Branch caches a server enforces

说明与用途

服务器根据 OIDC 令牌强制缓存写入，隔离分支并防止主分支缓存被污染。

问题

CI pipelines need to reuse artifacts from main while preventing untrusted or non-hermetic builds from contaminating the main cache.

结果

By moving write decisions to the server and using OIDC tokens for trust, the system ensures that only trusted main or merge‑queue builds can write to the shared cache, while branch builds are isolated. Reads are efficiently served by a header‑driven lookup that prefers main’s artifacts for PRs.

工作流

• 1. CI job mints a signed OIDC token containing repository, ref, and workflow claims.
• 2. The client sends a PUT /v8/artifacts/:hash request with the token and the artifact hash.
• 3. The server verifies the token against its trust policy. If the token matches a rule, the write is stored in the trusted cache; otherwise it is stored under the branch’s scope.
• 4. For reads, the client includes an x-artifact-read-scopes header listing refs in priority order (e.g., feat‑x, main).
• 5. The server iterates the list: if a ref matches a trusted rule, it looks in the trusted cache; otherwise it looks in that ref’s scope. The first hit is returned.
• 6. If no header is present, the server reads only from the trusted cache, ensuring compatibility with plain Turbo clients.

证据

The OIDC token, checked against the server's OIDC trust policy, is the only thing that decides where a write may land.

来源

A pull request from feat‑x wants its own earlier results first, then main's.

来源

The server walks the list and returns the first hit.

来源