Skip to content

ci: Rotate Docker cache keys #1816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
real-or-random merged 3 commits into from
Feb 2, 2026
Merged

ci: Rotate Docker cache keys #1816

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0ffb174
ci, docker: Fix LLVM repository signature failure
hebasto Feb 1, 2026
2f18567
ci: Rotate Docker cache keys every 4 weeks
hebasto Feb 2, 2026
2ccff6e
ci: Add weekly schedule
hebasto Feb 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .github/actions/run-in-docker-action/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@ inputs:
required: true
scope:
description: 'A cached image scope'
required: false
default: ${{ runner.arch }}
required: true
command:
description: 'A command to run in a container'
required: true
Expand Down
16 changes: 14 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ on:
- '**'
tags-ignore:
- '**'
schedule:
# Run on the default branch every Monday morning.
# This also warms the Docker caches after key rotation.
- cron: '22 2 * * 1'

concurrency:
group: ${{ github.event_name != 'pull_request' && github.run_id || github.ref }}
Expand Down Expand Up @@ -48,6 +52,8 @@ jobs:
docker_cache:
name: "Build ${{ matrix.arch }} Docker image"
runs-on: ${{ matrix.runner }}
outputs:
cache_scope: ${{ steps.cache_timestamp.outputs.period }}

strategy:
fail-fast: false
Expand All @@ -59,6 +65,10 @@ jobs:
runner: ubuntu-24.04-arm

steps:
- name: Get cache validity period
id: cache_timestamp
run: echo "period=$(($(date +%V) / 4))" >> "$GITHUB_OUTPUT"

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
with:
Expand All @@ -70,8 +80,8 @@ jobs:
uses: docker/build-push-action@v6
with:
file: ./ci/linux-debian.Dockerfile
cache-from: type=gha,scope=${{ runner.arch }}
cache-to: type=gha,scope=${{ runner.arch }},mode=min
cache-from: type=gha,scope=${{ runner.arch }}-${{ steps.cache_timestamp.outputs.period }}
cache-to: type=gha,scope=${{ runner.arch }}-${{ steps.cache_timestamp.outputs.period }},mode=min

x86_64-debian:
name: "x86_64: Linux (Debian stable)"
Expand Down Expand Up @@ -117,6 +127,7 @@ jobs:
uses: ./.github/actions/run-in-docker-action
with:
dockerfile: ./ci/linux-debian.Dockerfile
scope: ${{ runner.arch }}-${{ needs.docker_cache.outputs.cache_scope }}
command: ./ci/ci.sh

- &PRINT_LOGS
Expand Down Expand Up @@ -636,6 +647,7 @@ jobs:
uses: ./.github/actions/run-in-docker-action
with:
dockerfile: ./ci/linux-debian.Dockerfile
scope: ${{ runner.arch }}-${{ needs.docker_cache.outputs.cache_scope }}
command: |
g++ -Werror include/*.h
clang -Werror -x c++-header include/*.h
Expand Down
3 changes: 3 additions & 0 deletions ci/linux-debian.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,9 @@ RUN \
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
# Add repository for this Debian release
. /etc/os-release && echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME} main" >> /etc/apt/sources.list && \
# Temporarily work around Sequoia PGP policy deadline for legacy repositories.
# See https://github.com/llvm/llvm-project/issues/153385.
sed -i 's/\(sha1\.second_preimage_resistance =\).*/\1 9999-01-01/' /usr/share/apt/default-sequoia.config && \
Comment on lines +70 to +72
Copy link
Copy Markdown
Contributor

@real-or-random real-or-random Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What a sad thing to commit in this repo...

(Nothing to do here. I just wanted to point that out.)

apt-get update && \
# Determine the version number of the LLVM development branch
LLVM_VERSION=$(apt-cache search --names-only '^clang-[0-9]+$' | sort -V | tail -1 | cut -f1 -d" " | cut -f2 -d"-" ) && \
Expand Down