From 09e208c54fe1169fdd4182ac965c56182d5760ee Mon Sep 17 00:00:00 2001 From: Devin Foley Date: Fri, 11 Sep 2026 18:05:36 -0700 Subject: [PATCH] ci: activate shared PR dependency cache restores (#13302) ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - PR checks share a repository cache budget with post-merge cloud verification. > - Per-PR dependency store copies consume about 700 MB each and displace useful build caches. > - The reviewed workflow now restores shared dependency caches without saving PR copies. > - The public entry point must pin an approved immutable workflow before it can use AWS runners. > - This PR activates the merged workflow after the runner group accepted its exact SHA. > - Native verification and the app build also run in parallel, as defined in the merged workflow. ## Linked Issues or Issue Description Refs #13300. Refs #13301. The cache definition is merged, and its exact SHA is authorized in the restricted runner group. This PR activates it. Its base also contains the two synthetic fixture fixes from #13301. No duplicate activation PR was found. ## What Changed - Advance the `pr-trusted.yml` pin from `03609aa6ecc9a047ed53d6b6469d8be554fbc46d` to merged commit `44dde2dec42a22746a2f36b595acacc9ccfa1df6`. - Update the adjacent pin comment to identify #13300 and the activated behavior. - Activate restore-only pnpm caching and removal of redundant Node setup steps from #13300. - Activate the already-merged separate native verification job, required by the aggregate `verify` check. The app build no longer waits for native verification inside the same job. - Activate the merged module-boundary and source-verification checks and explicit Runner Evalbook viewer build. ## Verification - Passed all 505 workflow, routing, cache, sharding, and source-verification tests. - Passed `actionlint` for both workflow files and `git diff --check`. - Passed the runner infrastructure's workflow routing regression tests. - Confirmed that the gate is unchanged between the old and new workflow definitions. The restricted runner group permits the exact merged SHA and retains its existing workflow pins. - Full workspace typecheck and build passed on the timeout-fix branch. Its 107 targeted runner tests and all Linux CI groups passed. The broad local Mac test command had 15 unrelated permission and missing-skill-path failures, documented in #13301; it stopped before later groups. - [Current-head CI run 34662664879](https://github.com/paperclipai/paperclip/actions/runs/34662664879) passed. All 33 checks are green or intentionally skipped at `ded4f1d093644b9279cdf56457f69a196fcf8cc2`. Greptile is 5/5, with no unresolved findings. - The live build restored the master pnpm cache, downloaded the resolved lockfile artifact, and completed a frozen install. It had no dependency-cache upload step. GitHub reports zero cache entries for this PR. Native verification and the app build started together and both passed. - [Post-merge cloud readiness for #13301](https://github.com/paperclipai/paperclip/actions/runs/34662389233) passed all 30 jobs in 12m42s from merge. Native verification restored the master Rust cache and passed the formerly failing fixtures. ## Risks A new PR-only dependency can require a download until a master cache contains it. The new pin also activates the merged workflow changes listed above, so the live PR must pass all checks. The repository storage cap is still 10 GB; this PR does not increase it. No allowlist or runner permission logic changes. ## Model Used OpenAI GPT-6 through Codex, with reasoning, repository tools, and code execution. The exact serving model ID and context window are not exposed by this environment. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip --- .github/workflows/pr.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 68d31855e6..f2dff59b78 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -10,5 +10,5 @@ permissions: jobs: ci: - # Pin: #12858 merge — docker context integrity gate + traceability context fix. - uses: paperclipai/paperclip/.github/workflows/pr-trusted.yml@03609aa6ecc9a047ed53d6b6469d8be554fbc46d + # Pin: #13300 merge — restore-only dependency caches and parallel native verification. + uses: paperclipai/paperclip/.github/workflows/pr-trusted.yml@44dde2dec42a22746a2f36b595acacc9ccfa1df6