From a53679b49db1ed800809cadf8b1dfb9973235426 Mon Sep 17 00:00:00 2001 From: Luiz Gustavo Abou Hatem de Liz Date: Tue, 21 Jul 2026 16:24:34 -0300 Subject: [PATCH] ci: gate the sccache wrapper on the R2 secret so fork PRs build uncached RUSTC_WRAPPER was set to sccache unconditionally at the workflow env level. GitHub withholds repo secrets from pull_request runs whose head is a fork, so R2_ACCOUNT_ID interpolates to empty, the R2 endpoint becomes a nonexistent host, and sccache's server refuses to start - failing clippy/test before anything compiles. Only enable the wrapper when the secret is present; fork PRs fall back to an uncached-but-green build, which is also the right degradation since they shouldn't reach the write-capable shared cache anyway. Closes #337 --- .github/workflows/ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e0f2788e..ede8814c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,7 +29,12 @@ env: # deterministic, so PR builds writing to the shared bucket write correct objects # under correct keys (no poisoning); bound storage with an R2 lifecycle-expiry # rule on the bucket (sccache does not evict cloud backends itself). - RUSTC_WRAPPER: sccache + # GitHub withholds repo secrets from pull_request runs whose head is a fork, so + # R2_ACCOUNT_ID is empty there; only enable the wrapper when the secret exists, + # or fork PRs fail at sccache startup before compiling anything (empty endpoint + # host). Fork PRs are exactly the runs that shouldn't reach the write-capable + # cache anyway, so uncached-but-green is the right degradation. + RUSTC_WRAPPER: ${{ secrets.R2_ACCOUNT_ID != '' && 'sccache' || '' }} CARGO_INCREMENTAL: "0" SCCACHE_BUCKET: shepherd-sccache SCCACHE_ENDPOINT: https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com