ci: stop E2E from saving an unresolved Swift package cache

[teamleaderleo]

Problem

E2E build job 108069926979 (run 36134675453, blacksmith-12vcpu-macos-26) restored an exact spm-03e341ca... hit, then its offline resolve failed after 44 s with "no versions of 'iroh-ffi' match the requirement 1.0.2-cmux.7.ios17.3" and it resolved online for another 86 s.

Cause

test-e2e.yml restored the spm- cache with actions/cache, which also saves on an exact-key miss. canonical-resolve copies the checkout to /private/tmp/cmux-ci/src and resolves there, so the workspace .ci-source-packages that the post step saved was still the fallback restore of the previous Package.resolved. nightly.yml already avoids this by collecting the resolved copy before saving; E2E did not.

After 4a0bd3a moved iroh-ffi to 1.0.2-cmux.7.ios17.3, an E2E run saved the old iroh-ffi clone (no new tag) under the new exact key in the GitHub store. Every later exact hit then tried the offline resolve, which cannot fetch, and fell back.

Frequency

Successful E2E build jobs today on Blacksmith (all read the GitHub store):

Job	Key	Offline resolve	Resolve total
108002501389 (08:36Z)	old spm-4c27	ok	112 s
108015710751 (09:36Z)	old spm-4c27	ok	116 s
108040802311 (10:57Z)	new spm-03e3	failed, 38 s	80 s
108069926979 (12:53Z)	new spm-03e3	failed, 44 s	130 s

2 of 2 exact hits since the lockfile change failed offline. Even the "working" GitHub-store entry took about 2 minutes, since it holds no resolved state. Owned minis are unaffected (kept package state, about 10 s).

Fix

• test-e2e.yml, test-macos-suite.yml and perf-activation.yml restore the spm- cache read-only through ./.github/actions/cache-restore, from the store nightly.yml seeds with the resolved copy (R2 by default), the same way compile admission already does. Each step sets CI_CACHE_R2_PUBLIC_URL, without which r2-cache.sh silently reports a miss.
• tests/test_ci_pull_request_caches_are_read_only.py now fails any workflow other than nightly.yml that saves an spm- .ci-source-packages cache, or reads one other than through cache-restore with an r2 backend and CI_CACHE_R2_PUBLIC_URL set. It fails on the old workflows with all three findings and passes now.

No layout bump: the R2 seeds are written from the resolved copy and were never affected. Until nightly seeds the new key, E2E takes the prefix fallback and resolves normally, with no failed offline attempt.

Verification

• python3 tests/test_ci_pull_request_caches_are_read_only.py (fails before on test-e2e, test-macos-suite, perf-activation; passes after)
• python3 tests/test_ci_manual_macos_package_cache.py, tests/test_seed_derived_data.py, tests/test_ci_change_areas.py, tests/test_ci_reusable_workflow_permissions.py, tests/test_ci_cache_restore_receipt.py
• actionlint on the three workflows

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

CI workflows no longer save a Swift package cache they only restore. Previously actions/cache saved on an exact-key miss, storing a fallback restore of the previous Package.resolved under the new exact key, so after the iroh-ffi version bump every exact hit failed the offline resolve and fell back to fetching remotes.

• E2E, the macOS suite, and perf-activation now restore the spm- cache read-only via ./.github/actions/cache-restore, from the resolved copy nightly.yml seeds, with an r2 backend and CI_CACHE_R2_PUBLIC_URL set (a missing public URL silently reports a miss).
• A new test guard fails any workflow other than nightly.yml that saves an spm- .ci-source-packages cache, or reads one from a store nightly does not seed without an r2 backend and the public URL.

^{Written for commit 6981afa. Summary will update on new commits.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[github-actions]

Merge receipt for 6981afa7a6, merged 2026-09-25 13:15:52 UTC

• Not verified at merge: ci-status (not reported), Web complexity (in progress)
• Verified: web-validation, Fast static checks, receipt-contract, Testbox broker trust boundary
• Skipped by policy: web-build, web-database-tests, web-tests
• Full suite: runs on main after merge.

Labeled merged-unverified: if main breaks near this merge, look here first.