Module buildcache 

The build cache every runner shares (ADR 0052, 0053): the entries of Gradle’s HTTP build cache, and of the other tools the runner image points at it, kept per repository in a directory of the daemon’s and served to each runner on a Unix socket of its own, which the runner image forwards to 127.0.0.1. Owns the entries, the size limit, the sockets, and what each runner was served and stored. Which socket a request came in on is who sent it; no job can claim another’s. It never decides whether a job may write: the engine tells it (Writes), from what GitHub says of the job. It never logs a request’s headers, which may carry a tool’s token.

Structs

BuildCache

The shared build cache. Cloning shares it.

Size

The build cache’s size now.

Trimmed

What trim removed.

Enums

Writes

Whether a runner’s job may write entries.

Constants

MOUNT

Where a runner container mounts its socket’s directory, read-only (image/entrypoint.sh).

PULL_REQUEST_EVENT

The event of a pull request’s run that BuildCacheWriters::PullRequests lets write. Never pull_request_target, which runs with the repository’s secrets whatever the pull request’s head is.

SOCKET

The socket’s name in that directory.

Functions

opened_by_user

Whether a pull request trigger runs lets it write: a person opened it, from trigger’s head branch in repository itself. A bot’s, such as Renovate’s or Dependabot’s, only reads.

writes

Whether runner’s job may write, from what GitHub says: the runner it placed the job on (job_runner, which a job cannot forge as it can its runner’s log), and its run’s trigger. A push, scheduled or manually started run of repository itself on one of branches may. With writers at PullRequests, so may a pull_request run of one of the repository’s own branches that people started, once GitHub also says each of its pull requests was opened by one (opened_by_user). Undecided while GitHub places the job on no runner.