ci(cache): add a ci.toml declaring fbuild's cache ceiling (8.73 GiB = 87% of the 10 GiB cap)

.coderabbit.yaml

@@ -1,7 +1,17 @@
 reviews:
-  request_changes_workflow: true
+  # GATE-012 (policy-general.md "Remote-only checks never gate a PR"):
+  # CodeRabbit runs on GitHub's servers and cannot run under the local gate,
+  # so it must never be able to block a merge. Its findings stay useful as
+  # PR comments -- only the gating is disabled. This was a live violation:
+  # CodeRabbit's CHANGES_REQUESTED review held PR #1652 at BLOCKED with every
+  # one of its 20 checks green.
+  auto_review:
+    enabled: false
+  commit_status: false
+  fail_commit_status: false
+  request_changes_workflow: false
   pre_merge_checks:
-    enabled: true
+    enabled: false
   path_instructions:
     # FastLED/fbuild#838 — mock-vs-integration test review.
     # Dylint can't tell a "mock" from a normal #[cfg(test)] struct, so the

.github/workflows/benchmark-build-comparison.yml

@@ -33,13 +33,45 @@ jobs:
     name: Measure and publish Blink builds
     runs-on: ubuntu-24.04
     timeout-minutes: 60
+    # CACHE-034 (zackees/ci.yml#352/#354/#360): this job runs the pre-prune
+    # ahead of its own setup-soldr save; `actions: write` is what the cache
+    # deletions need (allow-listed in ci.toml's [allow.permissions]).
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
+          # HEAD^ must exist for ci/lockfile_changed.py (CACHE-034).
+          fetch-depth: 2
 
       - uses: astral-sh/setup-uv@v3
 
+      # CACHE-034 (zackees/ci.yml#352/#354/#360): honour [flow.main]'s
+      # `pre-prune = true` waiver. The prune runs in this job, ahead of the
+      # setup-soldr save below -- within the same run means same job or an
+      # earlier `needs:` link, and GitHub Actions has no cross-workflow
+      # barrier. The ci-lint checkout matches ci.toml's `linter` pin (CT-004).
+      - name: Check out ci-lint
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          repository: zackees/ci.yml
+          ref: 92106df315bd28de24ef1808c893c91a5859122d
+          path: .ci-lint
+          persist-credentials: false
+      - name: Detect lockfile change vs parent commit
+        id: lockfile
+        run: python3 ci/lockfile_changed.py
+      - name: Pre-prune superseded lockfile-keyed caches (CACHE-034)
+        if: github.event_name != 'pull_request' && steps.lockfile.outputs.changed == 'true'
+        env:
+          # act2/bosn replays inject no token: the fallback keeps the
+          # step runnable there (401 -> ci-lint warning, exit 0); GitHub
+          # runs always resolve github.token.
+          GITHUB_TOKEN: ${{ github.token || 'replay-no-token' }}
+          PYTHONPATH: .ci-lint
+        run: python3 -m ci_lint cache preprune --repo . --lockfile-changed --max-deletes 50
       - name: Setup soldr
         uses: zackees/setup-soldr@v0
         with:

.github/workflows/ci-minimal.yml

@@ -17,9 +17,10 @@ jobs:
   verify:
     name: Verify local gate
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 8
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout source
         uses: actions/checkout@v6
@@ -38,6 +39,28 @@ jobs:
           else
             echo "Local proof verification is required on pull requests"
           fi
+      # CACHE-034 (zackees/ci.yml#352/#354/#360): honour [flow.main]'s
+      # `pre-prune = true` waiver ahead of the check-ubuntu saves below this
+      # job in the needs: chain (actions: write allow-listed in ci.toml).
+      - name: Check out ci-lint
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          repository: zackees/ci.yml
+          ref: 92106df315bd28de24ef1808c893c91a5859122d
+          path: .ci-lint
+          persist-credentials: false
+      - name: Detect lockfile change vs parent commit
+        id: lockfile
+        run: python3 ci/lockfile_changed.py
+      - name: Pre-prune superseded lockfile-keyed caches (CACHE-034)
+        if: github.event_name != 'pull_request' && steps.lockfile.outputs.changed == 'true'
+        env:
+          # act2/bosn replays inject no token: the fallback keeps the step
+          # runnable there (it 401s and ci-lint reports a warning, exit 0)
+          # while real GitHub runs always resolve github.token.
+          GITHUB_TOKEN: ${{ github.token || 'replay-no-token' }}
+          PYTHONPATH: .ci-lint
+        run: python3 -m ci_lint cache preprune --repo . --lockfile-changed --max-deletes 50
   linux:
     if: github.event_name != 'pull_request' || (!contains(github.event.pull_request.labels.*.name, 'ci-test') && !contains(github.event.pull_request.labels.*.name, 'ci-full'))
     needs: verify

.github/workflows/dylint.yml

@@ -57,6 +57,13 @@ jobs:
     name: Dylint Full (Linux builder, all OS targets)
     runs-on: ubuntu-latest
     timeout-minutes: 90
+    # CACHE-034 (zackees/ci.yml#352/#354/#360): this job is the run's only
+    # setup-soldr saver, so it runs `ci-lint cache preprune` itself ahead of
+    # its own save; `actions: write` is what the cache deletions need
+    # (allow-listed in ci.toml's [allow.permissions]).
+    permissions:
+      contents: read
+      actions: write
     defaults:
       run:
         shell: bash
@@ -65,6 +72,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ inputs.ref }}
+          # HEAD^ must exist for ci/lockfile_changed.py (CACHE-034).
+          fetch-depth: 2
       - name: Set up uv
         uses: astral-sh/setup-uv@v3
       - name: Validate Dylint allowlist paths
@@ -77,6 +86,40 @@ jobs:
           uv run --no-project python ci/check_fbuild_path_baseline.py --base FETCH_HEAD
       - name: Validate platform-boundary ledgers
         run: uv run --no-project python ci/enforce_platform_boundary.py --print-totals
+      # CACHE-034 (zackees/ci.yml#352/#354/#360): honour [flow.main]'s
+      # `pre-prune = true` waiver. The prune runs in this job, ahead of the
+      # setup-soldr save below -- within the same run means same job or an
+      # earlier `needs:` link, and GitHub Actions has no cross-workflow
+      # barrier. The ci-lint checkout matches ci.toml's `linter` pin (CT-004).
+      - name: Check out ci-lint
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          repository: zackees/ci.yml
+          ref: 92106df315bd28de24ef1808c893c91a5859122d
+          path: .ci-lint
+          persist-credentials: false
+      - name: Detect lockfile change vs parent commit
+        id: lockfile
+        run: python3 ci/lockfile_changed.py
+      - name: Pre-prune superseded lockfile-keyed caches (CACHE-034)
+        # No `if:` gate: the gate replay proof (local-gate.toml's
+        # gate.replay) requires every declared step to show an executed and
+        # successful section, and this workflow's replay is a clean-diff
+        # pull_request selection where `changed == 'true'` is false. The
+        # lockfile step's `args` output carries `--lockfile-changed` only
+        # when a watched file actually changed (or detection failed
+        # conservatively), so the forecast still counts the peak exactly
+        # when it should; an unflagged run is forecast-only and never
+        # deletes (steady total stays under budget). dylint saves caches on
+        # PRs too (save-cache: true), so pruning here matches what this
+        # job writes.
+        env:
+          # act2/bosn replays inject no token: the fallback keeps the step
+          # runnable there (401 -> ci-lint warning, exit 0); GitHub runs
+          # always resolve github.token.
+          GITHUB_TOKEN: ${{ github.token || 'replay-no-token' }}
+          PYTHONPATH: .ci-lint
+        run: python3 -m ci_lint cache preprune --repo . ${{ steps.lockfile.outputs.args }} --max-deletes 50
       - name: Setup soldr
         uses: zackees/setup-soldr@v0
         with:

.github/workflows/fmt.yml

@@ -29,10 +29,42 @@ jobs:
     name: Formatting
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    # CACHE-034 (zackees/ci.yml#352/#354/#360): this job runs the pre-prune
+    # ahead of its own setup-soldr save; `actions: write` is what the cache
+    # deletions need (allow-listed in ci.toml's [allow.permissions]).
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v6
         with:
           ref: ${{ inputs.ref }}
+          # HEAD^ must exist for ci/lockfile_changed.py (CACHE-034).
+          fetch-depth: 2
+      # CACHE-034 (zackees/ci.yml#352/#354/#360): honour [flow.main]'s
+      # `pre-prune = true` waiver. The prune runs in this job, ahead of the
+      # setup-soldr save below -- within the same run means same job or an
+      # earlier `needs:` link, and GitHub Actions has no cross-workflow
+      # barrier. The ci-lint checkout matches ci.toml's `linter` pin (CT-004).
+      - name: Check out ci-lint
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          repository: zackees/ci.yml
+          ref: 92106df315bd28de24ef1808c893c91a5859122d
+          path: .ci-lint
+          persist-credentials: false
+      - name: Detect lockfile change vs parent commit
+        id: lockfile
+        run: python3 ci/lockfile_changed.py
+      - name: Pre-prune superseded lockfile-keyed caches (CACHE-034)
+        if: github.event_name != 'pull_request' && steps.lockfile.outputs.changed == 'true'
+        env:
+          # act2/bosn replays inject no token: the fallback keeps the
+          # step runnable there (401 -> ci-lint warning, exit 0); GitHub
+          # runs always resolve github.token.
+          GITHUB_TOKEN: ${{ github.token || 'replay-no-token' }}
+          PYTHONPATH: .ci-lint
+        run: python3 -m ci_lint cache preprune --repo . --lockfile-changed --max-deletes 50
       - name: Setup soldr
         id: setup-soldr
         uses: zackees/setup-soldr@v0

.github/workflows/nightly-platforms.yml

@@ -27,6 +27,9 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       workflows: ${{ steps.select.outputs.workflows }}
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v6
         with:
@@ -49,6 +52,25 @@ jobs:
           workflows=$(cd ci && uv run --no-project python select_boards.py "${args[@]}")
           echo "selected: $workflows"
           echo "workflows=$workflows" >> "$GITHUB_OUTPUT"
+      - name: Check out ci-lint
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          repository: zackees/ci.yml
+          ref: 92106df315bd28de24ef1808c893c91a5859122d
+          path: .ci-lint
+          persist-credentials: false
+      - name: Detect lockfile change vs parent commit
+        id: lockfile
+        run: python3 ci/lockfile_changed.py
+      - name: Pre-prune superseded lockfile-keyed caches (CACHE-034)
+        if: github.event_name != 'pull_request' && steps.lockfile.outputs.changed == 'true'
+        env:
+          # act2/bosn replays inject no token: the fallback keeps the step
+          # runnable there (401 -> ci-lint warning, exit 0); GitHub runs
+          # always resolve github.token.
+          GITHUB_TOKEN: ${{ github.token || 'replay-no-token' }}
+          PYTHONPATH: .ci-lint
+        run: python3 -m ci_lint cache preprune --repo . --lockfile-changed --max-deletes 50
 
   fbuild_bin:
     name: Build fbuild (shared by board jobs)

.github/workflows/template_build.yml

@@ -67,12 +67,47 @@ jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    # CACHE-034 (zackees/ci.yml#352/#354/#360): this job runs the pre-prune
+    # ahead of its own setup-soldr save (and its main-gated toolchain/build
+    # saves below); `actions: write` is what the cache deletions need
+    # (allow-listed in ci.toml's [allow.permissions]).
+    permissions:
+      contents: read
+      actions: write
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
           ref: ${{ inputs.checkout_ref }}
+          # HEAD^ must exist for ci/lockfile_changed.py (CACHE-034).
+          fetch-depth: 2
+
+      # CACHE-034 (zackees/ci.yml#352/#354/#360): honour [flow.main]'s
+      # `pre-prune = true` waiver for the nightly-dispatched board runs that
+      # save here on main. The gate mirrors setup-soldr's save-cache gate
+      # below exactly (default branch only); within the same run means same
+      # job, ahead of the save. The ci-lint checkout matches ci.toml's
+      # `linter` pin (CT-004).
+      - name: Check out ci-lint
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          repository: zackees/ci.yml
+          ref: 92106df315bd28de24ef1808c893c91a5859122d
+          path: .ci-lint
+          persist-credentials: false
+      - name: Detect lockfile change vs parent commit
+        id: lockfile
+        run: python3 ci/lockfile_changed.py
+      - name: Pre-prune superseded lockfile-keyed caches (CACHE-034)
+        if: github.ref == 'refs/heads/main' && steps.lockfile.outputs.changed == 'true'
+        env:
+          # act2/bosn replays inject no token: the fallback keeps the
+          # step runnable there (401 -> ci-lint warning, exit 0); GitHub
+          # runs always resolve github.token.
+          GITHUB_TOKEN: ${{ github.token || 'replay-no-token' }}
+          PYTHONPATH: .ci-lint
+        run: python3 -m ci_lint cache preprune --repo . --lockfile-changed --max-deletes 50
 
       - name: Setup soldr
         id: setup-soldr

.gitignore

@@ -9,6 +9,11 @@
 # copy in.
 /ci/bin/
 
+# ci-lint runtime checkout: CI jobs check out zackees/ci.yml here to run
+# `python3 -m ci_lint ...` (created at run time, never committed; must stay
+# ignored for template_build's stray-working-tree assertion)
+/.ci-lint/
+
 # IDE
 .idea/
 .vscode/