Summary
Implement build caching for the EdgeZero deploy actions so a deploy no longer pays a ~10-minute cold Rust compile every run (observed on stackpop/trusted-server-deployer, which checks out a separate application repo and builds its CLI).
The design is merged (via #316) and lives at:
- Spec:
docs/specs/edgezero-deploy-build-caching.md (v6.14 — sccache pivot)
- Container sub-plan:
docs/superpowers/plans/2026-08-20-build-cache-container.md
Approach (v6.14)
Caching is delivered by a reusable workflow (workflow_call) running in a pinned container (single-manifest linux/amd64, digest-pinned, baking the Rust toolchain + wasm32-wasip1 + a pinned sccache + the Fastly CLI), on GitHub-hosted runners only. The cache mechanism is a fresh CARGO_TARGET_DIR + an action-owned pinned sccache disk cache (Cargo's own recommendation): content-addressed, so it works for any source (including EdgeZero's own unpublished git dependency), needs no custom target/ pruner, and caches no dependency source (compiled objects only). cache is off by default; provenance + container execution are unconditional.
Sub-plans (dependency-ordered)
- Pinned build container — Dockerfile, GHCR publish (verify-by-digest → reviewable
image.json PR), digest-pin gate. Everything keys platform-id on this digest.
- Cached build path — reusable workflow +
prepare/compile split + owned actions/cache restore/save over SCCACHE_DIR + config/source closure.
- Provenance — committed JSON Schema + canonical-JSON validation,
validate-app-cli-provenance, compute-app-cli-identity, the single ExpectedIdentity contract.
- Consumer integration —
active-version-fastly, per-consumer ExpectedIdentity, the one action-owned Docker launcher, production-only recovery.
Rollout is atomic at one EdgeZero SHA (provenance + container execution change every build; the direct-composite producer is retired, so adopters move to a two-job topology; runner floor rises to Actions Runner 2.336.0 for the self-repo $/ reference).
Status / scope of the tracking PR
The design has been through extensive review and is still being hardened. This issue tracks the implementation, landing in dependency order behind the container. The first increment (the fail-closed image.json digest-pin validator) is in the linked PR.
Out of scope (v1)
Caching .crate archives; workflow-bound artifact attestation; git/alternate-registry dependency authentication; a trusted self-hosted runner mode; non-default feature sets; non-Fastly adapters.
Summary
Implement build caching for the EdgeZero deploy actions so a deploy no longer pays a ~10-minute cold Rust compile every run (observed on
stackpop/trusted-server-deployer, which checks out a separate application repo and builds its CLI).The design is merged (via #316) and lives at:
docs/specs/edgezero-deploy-build-caching.md(v6.14 — sccache pivot)docs/superpowers/plans/2026-08-20-build-cache-container.mdApproach (v6.14)
Caching is delivered by a reusable workflow (
workflow_call) running in a pinned container (single-manifestlinux/amd64, digest-pinned, baking the Rust toolchain +wasm32-wasip1+ a pinnedsccache+ the Fastly CLI), on GitHub-hosted runners only. The cache mechanism is a freshCARGO_TARGET_DIR+ an action-owned pinnedsccachedisk cache (Cargo's own recommendation): content-addressed, so it works for any source (including EdgeZero's own unpublished git dependency), needs no customtarget/pruner, and caches no dependency source (compiled objects only).cacheis off by default; provenance + container execution are unconditional.Sub-plans (dependency-ordered)
image.jsonPR), digest-pin gate. Everything keysplatform-idon this digest.prepare/compilesplit + ownedactions/cacherestore/save overSCCACHE_DIR+ config/source closure.validate-app-cli-provenance,compute-app-cli-identity, the singleExpectedIdentitycontract.active-version-fastly, per-consumerExpectedIdentity, the one action-owned Docker launcher, production-only recovery.Rollout is atomic at one EdgeZero SHA (provenance + container execution change every build; the direct-composite producer is retired, so adopters move to a two-job topology; runner floor rises to Actions Runner 2.336.0 for the self-repo
$/reference).Status / scope of the tracking PR
The design has been through extensive review and is still being hardened. This issue tracks the implementation, landing in dependency order behind the container. The first increment (the fail-closed
image.jsondigest-pin validator) is in the linked PR.Out of scope (v1)
Caching
.cratearchives; workflow-bound artifact attestation; git/alternate-registry dependency authentication; a trusted self-hosted runner mode; non-default feature sets; non-Fastly adapters.