ci: cache Linux Swift toolchains - #1670
Conversation
|
Codex review: needs maintainer review before merge. Reviewed June 19, 2026, 10:57 PM ET / 02:57 UTC. Summary Reproducibility: not applicable. as a bug reproduction; this is a CI workflow PR. The changed behavior is verifiable from the current-head GitHub Actions Linux matrix status and copied log excerpts in the PR discussion. Review metrics: 2 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Next step before merge
Security Review detailsBest possible solution: Land the workflow change after normal required checks finish, keeping the cache scoped by OS, architecture, and Swift version while prerequisites are installed before the cache-sensitive swiftly install path. Do we have a high-confidence way to reproduce the issue? Not applicable as a bug reproduction; this is a CI workflow PR. The changed behavior is verifiable from the current-head GitHub Actions Linux matrix status and copied log excerpts in the PR discussion. Is this the best way to solve the issue? Yes. The current diff uses a narrow cache boundary, keeps downloading and initializing swiftly each run, installs prerequisites before the cache-sensitive install call, and has warm-cache Linux proof. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 0f85e05f1c3d. Label changesLabel changes:
Label justifications:
Evidence reviewedWhat I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
clawsweeper
Bot
added
rating: 🦪 silver shellfish
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 056b5787aa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| path: | | ||
| ~/.local/share/swiftly | ||
| ~/.local/bin/swiftly |
There was a problem hiding this comment.
In the cache-hit path this restores the toolchain directory and only the swiftly executable, but not the swift, swiftc, etc. shims that swiftly documents as SWIFTLY_BIN_DIR symlinks for toolchain commands. Because swiftly's install path also treats an already-present exact version as already installed rather than a new install, the later swiftly install "$SWIFT_VERSION" --use can leave a fresh runner without ~/.local/bin/swift, so swift --version and the Linux build fail after the first cache is saved. Cache the whole bin directory or explicitly recreate/select the shims on cache hits.
Useful? React with 👍 / 👎.
| echo "SWIFTLY_BIN_DIR=$SWIFTLY_BIN_DIR" >> "$GITHUB_ENV" | ||
|
|
||
| swiftly install 6.2.1 --use --assume-yes --post-install-file "$POST_INSTALL_SCRIPT" | ||
| swiftly install "$SWIFT_VERSION" --use --assume-yes --post-install-file "$POST_INSTALL_SCRIPT" |
There was a problem hiding this comment.
When this toolchain is restored from cache on a fresh Ubuntu runner, swiftly install "$SWIFT_VERSION" can report the exact version as already installed and skip generating the --post-install-file; swiftly's docs describe that file as being written only when the toolchain being installed has extra post-install steps. That means the sudo bash "$POST_INSTALL_SCRIPT" branch never runs on cache hits, so required apt packages that are not part of the runner image are no longer installed before swift build/swift test. Install the dependency script independently of the cached toolchain, or force a path that re-emits/runs those dependencies.
Useful? React with 👍 / 👎.
056b578 to
9281e25
Compare
|
@clawsweeper re-review I revised the cache boundary in
Fresh run for this commit: https://github.com/steipete/CodexBar/actions/runs/27857529840 Linux matrix proof from that run:
The first v2 run is cold because the key intentionally changed after removing cached bootstrap execution. Subsequent runs should be warm for the toolchain state while still using the freshly downloaded swiftly bootstrap. |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
status: 🔁 re-review loop
9281e25 to
14765ed
Compare
|
@clawsweeper re-review I addressed the cache-hit prerequisite finding in
Warm-cache proof run: https://github.com/steipete/CodexBar/actions/runs/27857784562 Key proof:
|
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
proof: sufficient
|
Maintainer verification on exact head
Landing this CI-only change. |
2 participants
Summary
build-linux-climatrixenv.SWIFT_VERSIONswiftlybootstrap binaryswiftly install, independent of cache hit/miss behaviorWhy
Every PR runs the Linux x64 and arm64 CLI jobs, and each job currently installs Swift 6.2.1 through swiftly before building/testing the CLI. Caching
~/.local/share/swiftlylets warm runs reuse Swift toolchain state while keeping the existingswiftly install ... --usecommand as the correctness gate.This does not change test coverage or branch-protection behavior. Cold runs still follow the existing download/init/install path. Warm runs still fetch the official swiftly bootstrap, verify required Ubuntu packages first, then let swiftly reuse cached toolchain state.
Safety
~/.local/share/swiftly;~/.local/bin/swiftlyis not cached.swiftly install.ca-certificates,gpg, andlibcurl4-openssl-devare checked withdpkg-querybefore swiftly runs;apt-get update/installonly runs when one is missing.swiftly install "$SWIFT_VERSION" --usecall remains in place, so swiftly still validates/selects the requested toolchain.Validation
yaml.safe_loadbuild-linux-clijob containsactions/cache@v4with an OS/arch/Swift-version scoped key~/.local/share/swiftlybash -ngit diff --checkGitHub Actions proof
Warm-cache run for this commit: https://github.com/steipete/CodexBar/actions/runs/27857784562
changes: successlint: successbuild-linux-cli (linux-x64, ubuntu-24.04): successRestore Swift toolchain cache: successCache restored from key: swift-Linux-X64-6.2.1-v2Swift toolchain cache hit: trueSetting up libcurl4-openssl-dev:amd64Swift version 6.2.1 (swift-6.2.1-RELEASE)build-linux-cli (linux-arm64, ubuntu-24.04-arm): successRestore Swift toolchain cache: successCache restored from key: swift-Linux-ARM64-6.2.1-v2Swift toolchain cache hit: trueSetting up libcurl4-openssl-dev:arm64Swift version 6.2.1 (swift-6.2.1-RELEASE)This proves the warm-cache path still installs missing Ubuntu prerequisites before
swiftly install, selects Swift 6.2.1, and completes the full Linux build/test/smoke matrix on both architectures.