Branch caches a server enforces

Описание и применение

Сервер принимает решения о записи кэша на основе OIDC‑токенов, обеспечивая изоляцию веток и предотвращая загрязнение кэша основной ветки.

Задача

CI pipelines need to reuse artifacts from main while preventing untrusted or non-hermetic builds from contaminating the main cache.

Результат

By moving write decisions to the server and using OIDC tokens for trust, the system ensures that only trusted main or merge‑queue builds can write to the shared cache, while branch builds are isolated. Reads are efficiently served by a header‑driven lookup that prefers main’s artifacts for PRs.

Рабочий процесс

• 1. CI job mints a signed OIDC token containing repository, ref, and workflow claims.
• 2. The client sends a PUT /v8/artifacts/:hash request with the token and the artifact hash.
• 3. The server verifies the token against its trust policy. If the token matches a rule, the write is stored in the trusted cache; otherwise it is stored under the branch’s scope.
• 4. For reads, the client includes an x-artifact-read-scopes header listing refs in priority order (e.g., feat‑x, main).
• 5. The server iterates the list: if a ref matches a trusted rule, it looks in the trusted cache; otherwise it looks in that ref’s scope. The first hit is returned.
• 6. If no header is present, the server reads only from the trusted cache, ensuring compatibility with plain Turbo clients.

Доказательства

The OIDC token, checked against the server's OIDC trust policy, is the only thing that decides where a write may land.

Источник

A pull request from feat‑x wants its own earlier results first, then main's.

Источник

The server walks the list and returns the first hit.

Источник