2 files changed, 44 insertions(+), 0 deletions(-)

M .build.yml
M APKBUILD

@@ 1,6 1,7 @@
 image: alpine/edge
 packages:
   - abuild
+  - curl
   - go
   - git
   - rclone


@@ 10,6 11,10 @@ secrets:
   # File secret `apk-ci-s3`, installed at ~/.apk-ci.env, containing
   # APK_CI_S3_ACCESS_KEY / APK_CI_S3_SECRET_KEY for the Garage `repo` bucket.
   - apk-ci-s3
+  # S3 credentials for the cacher CI cache (Garage `docker-cache` bucket),
+  # same pair the bencher and ci-cacher builds use.
+  - 7dde4219-0783-4581-a67d-c94749de3600   # ~/.s3-cache-key-id
+  - 0e5b3530-6f19-4f30-9b73-9339dd382e46   # ~/.s3-cache-key-secret
 sources:
   - https://git.srht.bigb.es/~bigbes/sr-ht-spec
 environment:


@@ 57,11 62,44 @@ tasks:
       sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD
       echo "export PKGVER=$ver" >> ~/.buildenv
       echo "building $ver"
+  - cacher: |
+      # S3-backed CI cache helper (go.bigb.es/cacher), dogfooded from its own
+      # published release — the same bootstrap the bencher/ci-cacher builds use.
+      mkdir -p ~/.local/bin
+      curl -sSL "https://bigbes.pages.srht.bigb.es/ci-cacher/cacher-linux-amd64" \
+        -o ~/.local/bin/cacher
+      chmod +x ~/.local/bin/cacher
+      echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.buildenv
+      export PATH="$HOME/.local/bin:$PATH"
+      cacher init \
+        --endpoint    https://s3.bigb.es \
+        --region      garage \
+        --bucket      docker-cache \
+        --prefix      sr-ht-spec/deps \
+        --key-file    ~/.s3-cache-key-id \
+        --secret-file ~/.s3-cache-key-secret
+  - cache_restore: |
+      # Restore the Go module and build caches, both keyed by go.sum: the
+      # dependency tree dominates compile time, and it only changes when go.sum
+      # does. A miss is just a cold build, never an error.
+      KEY_MOD=$(cacher key "gomod/{hash}.tar.zst" --hash-from "$REPO/go.sum")
+      KEY_GOC=$(cacher key "gocache/{hash}.tar.zst" --hash-from "$REPO/go.sum")
+      echo "export KEY_MOD=$KEY_MOD KEY_GOC=$KEY_GOC" >> ~/.buildenv
+      # abuild redirects the Go caches into its throwaway $tmpdir (and an
+      # upstream typo slaves GOMODCACHE to GOCACHE), so env exports here can't
+      # stick — the APKBUILD's build() re-pins both to these home locations.
+      cacher dir download "$KEY_MOD" ~/go/pkg/mod || true
+      cacher dir download "$KEY_GOC" ~/.cache/go-build || true
   - build: |
       cd "$REPO"
       # -d: makedepends are already installed via `packages:` above.
       REPODEST=$HOME/packages abuild -d
       find "$HOME/packages" -name '*.apk'
+  - cache_save: |
+      # Seed the caches only when this go.sum has no entry yet — on a hit the
+      # tarballs are already up there and re-uploading identical bytes is waste.
+      cacher exists "$KEY_MOD" || cacher dir upload "$KEY_MOD" ~/go/pkg/mod
+      cacher exists "$KEY_GOC" || cacher dir upload "$KEY_GOC" ~/.cache/go-build
   - publish: |
       set +x   # never echo the S3 credentials into the build log
       . ~/.apk-ci.env

@@ 22,6 22,12 @@ builddir="$startdir"
 
 build() {
 	cd "$builddir"
+	# abuild redirects GOCACHE into $tmpdir (wiped after packaging), and an
+	# upstream typo makes GOMODCACHE follow GOCACHE's value rather than its
+	# own. Re-pin both to the stable home locations here — after abuild's own
+	# exports — so CI's cache_restore/cache_save tasks see them survive.
+	export GOCACHE="$HOME/.cache/go-build"
+	export GOMODCACHE="$HOME/go/pkg/mod"
 	# CSS strictly before the binaries: web/ go:embed-s static/, so a
 	# stylesheet built afterwards would never make it into the binary. The
 	# shared scss partials are assembled by CI at ASSETS/scss (no apk ships