From f524f8536dc638a9a7f09f0f68745d23a68d6168 Mon Sep 17 00:00:00 2001 From: "Ryan Steel (ETAS)" Date: Fri, 7 Aug 2026 13:36:37 +0100 Subject: [PATCH 1/3] add cache-maintenance, bump workflow versions --- .github/workflows/build-qnx.yml | 2 +- .github/workflows/bzlmod-lock.yml | 2 +- .github/workflows/cache_maintenance.yml | 57 +++++++++++++++++++++++++ .github/workflows/code-coverage.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/comp-tests.yml | 2 +- .github/workflows/copyright.yml | 2 +- .github/workflows/docs-cleanup.yml | 2 +- .github/workflows/docs.yml | 4 +- .github/workflows/license-check.yml | 2 +- 10 files changed, 67 insertions(+), 10 deletions(-) create mode 100644 .github/workflows/cache_maintenance.yml diff --git a/.github/workflows/build-qnx.yml b/.github/workflows/build-qnx.yml index 8e5407b2..53906102 100644 --- a/.github/workflows/build-qnx.yml +++ b/.github/workflows/build-qnx.yml @@ -30,7 +30,7 @@ on: - main jobs: qnx-build: - uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@c644440e1f98e65db039cd66bcaa557314e6201b permissions: contents: read pull-requests: read diff --git a/.github/workflows/bzlmod-lock.yml b/.github/workflows/bzlmod-lock.yml index a4700ef7..b33ea559 100644 --- a/.github/workflows/bzlmod-lock.yml +++ b/.github/workflows/bzlmod-lock.yml @@ -33,6 +33,6 @@ on: jobs: bzlmod-lock: - uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@c644440e1f98e65db039cd66bcaa557314e6201b with: working-directory: . diff --git a/.github/workflows/cache_maintenance.yml b/.github/workflows/cache_maintenance.yml new file mode 100644 index 00000000..9714170c --- /dev/null +++ b/.github/workflows/cache_maintenance.yml @@ -0,0 +1,57 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* + +name: Cache maintenance + +# Refreshes caches and rebuilds a new bazel repository cache when MODULE.bazel.lock changes. +# Caches are only saved on pushes to the main branch or on workflow_dispatch events. +# In merge_groups and pull requests a fast dry-run is executed to ensure inputs are valid and caches can be rebuilt successfully. + +on: + pull_request: + types: [opened, reopened, synchronize, labeled, unlabeled] + merge_group: + types: [checks_requested] + workflow_dispatch: + push: + branches: [main] + +jobs: + repository_cache_maintenance: + permissions: + actions: write # needed for cache deletion after cache refresh + contents: read + secrets: + score-qnx-license: ${{ secrets.SCORE_QNX_LICENSE }} + score-qnx-user: ${{ secrets.SCORE_QNX_USER }} + score-qnx-password: ${{ secrets.SCORE_QNX_PASSWORD }} + uses: eclipse-score/cicd-workflows/.github/workflows/cache-maintenance.yml@c644440e1f98e65db039cd66bcaa557314e6201b + with: + variants: | + //... + --config=time-x86_64-linux //... + --config=time-arm64-linux //... + --config=time-x86_64-qnx //score/... //examples/... + --config=time-arm64-qnx //score/... //examples/... + + delete_old_caches: + runs-on: ubuntu-24.04 + needs: + - repository_cache_maintenance + permissions: + actions: write # needed for deletion of old caches + contents: read + if: ${{ !cancelled() && github.event_name == 'push' }} + steps: + - name: Prune obsolete Bazel caches + uses: eclipse-score/cicd-actions/prune-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml index 333ed94f..c784e7f1 100644 --- a/.github/workflows/code-coverage.yml +++ b/.github/workflows/code-coverage.yml @@ -30,7 +30,7 @@ on: jobs: code-coverage: - uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@c644440e1f98e65db039cd66bcaa557314e6201b with: bazel-target: "//score/..." bazel-config: "time-x86_64-linux" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 45600f9d..dfec3f26 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,7 @@ on: jobs: codeql: - uses: eclipse-score/cicd-workflows/.github/workflows/codeql.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/codeql.yml@c644440e1f98e65db039cd66bcaa557314e6201b with: build-script: "bazel build --config=time-x86_64-linux //score/..." permissions: diff --git a/.github/workflows/comp-tests.yml b/.github/workflows/comp-tests.yml index 94bf9476..88f0e86f 100644 --- a/.github/workflows/comp-tests.yml +++ b/.github/workflows/comp-tests.yml @@ -31,7 +31,7 @@ on: jobs: run-comp-tests: - uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@c644440e1f98e65db039cd66bcaa557314e6201b permissions: contents: read pull-requests: read diff --git a/.github/workflows/copyright.yml b/.github/workflows/copyright.yml index ae44d53c..004f32ae 100644 --- a/.github/workflows/copyright.yml +++ b/.github/workflows/copyright.yml @@ -27,4 +27,4 @@ on: types: [checks_requested] jobs: copyright-check: - uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@c644440e1f98e65db039cd66bcaa557314e6201b diff --git a/.github/workflows/docs-cleanup.yml b/.github/workflows/docs-cleanup.yml index c134104c..e3490d5a 100644 --- a/.github/workflows/docs-cleanup.yml +++ b/.github/workflows/docs-cleanup.yml @@ -24,6 +24,6 @@ on: jobs: docs-cleanup: - uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@c644440e1f98e65db039cd66bcaa557314e6201b secrets: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 3d7939ef..a60d722a 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -30,7 +30,7 @@ on: jobs: docs-verify: - uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@c644440e1f98e65db039cd66bcaa557314e6201b permissions: pull-requests: write contents: read @@ -39,7 +39,7 @@ jobs: docs-build: needs: docs-verify - uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@c644440e1f98e65db039cd66bcaa557314e6201b permissions: contents: write pages: write diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml index a3cf1833..8b2b5cb6 100644 --- a/.github/workflows/license-check.yml +++ b/.github/workflows/license-check.yml @@ -30,7 +30,7 @@ permissions: jobs: license-check: - uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2 + uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@c644440e1f98e65db039cd66bcaa557314e6201b with: repo-url: "${{ github.server_url }}/${{ github.repository }}" secrets: From 2ec569db39dda3c144d33aa95161290196facf94 Mon Sep 17 00:00:00 2001 From: "Ryan Steel (ETAS)" Date: Wed, 12 Aug 2026 11:31:59 +0100 Subject: [PATCH 2/3] chore: update to match cache-maintenance guide --- .github/workflows/build-linux.yml | 8 ++------ .github/workflows/build-qnx.yml | 4 +--- .github/workflows/cache_maintenance.yml | 12 ++++++++++-- .github/workflows/clang-tidy.yml | 7 ++----- .github/workflows/format.yml | 7 ++----- .github/workflows/sanitizers.yml | 7 ++----- 6 files changed, 19 insertions(+), 26 deletions(-) diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml index 693e7b37..216d76f0 100644 --- a/.github/workflows/build-linux.yml +++ b/.github/workflows/build-linux.yml @@ -28,7 +28,6 @@ on: - main merge_group: types: [checks_requested] - workflow_call: jobs: build: runs-on: ubuntu-24.04 @@ -39,12 +38,9 @@ jobs: - name: Checkout Repository uses: actions/checkout@v4.2.2 - name: Setup Bazel - uses: bazel-contrib/setup-bazel@0.18.0 + uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 with: - bazelisk-cache: true - disk-cache: ${{ github.workflow }}-${{ matrix.config }} - repository-cache: true - cache-save: ${{ github.event_name == 'push' }} + unique-cache-name: ${{ github.job }}-${{ matrix.config }} - name: Build with Bazel run: | diff --git a/.github/workflows/build-qnx.yml b/.github/workflows/build-qnx.yml index 53906102..de7edd4e 100644 --- a/.github/workflows/build-qnx.yml +++ b/.github/workflows/build-qnx.yml @@ -25,9 +25,7 @@ on: types: [opened, reopened, synchronize] merge_group: types: [checks_requested] - push: - branches: - - main + workflow_call: jobs: qnx-build: uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@c644440e1f98e65db039cd66bcaa557314e6201b diff --git a/.github/workflows/cache_maintenance.yml b/.github/workflows/cache_maintenance.yml index 9714170c..b08e6128 100644 --- a/.github/workflows/cache_maintenance.yml +++ b/.github/workflows/cache_maintenance.yml @@ -44,14 +44,22 @@ jobs: --config=time-x86_64-qnx //score/... //examples/... --config=time-arm64-qnx //score/... //examples/... + warmup-qnx: + needs: repository_cache_maintenance + # PR and merge-queue runs validate variants above but never warm or write + # shared caches. + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }} + secrets: inherit + uses: ./.github/workflows/build-qnx.yml + delete_old_caches: runs-on: ubuntu-24.04 needs: - - repository_cache_maintenance + - warmup-qnx permissions: actions: write # needed for deletion of old caches contents: read - if: ${{ !cancelled() && github.event_name == 'push' }} + if: ${{ !cancelled() && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} steps: - name: Prune obsolete Bazel caches uses: eclipse-score/cicd-actions/prune-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 diff --git a/.github/workflows/clang-tidy.yml b/.github/workflows/clang-tidy.yml index 538f1b67..94133f52 100644 --- a/.github/workflows/clang-tidy.yml +++ b/.github/workflows/clang-tidy.yml @@ -41,12 +41,9 @@ jobs: uses: actions/checkout@v4.2.2 - name: Setup Bazel - uses: bazel-contrib/setup-bazel@0.18.0 + uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 with: - bazelisk-cache: true - disk-cache: ${{ github.workflow }} - repository-cache: true - cache-save: ${{ github.event_name == 'push' }} + unique-cache-name: ${{ github.job }} - name: Run clang-tidy # continue-on-error is required: bazel exits non-zero when violations exist. diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml index 2a563e0f..ac10ce54 100644 --- a/.github/workflows/format.yml +++ b/.github/workflows/format.yml @@ -40,12 +40,9 @@ jobs: uses: actions/checkout@v4.2.2 - name: Setup Bazel - uses: bazel-contrib/setup-bazel@0.18.0 + uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 with: - bazelisk-cache: true - disk-cache: ${{ github.workflow }}-format-check - repository-cache: true - cache-save: ${{ github.event_name == 'push' }} + unique-cache-name: ${{ github.job }} - name: Run format check run: bazel test //:format.check diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml index 5e46d2a4..451c0174 100644 --- a/.github/workflows/sanitizers.yml +++ b/.github/workflows/sanitizers.yml @@ -42,12 +42,9 @@ jobs: uses: actions/checkout@v4.2.2 - name: Setup Bazel - uses: bazel-contrib/setup-bazel@0.18.0 + uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 with: - bazelisk-cache: true - disk-cache: ${{ github.workflow }}-${{ matrix.config }} - repository-cache: true - cache-save: ${{ github.event_name == 'push' }} + unique-cache-name: ${{ github.job }}-${{ matrix.config }} - name: Run tests with sanitizers # continue-on-error is required: bazel exits non-zero when tests fail. From 43917038c11099f15c11740076fc736dce503584 Mon Sep 17 00:00:00 2001 From: "Ryan Steel (ETAS)" Date: Wed, 12 Aug 2026 11:47:50 +0100 Subject: [PATCH 3/3] chore: fix cache_maintenance permissions --- .github/workflows/cache_maintenance.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/cache_maintenance.yml b/.github/workflows/cache_maintenance.yml index b08e6128..14fe3e4f 100644 --- a/.github/workflows/cache_maintenance.yml +++ b/.github/workflows/cache_maintenance.yml @@ -49,6 +49,9 @@ jobs: # PR and merge-queue runs validate variants above but never warm or write # shared caches. if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }} + permissions: + contents: read + pull-requests: read secrets: inherit uses: ./.github/workflows/build-qnx.yml