From d92b6770aaf2f79a22772141a1d7bd95c1e2edab Mon Sep 17 00:00:00 2001 From: StellarWayne <45438363+StellarWayne@users.noreply.github.com> Date: Wed, 23 Sep 2026 16:15:51 -0700 Subject: [PATCH 1/3] ci: route Linux jobs to disposable AWS workers --- .github/workflows/publish.yml | 2 +- .github/workflows/quality.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 83ba38d..b59ebba 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -5,7 +5,7 @@ on: jobs: publish: - runs-on: ubuntu-latest + runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Checkout Repo uses: actions/checkout@v3 diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 3ddc407..7cdd0cc 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -5,7 +5,7 @@ jobs: quality: name: Quality - runs-on: ubuntu-latest + runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Checkout Repo From 4b58b1470c4b506165bdce384c6f74a2a297d7fd Mon Sep 17 00:00:00 2001 From: StellarWayne <45438363+StellarWayne@users.noreply.github.com> Date: Wed, 23 Sep 2026 17:31:13 -0700 Subject: [PATCH 2/3] ci: pin compatible pnpm and cache dependencies in S3 --- .github/workflows/publish.yml | 43 +++++++++++++++++++++++++++++------ .github/workflows/quality.yml | 43 +++++++++++++++++++++++++++++------ 2 files changed, 72 insertions(+), 14 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b59ebba..9880507 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -8,19 +8,48 @@ jobs: runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }} steps: - name: Checkout Repo - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Node Setup - uses: actions/setup-node@v3 + uses: actions/setup-node@v4 with: node-version: 18 - - name: PNPM Setup - uses: pnpm/action-setup@v2.2.2 + - name: Setup pinned pnpm + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 with: - version: latest - run_install: true - + version: 8.15.9 + - name: Resolve dependency cache + id: ci-pnpm-cache + shell: bash + run: | + echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" + echo "node=$(node --version)" >> "$GITHUB_OUTPUT" + - name: Export temporary AWS cache credentials + shell: bash + run: | + python3 - <<'PYTHON' + import json, os, subprocess + credentials = json.loads(subprocess.check_output(['aws', 'configure', 'export-credentials', '--format', 'process'])) + with open(os.environ['GITHUB_ENV'], 'a') as output: + for source, target in [('AccessKeyId', 'AWS_ACCESS_KEY_ID'), ('SecretAccessKey', 'AWS_SECRET_ACCESS_KEY'), ('SessionToken', 'AWS_SESSION_TOKEN')]: + value = credentials[source] + if not value or '\n' in value or '\r' in value: + raise RuntimeError('Invalid temporary credential value') + print('::add-mask::' + value) + output.write(target + '=' + value + '\n') + PYTHON + - name: Restore pnpm download store from S3 + uses: tespkg/actions-cache@e07e2d4953dc8c020d447363e5064e36d04f3cf9 + with: + region: us-west-1 + bucket: stellaraf-public-ci-961341522852-us-west-1 + path: ${{ steps.ci-pnpm-cache.outputs.path }} + key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-8.15.9/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ + hashFiles('pnpm-lock.yaml') }} + use-fallback: false + - name: Install dependencies + run: pnpm install --frozen-lockfile - name: Build run: pnpm run build diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 7cdd0cc..c303a6e 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -9,19 +9,48 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Node Setup - uses: actions/setup-node@v3 + uses: actions/setup-node@v4 with: node-version: 18 - - name: PNPM Setup - uses: pnpm/action-setup@v2.2.2 + - name: Setup pinned pnpm + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 with: - version: latest - run_install: true - + version: 8.15.9 + - name: Resolve dependency cache + id: ci-pnpm-cache + shell: bash + run: | + echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" + echo "node=$(node --version)" >> "$GITHUB_OUTPUT" + - name: Export temporary AWS cache credentials + shell: bash + run: | + python3 - <<'PYTHON' + import json, os, subprocess + credentials = json.loads(subprocess.check_output(['aws', 'configure', 'export-credentials', '--format', 'process'])) + with open(os.environ['GITHUB_ENV'], 'a') as output: + for source, target in [('AccessKeyId', 'AWS_ACCESS_KEY_ID'), ('SecretAccessKey', 'AWS_SECRET_ACCESS_KEY'), ('SessionToken', 'AWS_SESSION_TOKEN')]: + value = credentials[source] + if not value or '\n' in value or '\r' in value: + raise RuntimeError('Invalid temporary credential value') + print('::add-mask::' + value) + output.write(target + '=' + value + '\n') + PYTHON + - name: Restore pnpm download store from S3 + uses: tespkg/actions-cache@e07e2d4953dc8c020d447363e5064e36d04f3cf9 + with: + region: us-west-1 + bucket: stellaraf-public-ci-961341522852-us-west-1 + path: ${{ steps.ci-pnpm-cache.outputs.path }} + key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-8.15.9/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ + hashFiles('pnpm-lock.yaml') }} + use-fallback: false + - name: Install dependencies + run: pnpm install --frozen-lockfile - name: Formatting run: pnpm run format From 393ef95397ca47a192d11cdd14e9aaa771f6e25f Mon Sep 17 00:00:00 2001 From: StellarWayne <45438363+StellarWayne@users.noreply.github.com> Date: Wed, 23 Sep 2026 17:37:43 -0700 Subject: [PATCH 3/3] ci: pin compatible pnpm and cache dependencies in S3 --- .github/workflows/publish.yml | 3 ++- .github/workflows/quality.yml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 9880507..210a790 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -45,7 +45,8 @@ jobs: region: us-west-1 bucket: stellaraf-public-ci-961341522852-us-west-1 path: ${{ steps.ci-pnpm-cache.outputs.path }} - key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-8.15.9/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ + key: + cache/${{ github.repository }}/${{ github.ref }}/pnpm-8.15.9/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ hashFiles('pnpm-lock.yaml') }} use-fallback: false - name: Install dependencies diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c303a6e..269dc67 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -46,7 +46,8 @@ jobs: region: us-west-1 bucket: stellaraf-public-ci-961341522852-us-west-1 path: ${{ steps.ci-pnpm-cache.outputs.path }} - key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-8.15.9/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ + key: + cache/${{ github.repository }}/${{ github.ref }}/pnpm-8.15.9/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ hashFiles('pnpm-lock.yaml') }} use-fallback: false - name: Install dependencies