From 962bb85619ef656bdb1ab3864599cdb6613030ed Mon Sep 17 00:00:00 2001 From: Dmitriy Zhavoronkov Date: Mon, 17 Aug 2026 19:24:38 +0200 Subject: [PATCH] perf(ci): let only main write the Gradle cache MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Measured on run 32030544289: the Plugin Verifier job spent 1m44s and the test job 32s in `Post Setup Gradle` — i.e. uploading cache — on top of both runs starting cold. The cause was the cache-read-only condition, which excluded forks only, so every same-repo pull request wrote its own copy of the Gradle home. That put the repository at 24GB across 60 entries against GitHub's ~10GB per-repo budget (refs/heads/main=14, refs/pull/28=18, refs/pull/29=17), so entries were LRU-evicted before they could be reused. Runs therefore paid twice: cold restores plus ~2min/run of pointless uploading. Pull requests are now read-only and only pushes to main write, which is the documented setup-gradle pattern. PRs can still restore the default branch's cache, and main already holds a full set of entries. It is also strictly safer, since same-repo PRs can no longer poison the shared cache. Also correct a comment added in #29 claiming the extracted IDEs are not cached and would need a cache action of their own. They are: setup-gradle covers both the installers under caches/modules-2 and the extracted trees (there is a `gradle-transforms-v1` entry, ~1.4GB). Pinning verification to a single IDE is what bounds the size, not any absence of caching. --- .github/workflows/ci.yml | 27 +++++++++++++++++---------- CHANGELOG.md | 4 ++++ 2 files changed, 21 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 20995e9..9835448 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,9 +41,13 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@v4 with: - # Write caches for internal branch pushes and same-repo PRs; keep - # read-only for untrusted fork PRs so they can't poison the cache. - cache-read-only: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} + # Only pushes to main write the cache; every pull request reads it. + # PRs used to write too (this condition excluded forks only), which + # put the repository at 24GB across 60 cache entries against a ~10GB + # budget: entries were LRU-evicted before they could be reused, so + # runs started cold AND spent ~2min/run uploading. PRs can still + # restore the default branch's cache, which is what we want. + cache-read-only: ${{ github.event_name == 'pull_request' }} # Note: this invocation always discards the configuration cache, because # koverVerify pulls in every Test task including platformTest, which is @@ -102,17 +106,20 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@v4 with: - cache-read-only: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} + # See the note in the test job: PRs read, main writes. This job is the + # worst offender for cache size, since it pulls whole IDE installers. + cache-read-only: ${{ github.event_name == 'pull_request' }} # The Plugin Verifier CLI downloads the plugin's Marketplace dependencies # (~1GB, ~2min observed) into ~/.pluginVerifier/loaded-plugins. That is - # outside the Gradle user home, so setup-gradle does not cover it. + # outside the Gradle user home, so setup-gradle does not cover it — hence + # this explicit cache. # - # The IDEs themselves are deliberately NOT cached: IPGP 2.x resolves them - # as Gradle dependencies and extracts each to ~4GB under - # ~/.gradle/caches//transforms/. Three supported lines would blow - # GitHub's 10GB per-repo cache budget and evict everything else. Pinning - # to one IDE (below) is the lever instead. + # The IDEs themselves need no cache action of our own: setup-gradle + # already covers them, both the installers in caches/modules-2 and the + # extracted trees (there is a `gradle-transforms-v1` entry, ~1.4GB). An + # earlier comment here claimed otherwise; that was wrong. Keeping the + # verification pinned to one IDE is what bounds the size. - name: Cache Plugin Verifier downloads uses: actions/cache@v4 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index eb502e2..bd6e289 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -37,6 +37,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 where deprecations surface at all, since the oldest supported SDK carries no annotation for them. Releases still sweep every supported line. Lint shares the test job, and the verifier's Marketplace downloads are cached, so the extra check costs little. +- **CI cache is written only by `main`**, and read by pull requests. Every PR used to write its + own copy of the Gradle home, which put the repository at 24 GB across 60 entries against a + ~10 GB budget — so entries were evicted before they could be reused, making runs cold *and* + costing ~2 min per run in uploads. ### Fixed - Removed all use of platform API that is deprecated or scheduled for removal, so the plugin