From 3961c0a8dc7ce323aa344d8bf7c2533356196c8b Mon Sep 17 00:00:00 2001
From: Zack Jackson <25274700+ScriptedAlchemy@users.noreply.github.com>
Date: Sun, 8 Nov 2026 23:12:46 -0800
Subject: [PATCH 1/2] ci(bazel): isolate dependency snapshots and verify
 complete warms

---
 .github/actions/setup-bazel/action.yml      | 48 +++++++++++++++++----
 .github/actions/setup-bazel/save/action.yml |  4 +-
 .github/workflows/dependency-cache.yml      | 16 ++++++-
 3 files changed, 56 insertions(+), 12 deletions(-)

diff --git a/.github/actions/setup-bazel/action.yml b/.github/actions/setup-bazel/action.yml
index a54ef3b921..4d7e8cf73f 100644
--- a/.github/actions/setup-bazel/action.yml
+++ b/.github/actions/setup-bazel/action.yml
@@ -25,6 +25,9 @@ inputs:
   cache-save:
     description: Whether master jobs may save Bazelisk and newly fetched dependencies.
     default: "true"
+  verify-launcher-cache:
+    description: Restore only the complete launcher cache for an offline verification.
+    default: "false"
   windows-redirect-temp:
     description: Put Windows test temporary files on the runner workspace drive.
     default: "false"
@@ -52,6 +55,12 @@ outputs:
   repository-cache-entries:
     description: Restored entry count, used to avoid uploading an unchanged cache.
     value: ${{ steps.repository-cache-state.outputs.entries }}
+  launcher-cache-key:
+    description: Immutable platform and manifest key for a complete launcher archive.
+    value: ${{ steps.launcher-cache.outputs.cache-primary-key }}
+  launcher-cache-hit:
+    description: Whether the exact complete launcher archive was restored.
+    value: ${{ steps.launcher-cache.outputs.cache-hit }}
 
 runs:
   using: composite
@@ -142,6 +151,10 @@ runs:
       shell: bash
       env:
         CACHE_NAME: ${{ inputs.cache-key }}
+        WORKFLOW_NAME: ${{ github.workflow }}
+        JOB_NAME: ${{ github.job }}
+        MANIFEST: ${{ hashFiles('MODULE.bazel', 'Cargo.lock', 'pnpm-lock.yaml', '.bazelversion') }}
+        LAUNCHER_MANIFEST: ${{ hashFiles('MODULE.bazel', 'Cargo.lock', 'pnpm-lock.yaml', '.bazelversion', '.bazelrc', 'scripts/bazel/downloader.cfg', '.github/workflows/dependency-cache.yml') }}
         EXTRA_RESTORE_KEYS: ${{ inputs.extra-restore-keys }}
       run: |
         node <<'JS'
@@ -156,7 +169,11 @@ runs:
         const repositoryPath = windowsRoot
           ? `${windowsRoot}b-repo`
           : `${os.homedir().replace(/\\/g, '/')}/.cache/bazel-repo`;
-        const repositoryPrefix = `setup-bazel-1-${process.platform}-${os.arch()}-repository-`;
+        const platform = `setup-bazel-1-${process.platform}-${os.arch()}`;
+        const { WORKFLOW_NAME, JOB_NAME, CACHE_NAME, MANIFEST } = process.env;
+        const workload = `${platform}-deps-${WORKFLOW_NAME}-${JOB_NAME}-${CACHE_NAME}-`;
+        const legacy = `${platform}-repository-`;
+        const launcher = `${platform}-launcher-helpers-${process.env.LAUNCHER_MANIFEST}`;
         const names = [process.env.CACHE_NAME, ...(process.env.EXTRA_RESTORE_KEYS || '')
           .split(',')
           .map((name) => name.trim())
@@ -165,7 +182,7 @@ runs:
           `setup-bazel-1-${process.platform}-${os.arch()}-disk-${name}-`);
         fs.appendFileSync(
           process.env.GITHUB_OUTPUT,
-          `repository-path=${repositoryPath}\nrepository-prefix=${repositoryPrefix}\npath=${path}\noutput-base=${windowsRoot ? `${windowsRoot}b` : ''}\nprefix=${prefixes[0]}\nrestore-keys<<EOF\n${prefixes.join('\n')}\nEOF\n`,
+          `repository-path=${repositoryPath}\nworkload=${workload}\nworkload-manifest=${workload}${MANIFEST}-\nlegacy-manifest=${legacy}${MANIFEST}\nlegacy=${legacy}\nlauncher=${launcher}\npath=${path}\noutput-base=${windowsRoot ? `${windowsRoot}b` : ''}\nprefix=${prefixes[0]}\nrestore-keys<<EOF\n${prefixes.join('\n')}\nEOF\n`,
         );
         JS
 
@@ -235,17 +252,32 @@ runs:
         # under its repository name twice; keep the output base short.
         output-base: ${{ steps.disk-cache-config.outputs.output-base }}
 
-    # Restore by manifest, then platform. Publishing uses a fresh key only
-    # when the caller fetched new blobs, so a partial snapshot can grow.
-    - name: Restore dependency cache
+    # New snapshots share a restore prefix only with this workload. The old
+    # platform-wide keys remain read-only seeds during migration.
+    - name: Restore workload dependency cache
       id: repository-cache
+      if: inputs.verify-launcher-cache != 'true'
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.disk-cache-config.outputs.repository-path }}
-        key: ${{ steps.disk-cache-config.outputs.repository-prefix }}${{ hashFiles('MODULE.bazel', 'Cargo.lock', 'pnpm-lock.yaml', '.bazelversion') }}-run-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ inputs.cache-key }}
+        key: ${{ steps.disk-cache-config.outputs.workload-manifest }}run-${{ github.run_id }}-${{ github.run_attempt }}
         restore-keys: |
-          ${{ steps.disk-cache-config.outputs.repository-prefix }}${{ hashFiles('MODULE.bazel', 'Cargo.lock', 'pnpm-lock.yaml', '.bazelversion') }}-
-          ${{ steps.disk-cache-config.outputs.repository-prefix }}
+          ${{ steps.disk-cache-config.outputs.workload-manifest }}
+          ${{ steps.disk-cache-config.outputs.workload }}
+          ${{ steps.disk-cache-config.outputs.legacy-manifest }}
+          ${{ steps.disk-cache-config.outputs.legacy }}
+
+    # The hosted Ubuntu warmer publishes all launcher targets as one immutable
+    # snapshot. Extract it into the checksum-addressed cache after the workload
+    # snapshot, before Bazel runs, so a partial workload cannot shadow it.
+    - name: Restore complete launcher helpers
+      id: launcher-cache
+      if: runner.os == 'Linux'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.disk-cache-config.outputs.repository-path }}
+        key: ${{ steps.disk-cache-config.outputs.launcher }}
+        fail-on-cache-miss: ${{ inputs.verify-launcher-cache == 'true' }}
 
     - name: Measure restored dependency cache
       id: repository-cache-state
diff --git a/.github/actions/setup-bazel/save/action.yml b/.github/actions/setup-bazel/save/action.yml
index 565f6bca8a..0c48f5c014 100644
--- a/.github/actions/setup-bazel/save/action.yml
+++ b/.github/actions/setup-bazel/save/action.yml
@@ -15,7 +15,7 @@ runs:
   steps:
     - name: Check for newly fetched dependencies
       id: changed
-      if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' && inputs.key != ''
+      if: always() && !cancelled() && github.ref == 'refs/heads/master' && github.event_name != 'pull_request' && inputs.key != '' && inputs.restored-entries != ''
       shell: bash
       env:
         CACHE_PATH: ${{ inputs.path }}
@@ -30,7 +30,7 @@ runs:
         fs.appendFileSync(process.env.GITHUB_OUTPUT, `changed=${changed}\n`);
         JS
     - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      if: steps.changed.outputs.changed == 'true'
+      if: always() && !cancelled() && steps.changed.outputs.changed == 'true'
       with:
         path: ${{ inputs.path }}
         key: ${{ inputs.key }}
diff --git a/.github/workflows/dependency-cache.yml b/.github/workflows/dependency-cache.yml
index d8a1f1da69..2e7dc7fc01 100644
--- a/.github/workflows/dependency-cache.yml
+++ b/.github/workflows/dependency-cache.yml
@@ -38,8 +38,10 @@ jobs:
         with:
           cache-key: dependency-helpers
           cache-save: ${{ inputs.offline != true }}
+          verify-launcher-cache: ${{ inputs.offline == true }}
 
       - name: Fetch launcher helpers for every supported platform
+        id: fetch
         env:
           OFFLINE: ${{ inputs.offline == true }}
         run: |
@@ -56,8 +58,18 @@ jobs:
           fi
           bazel build "${options[@]}" "${targets[@]}"
 
-      - name: Save newly fetched Bazel dependencies
-        if: always() && !cancelled() && steps.bazel.outputs.repository-cache-key != ''
+      # Only a successful build of every target establishes a complete archive.
+      # A warm legacy/workload cache can already contain every blob on the
+      # first run; the immutable helper key must still be published then.
+      - name: Publish complete launcher helpers
+        if: success() && github.ref == 'refs/heads/master' && inputs.offline != true && steps.bazel.outputs.launcher-cache-hit != 'true' && steps.bazel.outputs.launcher-cache-key != ''
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.bazel.outputs.repository-cache-path }}
+          key: ${{ steps.bazel.outputs.launcher-cache-key }}
+
+      - name: Preserve partially fetched launcher dependencies
+        if: failure() && !cancelled() && steps.fetch.outcome == 'failure' && steps.bazel.outputs.repository-cache-key != ''
         uses: ./.github/actions/setup-bazel/save
         with:
           path: ${{ steps.bazel.outputs.repository-cache-path }}

From 7aca89888144756f6f762f30ff967e1cbfa97b71 Mon Sep 17 00:00:00 2001
From: Zack Jackson <25274700+ScriptedAlchemy@users.noreply.github.com>
Date: Sun, 8 Nov 2026 23:16:33 -0800
Subject: [PATCH 2/2] fix(ci): prevent cross-workload dependency restore
 fallbacks

---
 .github/actions/setup-bazel/action.yml | 26 ++++++++++++++++----------
 .github/workflows/dependency-cache.yml |  2 +-
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/.github/actions/setup-bazel/action.yml b/.github/actions/setup-bazel/action.yml
index 4d7e8cf73f..3b55bd4a1d 100644
--- a/.github/actions/setup-bazel/action.yml
+++ b/.github/actions/setup-bazel/action.yml
@@ -171,8 +171,8 @@ runs:
           : `${os.homedir().replace(/\\/g, '/')}/.cache/bazel-repo`;
         const platform = `setup-bazel-1-${process.platform}-${os.arch()}`;
         const { WORKFLOW_NAME, JOB_NAME, CACHE_NAME, MANIFEST } = process.env;
-        const workload = `${platform}-deps-${WORKFLOW_NAME}-${JOB_NAME}-${CACHE_NAME}-`;
-        const legacy = `${platform}-repository-`;
+        const identity = [WORKFLOW_NAME, JOB_NAME, CACHE_NAME].map(encodeURIComponent).join(':');
+        const workload = `${platform}-deps:${identity}:`;
         const launcher = `${platform}-launcher-helpers-${process.env.LAUNCHER_MANIFEST}`;
         const names = [process.env.CACHE_NAME, ...(process.env.EXTRA_RESTORE_KEYS || '')
           .split(',')
@@ -180,10 +180,19 @@ runs:
           .filter(Boolean)];
         const prefixes = names.map((name) =>
           `setup-bazel-1-${process.platform}-${os.arch()}-disk-${name}-`);
-        fs.appendFileSync(
-          process.env.GITHUB_OUTPUT,
-          `repository-path=${repositoryPath}\nworkload=${workload}\nworkload-manifest=${workload}${MANIFEST}-\nlegacy-manifest=${legacy}${MANIFEST}\nlegacy=${legacy}\nlauncher=${launcher}\npath=${path}\noutput-base=${windowsRoot ? `${windowsRoot}b` : ''}\nprefix=${prefixes[0]}\nrestore-keys<<EOF\n${prefixes.join('\n')}\nEOF\n`,
-        );
+        const outputs = [
+          `repository-path=${repositoryPath}`,
+          `workload=${workload}`,
+          `workload-manifest=${workload}${MANIFEST}-`,
+          `launcher=${launcher}`,
+          `path=${path}`,
+          `output-base=${windowsRoot ? `${windowsRoot}b` : ''}`,
+          `prefix=${prefixes[0]}`,
+          'restore-keys<<EOF',
+          ...prefixes,
+          'EOF',
+        ];
+        fs.appendFileSync(process.env.GITHUB_OUTPUT, outputs.join('\n') + '\n');
         JS
 
     - name: Preserve the runner network environment for Tailscale
@@ -252,8 +261,7 @@ runs:
         # under its repository name twice; keep the output base short.
         output-base: ${{ steps.disk-cache-config.outputs.output-base }}
 
-    # New snapshots share a restore prefix only with this workload. The old
-    # platform-wide keys remain read-only seeds during migration.
+    # A partial dependency snapshot can seed only its own workload.
     - name: Restore workload dependency cache
       id: repository-cache
       if: inputs.verify-launcher-cache != 'true'
@@ -264,8 +272,6 @@ runs:
         restore-keys: |
           ${{ steps.disk-cache-config.outputs.workload-manifest }}
           ${{ steps.disk-cache-config.outputs.workload }}
-          ${{ steps.disk-cache-config.outputs.legacy-manifest }}
-          ${{ steps.disk-cache-config.outputs.legacy }}
 
     # The hosted Ubuntu warmer publishes all launcher targets as one immutable
     # snapshot. Extract it into the checksum-addressed cache after the workload
diff --git a/.github/workflows/dependency-cache.yml b/.github/workflows/dependency-cache.yml
index 2e7dc7fc01..db6d525b01 100644
--- a/.github/workflows/dependency-cache.yml
+++ b/.github/workflows/dependency-cache.yml
@@ -59,7 +59,7 @@ jobs:
           bazel build "${options[@]}" "${targets[@]}"
 
       # Only a successful build of every target establishes a complete archive.
-      # A warm legacy/workload cache can already contain every blob on the
+      # A warm workload cache can already contain every blob on the
       # first run; the immutable helper key must still be published then.
       - name: Publish complete launcher helpers
         if: success() && github.ref == 'refs/heads/master' && inputs.offline != true && steps.bazel.outputs.launcher-cache-hit != 'true' && steps.bazel.outputs.launcher-cache-key != ''