Summary
The mac-build / Build source job fails before configuration or compilation whenever the exact macOS SDK cache entry is absent. The prerequisite cache-check job successfully downloads and extracts the SDK, but cannot persist it when running for a fork PR because its token has no writable cache scope.
Observed on #7460:
Failure mode
The x86_64-apple-darwin / Check cache job reports:
Cache not found for input keys: depends-sdks-...
Downloading macOS SDK...
Verifying macOS SDK...
Extracting macOS SDK...
Failed to save: Unable to reserve cache with key depends-sdks-.... More details: cache write denied: token has no writable scopes
Because the ordinary depends cache is already present, x86_64-apple-darwin / Build depends is skipped. The later mac-build / Build source job then performs an exact restore with fail-on-cache-miss: true and exits immediately:
Failed to restore cache entry. Exiting as fail-on-cache-miss is set.
Root cause
The workflow assumes the SDK downloaded in the cache-check job will be available to a separate source-build job through actions/cache. That assumption fails for fork PR tokens, which can read but cannot create the missing repository cache entry. The downloaded SDK is discarded with the cache-check runner.
This is independent of the PR source diff. In #7460, only C++ unit-test fixture files changed; .github/workflows/build-src.yml, .github/workflows/build-depends.yml, and depends/hosts/darwin.mk are unchanged from develop.
Reproduction
- Remove or expire the exact
depends-sdks-${{ hashFiles('depends/hosts/darwin.mk') }} cache entry.
- Trigger the build workflow from a fork PR while the ordinary macOS depends cache is still present.
- Observe the cache-check job download the SDK but fail to save it because the token lacks writable cache scope.
- Observe the depends-build job get skipped and the mac source-build job fail its exact SDK restore before compilation.
Possible direction
Carry the downloaded SDK to downstream jobs as a same-run artifact, make the mac source-build job prepare the SDK on an exact cache miss, or ensure a trusted workflow seeds the exact SDK cache key before untrusted PR builds consume it.
Summary
The
mac-build / Build sourcejob fails before configuration or compilation whenever the exact macOS SDK cache entry is absent. The prerequisite cache-check job successfully downloads and extracts the SDK, but cannot persist it when running for a fork PR because its token has no writable cache scope.Observed on #7460:
depends-sdks-3b862087d606856e3a05b094cf50293dbb11d6dc15c627cac91fde000534c962Failure mode
The
x86_64-apple-darwin / Check cachejob reports:Because the ordinary depends cache is already present,
x86_64-apple-darwin / Build dependsis skipped. The latermac-build / Build sourcejob then performs an exact restore withfail-on-cache-miss: trueand exits immediately:Root cause
The workflow assumes the SDK downloaded in the cache-check job will be available to a separate source-build job through
actions/cache. That assumption fails for fork PR tokens, which can read but cannot create the missing repository cache entry. The downloaded SDK is discarded with the cache-check runner.This is independent of the PR source diff. In #7460, only C++ unit-test fixture files changed;
.github/workflows/build-src.yml,.github/workflows/build-depends.yml, anddepends/hosts/darwin.mkare unchanged fromdevelop.Reproduction
depends-sdks-${{ hashFiles('depends/hosts/darwin.mk') }}cache entry.Possible direction
Carry the downloaded SDK to downstream jobs as a same-run artifact, make the mac source-build job prepare the SDK on an exact cache miss, or ensure a trusted workflow seeds the exact SDK cache key before untrusted PR builds consume it.