoint_name)" >&2
             exit 1
           fi
           if [[ "$depot_selected" != "true" ]]; then
             continue
           fi
-          if [[ ! "$endpoint_lower" =~ ^https://([a-z0-9-]+\.)*actions\.githubusercontent\.com(:[0-9]+)?([/?#]|$) ]]; then
-            echo "PR runner received a non-GitHub Actions endpoint: $endpoint_name" >&2
+          if ! is_github_endpoint "$endpoint" &&
+             ! is_loopback_endpoint "$endpoint"; then
+            echo "PR runner received a non-GitHub/non-loopback Actions endpoint ($endpoint_name)" >&2
             exit 1
           fi
         done
 
         docker_auth_config="${DOCKER_AUTH_CONFIG:-}"
-        if [[ -n "$docker_auth_config" ]] &&
-           printf '%s' "$docker_auth_config" | grep -Eiq 'depot\.dev'; then
-          echo "PR runner has Depot registry authentication configured" >&2
+        if [[ -n "$docker_auth_config" ]]; then
+          echo "PR runner has Docker registry authentication configured (DOCKER_AUTH_CONFIG)" >&2
           exit 1
         fi
 
         docker_config="${DOCKER_CONFIG:-${HOME:-}/.docker}/config.json"
-        if [[ -f "$docker_config" ]] && grep -Eiq 'depot\.dev' "$docker_config"; then
-          echo "PR runner has Depot registry authentication configured" >&2
+        if [[ -f "$docker_config" ]] &&
+           grep -Eiq '"(auths|credHelpers|credsStore)"[[:space:]]*:' "$docker_config"; then
+          echo "PR runner has Docker registry authentication configured (config.json)" >&2
           exit 1
         fi

.github/actions/configure-sccache-gha/action.yml

@@ -6,6 +6,10 @@ inputs:
     description: Allow this trusted job to read and write Depot's repository-scoped WebDAV cache.
     required: false
     default: "false"
+  allow_native_github_cache:
+    description: Allow this job to use GitHub Actions cache as an sccache backend.
+    required: false
+    default: "false"
 
 runs:
   using: composite
@@ -14,6 +18,7 @@ runs:
       uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       env:
         INPUT_ALLOW_DEPOT_REMOTE_CACHE: ${{ inputs.allow_depot_remote_cache }}
+        INPUT_ALLOW_NATIVE_GITHUB_CACHE: ${{ inputs.allow_native_github_cache }}
         DISPATCH_ORIGINAL_EVENT_NAME: ${{ github.event.inputs.original_event_name || '' }}
       with:
         script: |
@@ -28,6 +33,17 @@ runs:
             );
             return;
           }
+          const allowNativeGithubCache =
+            (process.env.INPUT_ALLOW_NATIVE_GITHUB_CACHE || '').toLowerCase();
+          if (
+            allowNativeGithubCache !== 'true' &&
+            allowNativeGithubCache !== 'false'
+          ) {
+            core.setFailed(
+              'allow_native_github_cache must be the string true or false.',
+            );
+            return;
+          }
 
           const eventName = process.env.GITHUB_EVENT_NAME || '';
           const effectiveEventName =
@@ -148,11 +164,14 @@ runs:
           }
 
           if (
-            allowDepotRemoteCache === 'false' &&
-            (webdavEndpoint || webdavToken)
+            allowNativeGithubCache === 'false' ||
+            (allowDepotRemoteCache === 'false' &&
+              (webdavEndpoint || webdavToken))
           ) {
             core.info(
-              'Depot cache is present but disabled for this trust context; using job-local disk only.',
+              allowNativeGithubCache === 'false'
+                ? 'Native GitHub and Depot cache disabled for this trust context; using job-local disk only.'
+                : 'Depot cache is present but disabled for this trust context; using job-local disk only.',
             );
             core.exportVariable('SCCACHE_WEBDAV_ENDPOINT', '');
             core.exportVariable('SCCACHE_WEBDAV_TOKEN', '');

.github/actions/select-ci-runners/action.yml

@@ -187,32 +187,20 @@ runs:
               "$INPUT_REF" == "refs/heads/main" && \
               "$INPUT_DEPOT_MAIN_ENABLED" == "true" ]]; then
               depot_enabled=true
-              allow_depot_remote_cache=true
             fi
             ;;
           *)
             depot_enabled=false
             ;;
         esac
 
-        # Depot's repository-scoped cache is never authorized by a PR gate.
-        # Trusted main push/dispatch paths are the only paths that may retain
-        # the existing remote-cache behavior.
-        if [[ "$depot_enabled" == "true" && \
-          "$is_direct_pull_request" != "true" && \
-          "$is_dispatched_pull_request" != "true" && \
-          "$INPUT_EVENT_NAME" == "workflow_dispatch" ]]; then
-          allow_depot_remote_cache=true
-        fi
-
-        # Depot runners do not provide GitHub's branch-isolated cache
-        # authority.  Native GitHub cache APIs are therefore disabled for a
-        # directly selected PR, while hosted PRs and trusted main/release or
-        # manual paths retain their existing cache behavior.  This value is
-        # derived only from the protected provider policy; callers cannot opt
-        # a Depot PR back in by supplying a cache-related input.
-        if [[ "$depot_enabled" == "true" && \
-          "$is_direct_pull_request" == "true" ]]; then
+        # Depot's Actions cache namespace is intentionally inert for every
+        # Depot selection. Native GitHub cache APIs and Depot's remote cache
+        # are both disabled; hosted selections retain native GitHub cache
+        # behavior. These values are derived only from provider policy, so a
+        # caller cannot opt a Depot build back into either cache authority.
+        if [[ "$depot_enabled" == "true" ]]; then
+          allow_depot_remote_cache=false
           allow_native_github_cache=false
         fi
 

.github/workflows/ci-linux-host-slice.yml

@@ -106,10 +106,12 @@ jobs:
       RUSTC_WRAPPER: sccache
       RUSTFLAGS: "-C link-arg=-fuse-ld=lld"
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@b5dc126b0abe9b990cccbbf65796c26af7a09dc8
         with:
           original_event_name: ${{ inputs.original_event_name }}
           depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_8, 'depot-') }}
+          allow_native_github_cache: ${{ needs.runner_policy.outputs.allow_native_github_cache }}
+          allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}
@@ -119,6 +121,7 @@ jobs:
       - uses: ./.github/actions/configure-sccache-gha
         with:
           allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}
+          allow_native_github_cache: ${{ needs.runner_policy.outputs.allow_native_github_cache }}
       - if: ${{ needs.runner_policy.outputs.allow_native_github_cache == 'true' }}
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 snapshot 2026-03-12
         continue-on-error: true

.github/workflows/ci-linux-product-slice.yml

@@ -45,6 +45,7 @@ jobs:
       contents: read
     outputs:
       runner: ${{ steps.policy.outputs.runner }}
+      allow_depot_remote_cache: ${{ steps.policy.outputs.allow_depot_remote_cache }}
       allow_native_github_cache: ${{ steps.policy.outputs.allow_native_github_cache }}
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
@@ -83,10 +84,12 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@b5dc126b0abe9b990cccbbf65796c26af7a09dc8
         with:
           original_event_name: ${{ inputs.original_event_name }}
           depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner, 'depot-') }}
+          allow_native_github_cache: ${{ needs.runner_policy.outputs.allow_native_github_cache }}
+          allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}

.github/workflows/ci-linux-runtime-slice.yml

@@ -104,10 +104,12 @@ jobs:
       LLAMA_STAGE_SKIP_NCCL: "1"
       RUSTC_WRAPPER: sccache
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@b5dc126b0abe9b990cccbbf65796c26af7a09dc8
         with:
           original_event_name: ${{ inputs.original_event_name }}
           depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_16, 'depot-') }}
+          allow_native_github_cache: ${{ needs.runner_policy.outputs.allow_native_github_cache }}
+          allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}
@@ -126,6 +128,7 @@ jobs:
       - uses: ./.github/actions/configure-sccache-gha
         with:
           allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}
+          allow_native_github_cache: ${{ needs.runner_policy.outputs.allow_native_github_cache }}
       - if: ${{ needs.runner_policy.outputs.allow_native_github_cache == 'true' }}
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 snapshot 2026-03-12
         continue-on-error: true

.github/workflows/ci-macos-host-slice.yml

@@ -58,6 +58,7 @@ jobs:
       contents: read
     outputs:
       runner_macos: ${{ steps.policy.outputs.runner_macos }}
+      allow_depot_remote_cache: ${{ steps.policy.outputs.allow_depot_remote_cache }}
       allow_native_github_cache: ${{ steps.policy.outputs.allow_native_github_cache }}
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
@@ -90,10 +91,12 @@ jobs:
       matrix:
         host: ${{ fromJson(inputs.hosts_matrix) }}
     steps:
-      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@98909c0909a947944dd3215ff4ef2c7f431e4ea8
+      - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@b5dc126b0abe9b990cccbbf65796c26af7a09dc8
         with:
           original_event_name: ${{ inputs.original_event_name }}
           depot_selected: ${{ startsWith(needs.runner_policy.outputs.runner_macos, 'depot-') }}
+          allow_native_github_cache: ${{ needs.runner_policy.outputs.allow_native_github_cache }}
+          allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.source_sha || github.sha }}