Repository navigation
ci: cache Windows lanes and build Windows on the 16-core GitHub runner - #1333
Merged
Merged
Conversation
GitHub lifted the cache cap, so the three Agent lanes that need GitHub's windows-2025 image now keep caches in GitHub's store. Pull requests still only restore; master pushes and the nightly run save. - The planner gives each matrix entry cache_save: false when the resolved runner is from another vendor than the lane's home runner, so a failover never writes into the other store. Both matrices use it instead of matching labels in YAML; Blacksmith lanes behave as before. - agent-full-windows saves its rust-cache like every other matrix lane. - agent-windows-updater gets its own rust-cache key, saved by master pushes and nightly on GitHub's runners. Its receipts and artifact are unchanged, and the Agent's own crates still compile from source. - agent-package-windows restores ci-v1-agent-package-Windows-* like the Linux and macOS rehearsals, and runs nightly to save it. - CI_WINDOWS_GITHUB_RUNNER overrides the three lanes' runner (default windows-2025), for example to a larger GitHub runner on the same store. The workflow policy now lists exactly these GitHub-store writers and checks the failover guards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- C4 pins the packaging rehearsals' restore-keys to their own prefix and checks that no job falls back into ci-v1-agent-release-* by prefix. - The workflow policy pins the cached matrix lanes whose home runner uses GitHub's store (agent-full-windows), not only the matrix job, and requires every ci.yml cache save to name only push or schedule events. - plan.py lint checks that the plan step passes every matrix runner's override variable, so CI_WINDOWS_GITHUB_RUNNER cannot silently move only the special jobs. - Docs: GitHub's larger runners are billed; the packaging cache is listed apart from the rust-cache lane caches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Compiling Windows jobs move to the org's GitHub-hosted larger runner maple-windows-2025-16core (Windows Latest 2025, 16 cores): - the Agent's GitHub-image lanes (agent-full-windows, agent-windows-updater, agent-package-windows), now the CI_WINDOWS_GITHUB_RUNNER default; - the unsigned Agent Windows build in agent-desktop-build.yml, so build, sign and verify all run on GitHub-hosted runners again; - the signed Research build in desktop-build.yml and release.yml build-windows, together, so the release still restores the sccache master writes. Short signing and verify jobs stay on windows-2025; the Windows Clippy lane and the Research Windows PR package stay on Blacksmith. The policy test treats the org's maple-* runners as GitHub-hosted, actionlint learns the label, and the signature probe accepts builds from it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AnthonyRonning
added
ci:windows
AnthonyRonning
added a commit
that referenced
this pull request
Oct 28, 2026
… Blacksmith (#1341) * ci(agent): build Dev desktop packages nightly, Prod on every push Agent master pushes now build, sign and verify only Prod on macOS, Linux and Windows. Dev packages build nightly on the master tip (10:37 UTC) and, with Prod, on a manual dispatch. The Dev legs cost about $1.50 per Agent push. They also coupled the chains: on 0.0.12 (run 40625776561) 'Linux bundle (dev)' lost its runner, and Attest and Verify Linux were skipped for Prod too, so the release could not publish Linux without a rerun. Pushes no longer have a Dev leg to wait for. - Every packaging job's variant matrix is Prod on push, Dev on schedule and both on dispatch; each job's if: admits the schedule event. The changes job already selects the build on any non-push event. - Dev and Prod share the exact-key release cache (the profile changes only Agent workspace crates). Only pushes save it, so the nightly and dispatched builds restore Prod's entry and never write it. - The publisher already rejects schedule runs; desktop-signing and windows-signing allow master by branch policy, which a scheduled run on the default branch satisfies. - C2 now checks every event: a push that drops Prod or builds Dev, or a nightly that builds Prod, fails. C4 evaluates the release-cache save condition per event (push only) and pins its writers to Prod on push. - test_plan covers the nightly selection; docs updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci(opensecret): build every EIF on blacksmith-16vcpu-ubuntu-2404-arm The os-eif PR candidate is the one thing keeping OpenSecret src/ PRs over 10 minutes: its build took p50 7.8 / p90 9.2 min on 8 vCPU ARM (52 dev+prod pairs, 10-11..10-26), so ci-ok on PRs with EIF inputs was ~9.9 p50 / 12.4 p90 and 44% of them exceeded 10 min. Every EIF builder moves together, so the PR candidate, the trusted master and approval builds and the release builder stay on one runner class (C5): lanes.py EIF_BUILDER (ci.yml os-eif), opensecret-eif.yml eif-trusted and opensecret-eif-release.yml build. actionlint declares the new label in place of the old one, which nothing uses any more. The unprivileged fork job stays on GitHub's ubuntu-24.04-arm. Nothing else about the EIF builds, their inputs or the PCR checks changes. 16 vCPU ARM costs twice the rate for an expected ~0.6x the time, about +24% per build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci(agent): build the Agent Windows binary on Blacksmith again 'Build Windows binary' moves from maple-windows-2025-16core back to blacksmith-8vcpu-windows-2025. The fat-LTO link runs on one thread, so the 16-core runner is no faster warm (19.7 min of Cargo against 19.4-20.8 on Blacksmith) and costs about $1.05 more per Agent push, roughly $300 a month. Signing and verification stay on GitHub's windows-2025. Kept consistent with what #1333 changed alongside it: - test_workflow_policy no longer lists the job as a GitHub cache-store writer; its exact-key release cache now lives in Blacksmith's store, like the macOS and Linux builders'. The first Windows build after this lands starts cold once; nothing else reads that key. - actionlint keeps maple-windows-2025-16core (release.yml and ci.yml still use it) and already declares the Blacksmith label. - The signature probe keeps accepting all three build runners, since it checks historical producer runs; only its comment changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: address review findings C2 now pins that the publisher rejects the nightly run by its event, even when the run carries every Prod job and artifact. The Agent README and the publisher docs describe which runs build and which qualify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows jobs that compile now run on the org's new GitHub-hosted larger runner
maple-windows-2025-16core(Windows Latest 2025, 16 cores, runner group Maple). The Agent Windows lanes that must run on GitHub's image now also keep caches. GitHub lifted the enterprise usage cap that had made the cache store read-only, so they can.Runner moves (all GitHub-hosted, so signing trust is unchanged)
agent-full-windows,agent-windows-updater,agent-package-windows(ci.yml)windows-2025, 4 cores, no cacheagent-desktop-build.ymlwindows-build(unsigned Agent build that feeds signed updates)desktop-build.ymlbuild-windows(signed Research build) andrelease.ymlbuild-windowswindows-2025windows-2025CI_WINDOWS_GITHUB_RUNNER=windows-2025moves the three Agent lanes back to the standard runner without a PR..github/actionlint.yamldeclares the new label.maple-*runners as GitHub-hosted. Azure signing,--deny-self-hosted-runnersattestation checks and the environments are unaffected.scripts/ci/windows_signature_reference.pyaccepts builds from the new runner.Caches for the GitHub-image Agent lanes
agent-full-windowsci-v1-agent-full-windows-*(rust-cache)agent-windows-updaterci-v1-agent-windows-updater-*(rust-cache)agent-package-windowsci-v1-agent-package-Windows-*, thin LTO, with a prefix fallbackplan.pyadds acache_savematrix field, and the special jobs guard onrunner.name.ci-v1-agent-release-*exact-key family are unchanged, apart fromwindows-buildnow writing its exact key into GitHub's store.What this PR's run proves
The labels
ci:windowsandci:packagemake the run exercise the new runner before anything depends on it:agent-windows-updater, including the updater's native ACL checks;The master and release moves are proven by master's first
desktop-build(signed Research Windows) andagent-desktop-buildruns after merge. Those run the same build scripts as the release.Local validation
scripts/citests and the publisher tests pass.plan.py lintpasses, and actionlint is clean on all workflows.workflows,ci-scriptsandrelease-gatesflake checks pass.Watch after merge
Cache storage. These lanes add a few GB per Agent lockfile change. If usage nears the 50 GB limit, GitHub evicts the least recently used entries, and that could include the release-fed Windows sccache. Check
gh api repos/MaplePrivacyLabs/Maple/actions/cache/usagedaily for a week. If needed, save the two rust-cache lanes from nightly only.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.