Build caching for the deploy actions (sccache) — sub-plan 1: container digest-pin gate - #347
Draft
aram356 wants to merge 2 commits into
Draft
Build caching for the deploy actions (sccache) — sub-plan 1: container digest-pin gate#347aram356 wants to merge 2 commits into
aram356 wants to merge 2 commits into
Conversation
First increment of the build-caching feature (sub-plan 1, Task 1) per docs/specs/edgezero-deploy-build-caching.md (v6.14) and docs/superpowers/plans/2026-08-20-build-cache-container.md. The pinned build container's platform-id keys the whole feature on a sha256 manifest digest, so check-image-pin.sh fails closed on a tag, missing digest, or malformed JSON. Colocated unit test: 6 cases, all green; shellcheck clean.
aram356
marked this pull request as draft
August 27, 2026 04:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Starts the build-caching implementation for the deploy actions (design merged in #316). Tracks #346. This PR lands the feature in dependency order behind the pinned build container; the first increment is the container's fail-closed digest-pin validator.
Spec:
docs/specs/edgezero-deploy-build-caching.md(v6.14 — sccache pivot). Plan:docs/superpowers/plans/2026-08-20-build-cache-container.md(sub-plan 1 of 4).In this PR
.github/docker/build-app-cli/check-image-pin.sh— fail-closed validator that the build container'simage.jsonis pinned by asha256manifest digest (not a mutable tag), since the whole feature keysplatform-idon that digest. Rejects a tag, a short/missing digest, a missing repository, and malformed JSON (fail-closed)..github/actions/deploy-core/tests/check-image-pin.test.sh— 6 colocated unit cases, all green;shellcheck -S warningclean.Nothing here is wired into the runtime yet (no
image.json, Dockerfile, or workflow), so this is CI-neutral and self-contained.Next increments (same PR, dependency order)
wasm32-wasip1+ pinnedsccache+ Fastly CLI), the GHCR verify-by-digest → reviewableimage.jsonPR publish workflow, and wiring the digest pin into the contract suite.Notes
The design has been through extensive hardening review and continues to evolve; this PR intentionally starts from the most approach-stable, self-contained piece so review can proceed incrementally rather than against the whole feature at once.