2 commits

Author	SHA1	Message	Date
BruebachL	140fbb4484	[CI] Cover the legacy distros and the slow macOS runner in a nightly (#7668) ... * [CI] Cover the legacy distros and the slow macOS runner in a nightly Every pull request built ten Linux legs and five macOS/Windows legs, including the previous release of each distro and macOS 13 on the Intel runner. Those legs exist to catch a regression for users on an older distribution, which a change being reviewed almost never does, and macOS 13 Intel is the slowest leg of the matrix - 28 minutes against 19 for the rest. They now run in a nightly build of the default branch and on tag builds, which is when a change actually ships. Pull requests keep the current release of each distro, the sanitizer leg and the coverage leg. * [CI] Run the nightly legs from their own jobs jobs.<id>.if cannot read matrix, so the previous filter never validated and no leg of this workflow ran. matrix.exclude cannot express it either: GitHub processes exclude before include, and these matrices are include-only. Split the regular and nightly legs into two jobs per platform, sharing the step list through a YAML anchor and gating the jobs on the event instead of on matrix. The nightly run now covers only the legs a push leaves out, and the event name is part of the concurrency group so a nightly and a master push do not cancel each other. * [CI] Run the coverage leg in the nightly gcovr.cfg sets no fail_under, so the leg cannot fail a build, and nothing consumes coverage-report: it was an artifact produced on every pull request and read by no one. In the nightly it becomes a trend over the default branch instead, next to the legs a change being reviewed does not wait for. The leg itself is unchanged - same distro, version and variant, so the image name and ccache key still match the warm cache it built. It is marked allow-failure so a reporting leg cannot redden the nightly run that vcpkg-cache-import requires to conclude in success. The release-test comment loses its per-leg parenthetical: it claimed the sanitizer leg packages, which #7666 stopped being true, and the coverage leg is no longer in this job. --------- Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>	2026-11-04 07:42:35 +01:00
BruebachL	25c85cf0bb	[CI] Key the vcpkg binary cache per ABI and let pull requests heal it (#7377) ... * [CI] Key the vcpkg binary cache per ABI and let pull requests heal it The cache had no prefix, and TAServers/vcpkg-cache restores every entry it finds under the prefix rather than only the hashes vcpkg asks for. With all legs sharing the single vcpkg/ namespace, each of the five of them downloads all 66 archives of all five on every run. Each restore also refreshes the entry's last access date, so a dead ABI generation stays fresh forever and GitHub's least recently used eviction can never reach it. Name the scope in the key after the platform, target and toolchain it belongs to, so a leg restores only its own archives. macOS 14, 15 and 26 on the same Xcode build identical binaries when they share the lowest deployment target, so point all three at 14 and let them share one scope instead of three. A pull request cannot write the shared cache either. Its entries are scoped to refs/pull/<n>/merge, so nothing it saves is ever readable again, and letting it write anyway only burns the repository's quota, which is what the previous attempt at this did. Keep the build read-only and hand the archives it had to build itself to a new workflow running in the default branch scope, which saves them where master can restore them. Forks stay read-only, they are the one case whose archives must not be trusted. Because the prefix changes every key, add a job that deletes the entries of retired scopes, which is the one-time clean up of the current flat namespace, and the per-run ones pull requests leave behind, which age based eviction also never reaches. Also pin the Linux ccache cache to its own subdirectory, since the directory is shared with the docker build context, and drop the clang-format install from the build images, which format nothing at runtime. * [CI] Create the vcpkg cache directory when a scope is still empty * [CI] Let a pull request write the vcpkg archives it builds * [CI] Upload the vcpkg handover as one archive instead of loose files * [CI] Hand the vcpkg cache over from one leg per scope * [CI] Gate vcpkg cache writes to master pushes --------- Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>	2026-10-14 08:14:16 +02:00