cache

This is GitHub FU. Key issue here is cache poisoning, that is feature/bug that exist in utility functions/actions provided by Github. Even if there was misconfiguration on tanstack side, then root cause is on. GH for even allowing insecure workflows to interfere with secure ones. Here people are trying to fix defaults - not to write cache in insecure context -> https://github.com/actions/cache/issues/1756 (even if sufficiely smart attacker would find the key somewhere and skip this kind of prodection, not sure where but write-allowing-key it must exist somewhere in runtime if actions/cache can us it) Someone else on this thread: > On GitLab even if you set the same cache key it will not cross between unprotected and protected runs.

> Do you use the proprietary github actions stuff? If I can avoid it, no. Almost everything I can control is outside of the Microsoft ecosystem. But as a freelancer, I have to deal a bunch with GitHub and Microsoft anyways, so in many of those cases, yes. Many times, I end up using https://github.com/actions/cache for the clients who already use Actions, and none of that runs in the local machines at all. Typically I use a single Makefile/Justfile, that sometimes have most of the logic inside of it for running tests and what not, sometimes shell out to "proper" scripts. But that's disconnected from the required "setup", so Make/Just doesn't actually download dependencies, that's outside of the responsibilities of whatever runs the test. And also, with a lot of languages, it doesn't matter if you run an extra "npm install" over already exi

https://github.com/search?q=org%3Aactions+%22we+are+allocati... i.e. from https://github.com/actions/cache/?tab=readme-ov-file#note Thank you for your interest in this GitHub repo, however, right now we are not taking contributions. We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.

Since we launched this last year, GitHub released a v2 of their internal cache API [0], based on Twirp [1] of all things, so we adapted to that. Interestingly that Twirp service also receives Actions artifacts, though we have not intercepted those today given that you likely still want them to appear in the GitHub UI / be accessible from the GitHub API. [0] https://github.com/actions/cache/discussions/1510 [1] https://github.com/twitchtv/twirp

> with no persistent storage There's https://github.com/actions/cache though?

I do think it's good practice to enable caching, such that your script doesn't hit RubyGems / pip / npm / etc every time it runs. That way at least the automation activity stays entirely within the GitHub / Azure network. It looks like you can do that for Ruby by adding this: https://github.com/actions/cache/blob/master/examples.md#rub... - uses: ruby/setup-ruby@v1 with: ruby-version: 3.1 bundler-cache: true

> I need to store artifacts related to this build, as I don’t want to build those again! https://docs.github.com/en/actions/using-workflows/storing-w... they do seem to be capable of saving most things people call artifacts or if you are looking for something more along the lines of caching parts of the build for future builds, you can adjust it pretty easily by adjusting what the cache key is based on. example: key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} which will allow you to cached based on the hash of a specific deps lock file instead of the commit sha. https://docs.github.com/en/actions/using-workflows/caching-d... https://github.com/actions/cache The one note here is clearing that cache/cache management isn't straight forward currently (although they are improving it), there are a few acceptable workarounds tho

I disagree with the POV of the article. That said, I do work at Spacelift[0], a specialized CI/CD for Infra as Code (so you can either take this with a grain of salt, or more trust, due to the increased exposure). > First, CI rarely knows what has changed, so everything needs to be rebuilt and retested. Yes, this is an issue with some CI/CD systems, an issue you can solve however. See our Push Policies[1] based on Open Policy Agent. Test-case caching is also sometimes available (available in i.e. Go). > Running tests pre-commit is one answer. Running tests locally for a quick feedback loop - sure, that's fairly mainstream though (something you can use our local preview[2] for as well in the case of IaC). Running tests locally before directly deploying to prod - that would be a compliance and security nightmare. The author presents what lo

This is hitting workflows that use caching [1][2]. - [1] https://github.com/actions/setup-node/issues/516 - [2] https://github.com/actions/cache/issues/820 As of now (11:28 UTC) the status page has been updated. https://www.githubstatus.com

see also https://github.com/actions/cache/issues/820 Looks like the package servers are having troubles. Apparently a workaround is to use the `cache: npm` parameter for the setup-node action. Won't help when you rely on other actions or docker builds etc.

I know. I've been wondering if there's a way this complexity could be buried in the GitHub action for dprint (https://github.com/dprint/check) so people would only have to specify that and everything would just happen, but I'm not sure it's possible at the moment. Caching seems to be limited to needing to use actions/cache (https://github.com/actions/cache)

iirc the biggest issue with `npm ci` before was that it cleared node_modules, which used to be the primary way of caching deps in CI builds, but now most suggest caching ~/.npm[0]. 0: https://github.com/actions/cache/blob/main/examples.md#node-...

- can't cache on tags [0] Caching is a joke. But then again, comparing GHA to GitLab CI is like comparing a pogo stick to a bicycle. Sure, both can be used to get there, but one ride is a bit... bumpy. (I use both and I am not affiliated to either.) [0] https://github.com/actions/cache/issues/556