Skip to content

ci: mac source build fails when SDK cache entry is absent #7461

Description

@thepastaclaw

Summary

The mac-build / Build source job fails before configuration or compilation whenever the exact macOS SDK cache entry is absent. The prerequisite cache-check job successfully downloads and extracts the SDK, but cannot persist it when running for a fork PR because its token has no writable cache scope.

Observed on #7460:

Failure mode

The x86_64-apple-darwin / Check cache job reports:

Cache not found for input keys: depends-sdks-...
Downloading macOS SDK...
Verifying macOS SDK...
Extracting macOS SDK...
Failed to save: Unable to reserve cache with key depends-sdks-.... More details: cache write denied: token has no writable scopes

Because the ordinary depends cache is already present, x86_64-apple-darwin / Build depends is skipped. The later mac-build / Build source job then performs an exact restore with fail-on-cache-miss: true and exits immediately:

Failed to restore cache entry. Exiting as fail-on-cache-miss is set.

Root cause

The workflow assumes the SDK downloaded in the cache-check job will be available to a separate source-build job through actions/cache. That assumption fails for fork PR tokens, which can read but cannot create the missing repository cache entry. The downloaded SDK is discarded with the cache-check runner.

This is independent of the PR source diff. In #7460, only C++ unit-test fixture files changed; .github/workflows/build-src.yml, .github/workflows/build-depends.yml, and depends/hosts/darwin.mk are unchanged from develop.

Reproduction

  1. Remove or expire the exact depends-sdks-${{ hashFiles('depends/hosts/darwin.mk') }} cache entry.
  2. Trigger the build workflow from a fork PR while the ordinary macOS depends cache is still present.
  3. Observe the cache-check job download the SDK but fail to save it because the token lacks writable cache scope.
  4. Observe the depends-build job get skipped and the mac source-build job fail its exact SDK restore before compilation.

Possible direction

Carry the downloaded SDK to downstream jobs as a same-run artifact, make the mac source-build job prepare the SDK on an exact cache miss, or ensure a trusted workflow seeds the exact SDK cache key before untrusted PR builds consume it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions