[ScriptedAlchemy]

After merge, master published the complete helper archive and a fresh GitHub-hosted runner restored its exact key. All 14 platform helper targets resolved successfully with Bazel repository downloads disabled and release API staging omitted. Hosted offline verification.

Current base and verification

#4837, #4838 and #4847 have landed on master. This PR targets master directly again at 4c1fffaa4b; its tree matches the verified fde40ff100 tree. The three-file diff covers workload cache isolation, successful helper publication and exact offline verification. ShellCheck, actionlint, the hosted-runner policy and all 16 policy cases passed. Native GitHub auto-merge is enabled subject to the required checks. The earlier Linux repository gate stopped on a release download before tests; the shared archive fix is now on master.

Follow-up to merged #4840.

Each workflow, job and cache configuration now restores and publishes advances in its own dependency archive. The encoded workflow, job and cache names have explicit boundaries, including for configurations whose names share a prefix. A new workload with no complete helper archive starts empty. On the platform running the Ubuntu helper warmer, setup overlays the exact, successful launcher archive before Bazel starts. The archives contain checksum-addressed blobs, so a workload can keep its own downloads and use all 14 warmed helpers even if an unrelated job finishes later.

The warmer publishes its immutable generation only after every helper builds, including a first successful run that obtained all bytes from an existing cache. A failed warmer can publish newly fetched blobs only to its workload archive. The fresh-runner verifier from #4843 receives the exact canonical archive key from its successfully completed predecessor, preserving the #4844 handoff. Explicit keys and manual offline checks skip workload archives and fail on a miss. Both verification paths disable Bazel downloads. Its existing master-only retirement of old manifest keys runs only after the offline helper build succeeds. The ordinary save composite evaluates both its measurement and its upload after failed builds, and skips cancelled or unchanged jobs.

The downloader rule is correct as merged. The pinned Bazel 9.3.2 rewrites the URL after removing its scheme and preserves an explicit replacement protocol. The original PR owner verified all 14 helper targets from a cold Ubuntu cache and then from a fresh output base with downloads disabled. Downloader implementation · URL rewrite review · Concurrent snapshot review · Failed-build publication review

Local verification passed actionlint, the hosted-runner policy and all 16 policy tests. The actual setup and save scripts separated six workload namespaces (including overlapping names and encoded separators), selected a common canonical helper generation, detected growth and skipped an unchanged restored tree. Sequential tar extraction preserved independent checksum entries and shared entries. GitHub’s expression evaluator confirmed 19 exact-key, ordinary failure, cancellation, master/PR, first-warm, repeat-warm and offline decisions. Hosted publication requires master. After merge the warmer automatically starts an independent, downloads-disabled verification job; a manual offline dispatch remains available.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4c1fffa

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR