From 63c60f4c45b45d0dc8f84d26eb9a95ab497db283 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Date: Fri, 10 Jul 2026 18:03:42 +0200
Subject: [PATCH] ci: Kellnr crates.io mirror + persistent S3-backed sccache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adopt werkpilot's CI compile-acceleration setup so builds are crates.io-
independent and cached across runs:

- Resolve crates.io deps through the self-hosted Kellnr mirror
  (crates.meghsakha.com) via a .cargo/config.toml source replacement. Git deps
  (tramiton-core) are unaffected.
- Back sccache with Hetzner S3 (breakpilot-sccache bucket, key prefix
  compliance-scanner) instead of an ephemeral /tmp dir — persistent across CI
  runs. Bump sccache to v0.10.0.
- Throttle cargo (CARGO_NET_RETRY, HTTP/1.1) so the ~670-crate download burst
  doesn't 429 the mirror.

Requires repo secrets HETZNER_S3_ACCESS_KEY and HETZNER_S3_SECRET_KEY (same
bucket/creds as werkpilot). Closes #139.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0496c95..aba5c09 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -9,13 +9,25 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
-  # sccache caches compilation artifacts within a job so that compiling
-  # both --features server and --features web shares common crate work.
+  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
+  # and persistent across CI runs (own key prefix). Reuses the shared cluster S3
+  # creds (same bucket as werkpilot). Requires repo secrets HETZNER_S3_ACCESS_KEY
+  # and HETZNER_S3_SECRET_KEY.
   RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_DIR: /tmp/sccache
+  SCCACHE_BUCKET: breakpilot-sccache
+  SCCACHE_ENDPOINT: https://nbg1.your-objectstorage.com
+  SCCACHE_REGION: auto
+  SCCACHE_S3_USE_SSL: "true"
+  SCCACHE_S3_KEY_PREFIX: compliance-scanner
+  AWS_ACCESS_KEY_ID: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
   # compliance-agent depends on tramiton-core via git; use the system git so the
   # credential rewrite below (see "Configure git auth ...") is honored on fetch.
   CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+  # Throttle cargo so a ~670-crate concurrent download burst doesn't 429 the
+  # Kellnr mirror: fewer concurrent connections (HTTP/1.1) + more retries.
+  CARGO_NET_RETRY: "10"
+  CARGO_HTTP_MULTIPLEXING: "false"
 
 # Cancel in-progress runs for the same branch/PR
 concurrency:
@@ -39,11 +51,26 @@ jobs:
           git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}"
           git checkout FETCH_HEAD
+      # Resolve crates.io deps through the self-hosted Kellnr mirror (cached,
+      # crates.io-independent). Git deps (tramiton-core) are unaffected — source
+      # replacement only applies to crates.io-sourced crates.
+      - name: Use Kellnr crates.io mirror
+        run: |
+          : "${CARGO_HOME:=/usr/local/cargo}"
+          mkdir -p "$CARGO_HOME"
+          {
+            echo '[source.crates-io]'
+            echo 'replace-with = "kellnr"'
+            echo '[registries.kellnr]'
+            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
+          } >> "$CARGO_HOME/config.toml"
+        env:
+          RUSTC_WRAPPER: ""
       - name: Install tools
         run: |
           rustup component add rustfmt clippy
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.10.0-x86_64-unknown-linux-musl/sccache
           chmod +x /usr/local/bin/sccache
           cargo install cargo-audit --locked
         env:
-- 
2.54.0