oh-my-pi/.github/actions/bazel-cache/action.yml

name: "Compose bazel cache config"
description: >
   Selects the CI cache backend and emits a bazelrc fragment. A shell probe
   exposes the backend through step outputs before any action condition
   uses it.

   omp-kata jobs use the cluster remote cache. GitHub-hosted jobs use an
   actions/cache-backed disk cache seeded by the bazel-cache-warm workflow
   on the same runner image — cross-host action keys never hit, so the disk
   cache is hosted-only and its key carries a schema version (v1 was
   poisoned by a kata-produced export that silently missed every action).

   The v3 key is <config hash>-<source hash>: config covers toolchain and
   build settings, source covers crates/** + BUILD.bazel. Restores fall
   back to the config-scoped prefix, so a source generation the exact key
   has never seen still seeds from the previous generation's archive, and
   the refreshed archive is saved after the build (an exact hit suppresses
   the save — without the source component the first archive for a config
   generation would permanently shadow newer source states).

inputs:
   scope:
      description: Disk-cache key discriminator shared by compatible consumers
      required: true

outputs:
   rc:
      description: Path to the generated bazelrc fragment
      value: ${{ steps.compose.outputs.rc }}
   cache-key:
      description: Exact GitHub cache key for a later explicit save
      value: ${{ steps.backend.outputs.cache-key }}
   save-needed:
      description: Whether a disk-cache build can save a new exact-key archive
      value: ${{ steps.compose.outputs.save-needed }}
   remote:
      description: Whether the shell probe selected the cluster remote cache
      value: ${{ steps.backend.outputs.remote }}

runs:
   using: composite
   steps:
      - name: Detect bazel cache backend
        id: backend
        shell: bash
        env:
           CONFIG_HASH: ${{ hashFiles('Cargo.toml', 'Cargo.lock', 'MODULE.bazel', 'MODULE.bazel.lock', 'rust-toolchain.toml', 'rustfmt.toml', '.bazelrc', '.bazelignore', '.bazelversion', 'bazel/**') }}
           SOURCE_HASH: ${{ hashFiles('crates/**', 'BUILD.bazel') }}
        run: |
           set -euo pipefail
           remote=false
           if [ -n "${BAZEL_REMOTE_USER:-}" ] || [ -n "${BAZEL_REMOTE_PASSWORD:-}" ]; then
             if [ -z "${BAZEL_REMOTE_USER:-}" ] || [ -z "${BAZEL_REMOTE_PASSWORD:-}" ]; then
               echo "::error::BAZEL_REMOTE_USER and BAZEL_REMOTE_PASSWORD must both be set"
               exit 1
             fi
             remote=true
           fi
           key="bazel-disk-v3-${{ inputs.scope }}-${{ runner.os }}-${{ runner.arch }}-$CONFIG_HASH-$SOURCE_HASH"
           prefix="bazel-disk-v3-${{ inputs.scope }}-${{ runner.os }}-${{ runner.arch }}-$CONFIG_HASH-"
           {
             echo "remote=$remote"
             echo "cache-key=$key"
             echo "cache-prefix=$prefix"
           } >> "$GITHUB_OUTPUT"

      - name: Restore bazel disk cache
        id: restore
        if: steps.backend.outputs.remote != 'true'
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
           path: ~/.cache/omp-bazel-disk
           key: ${{ steps.backend.outputs.cache-key }}
           restore-keys: |
              ${{ steps.backend.outputs.cache-prefix }}

      - name: Compose cache config
        id: compose
        shell: bash
        env:
           REMOTE: ${{ steps.backend.outputs.remote }}
           RESTORE_HIT: ${{ steps.restore.outputs.cache-hit }}
        run: |
           set -euo pipefail
           save_needed=false
           if [ "$REMOTE" != "true" ] && [ "$RESTORE_HIT" != "true" ]; then
             save_needed=true
           fi

           rc="$RUNNER_TEMP/bazel-cache.rc"
           if [ "$REMOTE" = "true" ]; then
             # Mask the derived credential BEFORE writing the rc: config=ci
             # enables --announce_rc, which prints --remote_header verbatim.
             # Mask lines inside the redirected block below would land in the
             # rc file itself and mask nothing.
             raw_auth="${BAZEL_REMOTE_USER}:${BAZEL_REMOTE_PASSWORD}"
             auth="$(printf %s "$raw_auth" | base64 | tr -d '\n')"
             echo "::add-mask::$raw_auth"
             echo "::add-mask::$auth"
             {
               # The PVC mount lives outside $HOME. Pods are single-job and
               # use RUNNER_TEMP for Bazel's output root.
               echo "startup --output_user_root=$RUNNER_TEMP/bazel-root"
               echo "common --config=ci"
               echo "common --repository_cache=/opt/bazel-repo-cache"
               echo "common --repo_env=OMP_XWIN_CACHE_DIR=/opt/bazel-repo-cache/xwin"
               echo "common --config=cache-rw"
               echo "common --remote_cache=grpcs://bazel-remote.bazel-cache.svc.cluster.local:9092"
               echo "common --tls_certificate=infra/bazel-remote/ca.crt"
               echo "common --remote_header='authorization=Basic ${auth}'"
               echo "common --remote_download_toplevel"
             } > "$rc"
           else
             mkdir -p "$HOME/.cache/omp-bazel-disk" "$HOME/.cache/omp-bazel-repo"
             {
               echo "common --config=ci"
               echo "common --disk_cache=$HOME/.cache/omp-bazel-disk"
               echo "common --repository_cache=$HOME/.cache/omp-bazel-repo"
             } > "$rc"
           fi

           {
             echo "rc=$rc"
             echo "save-needed=$save_needed"
           } >> "$GITHUB_OUTPUT"