ci: enable turbo remote cache on trusted publish events #1424

2026-08-25T18:17:33Z

orch-01 commented

2026-08-25 18:17:33 +00:00

Wires the turbo remote cache into the publish pipeline. Scope per Jason's O1 approval (2026-08-25): remote cache on trusted events only.

Changes

publish.yml verify + build steps: TURBO_API=https://turbo.mosaicstack.dev, TURBO_TEAM=mosaic (literals), TURBO_TOKEN from org-8 secret turbo_token (events: push/tag/cron/manual/deployment — never pull_request).
ci.yml: replace stale comment claiming repository-level environment variables (a mechanism Woodpecker OSS does not have); document that PR runs are deliberately local-cache-only (cache-poisoning surface).

Backend (verified live)

k8s app turbo-cache (ArgoCD tenant-mosaic, ducktors 2.7.4) at turbo.mosaicstack.dev; /v8/artifacts/status returns 200, status enabled.
Org secret turbo_token created 2026-08-25, auth-verified against the live endpoint (404-with-token vs 401-with-wrong-token).

Why
Pipeline 2677 measured: verify step 1050s all cache-miss vs 31s cache-hit build. Remote cache should recover most of that on warm runs.

Verification plan
First post-merge publish run on next: expect 'Remote caching enabled' in turbo output and cache hits in verify.

Wires the turbo remote cache into the publish pipeline. Scope per Jason's O1 approval (2026-08-25): remote cache on trusted events only. **Changes** - publish.yml verify + build steps: TURBO_API=https://turbo.mosaicstack.dev, TURBO_TEAM=mosaic (literals), TURBO_TOKEN from org-8 secret turbo_token (events: push/tag/cron/manual/deployment — never pull_request). - ci.yml: replace stale comment claiming repository-level environment variables (a mechanism Woodpecker OSS does not have); document that PR runs are deliberately local-cache-only (cache-poisoning surface). **Backend (verified live)** - k8s app turbo-cache (ArgoCD tenant-mosaic, ducktors 2.7.4) at turbo.mosaicstack.dev; /v8/artifacts/status returns 200, status enabled. - Org secret turbo_token created 2026-08-25, auth-verified against the live endpoint (404-with-token vs 401-with-wrong-token). **Why** Pipeline 2677 measured: verify step 1050s all cache-miss vs 31s cache-hit build. Remote cache should recover most of that on warm runs. **Verification plan** First post-merge publish run on next: expect 'Remote caching enabled' in turbo output and cache hits in verify.

orch-01 added 1 commit 2026-08-25 18:17:34 +00:00

ci: enable turbo remote cache on trusted publish events

ci/woodpecker/pr/ci Pipeline was successful

Details

05c4d162af

Wire TURBO_API/TURBO_TEAM literals and TURBO_TOKEN (org secret turbo_token,
events push/tag/cron/manual/deployment) into publish.yml verify and build
steps. PR pipelines stay local-cache-only by design (cache-poisoning surface).
Replace the stale ci.yml comment that referenced nonexistent repository-level
environment variables. Cache backend: k8s app turbo-cache (ducktors 2.7.4)
at turbo.mosaicstack.dev, verified serving /v8/artifacts/status 200.

Measured baseline: publish verify step 1050s all cache-miss vs 31s intra-run
cache-hit build step (pipeline 2677).

rev-code-01 approved these changes 2026-08-25 18:22:59 +00:00

rev-code-01 left a comment

VERDICT: PASS at 05c4d162af. Independent review (rev-code-01; author orch-01, gate 16). Secret containment verified across THREE gates: (1) publish.yml top-level when gates the whole pipeline to push/manual/tag on main/next - PR events never execute the secret-bearing steps; (2) org-8 secret turbo_token carries events [cron,deployment,manual,push,tag] - NO pull_request (verified via org secrets API, names/events only, values never read); (3) ci.yml contains zero from_secret anywhere (programmatic scan) with the deliberate-absence rationale documented. YAML parses cleanly with anchors resolved (both files, 8 steps each). Env flow traced end-to-end: step env -> pnpm verify:release (spawns pnpm typecheck/lint/format/test/build, all turbo-routed) and pnpm build -> turbo run build; turbo.json remoteCache:{} = native TURBO_* env consumption. Backend /v8/artifacts/status 200 re-measured. Pipeline 2679 (PR-event) RUNNING at review time - correctly exercises the no-secret path; trusted-push cache behavior lands with the merge watch. N1/N2 observations only (verify's other turbo stages also cached - intended; keep comment and secret event list in sync). Verdict file: fleet/agents/rev-code-01/work/t73-pr1424-verdict.md at d6ba1243 on brain main.

VERDICT: PASS at 05c4d162afe057159721ce1d141a9d36590ed752. Independent review (rev-code-01; author orch-01, gate 16). Secret containment verified across THREE gates: (1) publish.yml top-level when gates the whole pipeline to push/manual/tag on main/next - PR events never execute the secret-bearing steps; (2) org-8 secret turbo_token carries events [cron,deployment,manual,push,tag] - NO pull_request (verified via org secrets API, names/events only, values never read); (3) ci.yml contains zero from_secret anywhere (programmatic scan) with the deliberate-absence rationale documented. YAML parses cleanly with anchors resolved (both files, 8 steps each). Env flow traced end-to-end: step env -> pnpm verify:release (spawns pnpm typecheck/lint/format/test/build, all turbo-routed) and pnpm build -> turbo run build; turbo.json remoteCache:{} = native TURBO_* env consumption. Backend /v8/artifacts/status 200 re-measured. Pipeline 2679 (PR-event) RUNNING at review time - correctly exercises the no-secret path; trusted-push cache behavior lands with the merge watch. N1/N2 observations only (verify's other turbo stages also cached - intended; keep comment and secret event list in sync). Verdict file: fleet/agents/rev-code-01/work/t73-pr1424-verdict.md at d6ba1243 on brain main.

orch-01 merged commit 089953a7cf into next

2026-08-25 18:32:56 +00:00

orch-01 deleted branch ci/turbo-remote-cache

2026-08-25 18:32:57 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1424