From 128d72963281e275bb1ec3be2bdb8653a2bb0c78 Mon Sep 17 00:00:00 2001
From: Eugene Blikh <bigbes@gmail.com>
Date: Wed, 5 Aug 2026 13:41:23 +0300
Subject: [PATCH] ci: cache Go module and build dirs via cacher

Same scheme as sr-ht-dolt (dbd8638 there): restore ~/go/pkg/mod and
~/.cache/go-build from the Garage docker-cache bucket before abuild and
seed them back after, keyed by go.sum via cacher (go.bigb.es/cacher).
GOCACHE/GOMODCACHE are re-pinned inside build() because abuild redirects
them into its throwaway $tmpdir and an upstream typo in abuild.in
clobbers any pre-set GOMODCACHE with GOCACHE's value.
---
 .build.yml | 38 ++++++++++++++++++++++++++++++++++++++
 APKBUILD   |  6 ++++++
 2 files changed, 44 insertions(+)

diff --git a/.build.yml b/.build.yml
index 6805ef2a0933102d34490524162feebf6213508d..8c3e9bdd0134c886ef3f54e188c507f28800e390 100644
--- a/.build.yml
+++ b/.build.yml
@@ -1,6 +1,7 @@
 image: alpine/edge
 packages:
   - abuild
+  - curl
   - go
   - git
   - rclone
@@ -10,6 +11,10 @@ secrets:
   # File secret `apk-ci-s3`, installed at ~/.apk-ci.env, containing
   # APK_CI_S3_ACCESS_KEY / APK_CI_S3_SECRET_KEY for the Garage `repo` bucket.
   - apk-ci-s3
+  # S3 credentials for the cacher CI cache (Garage `docker-cache` bucket),
+  # same pair the bencher and ci-cacher builds use.
+  - 7dde4219-0783-4581-a67d-c94749de3600   # ~/.s3-cache-key-id
+  - 0e5b3530-6f19-4f30-9b73-9339dd382e46   # ~/.s3-cache-key-secret
 sources:
   - https://git.srht.bigb.es/~bigbes/sr-ht-spec
 environment:
@@ -57,11 +62,44 @@ tasks:
       sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD
       echo "export PKGVER=$ver" >> ~/.buildenv
       echo "building $ver"
+  - cacher: |
+      # S3-backed CI cache helper (go.bigb.es/cacher), dogfooded from its own
+      # published release — the same bootstrap the bencher/ci-cacher builds use.
+      mkdir -p ~/.local/bin
+      curl -sSL "https://bigbes.pages.srht.bigb.es/ci-cacher/cacher-linux-amd64" \
+        -o ~/.local/bin/cacher
+      chmod +x ~/.local/bin/cacher
+      echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.buildenv
+      export PATH="$HOME/.local/bin:$PATH"
+      cacher init \
+        --endpoint    https://s3.bigb.es \
+        --region      garage \
+        --bucket      docker-cache \
+        --prefix      sr-ht-spec/deps \
+        --key-file    ~/.s3-cache-key-id \
+        --secret-file ~/.s3-cache-key-secret
+  - cache_restore: |
+      # Restore the Go module and build caches, both keyed by go.sum: the
+      # dependency tree dominates compile time, and it only changes when go.sum
+      # does. A miss is just a cold build, never an error.
+      KEY_MOD=$(cacher key "gomod/{hash}.tar.zst" --hash-from "$REPO/go.sum")
+      KEY_GOC=$(cacher key "gocache/{hash}.tar.zst" --hash-from "$REPO/go.sum")
+      echo "export KEY_MOD=$KEY_MOD KEY_GOC=$KEY_GOC" >> ~/.buildenv
+      # abuild redirects the Go caches into its throwaway $tmpdir (and an
+      # upstream typo slaves GOMODCACHE to GOCACHE), so env exports here can't
+      # stick — the APKBUILD's build() re-pins both to these home locations.
+      cacher dir download "$KEY_MOD" ~/go/pkg/mod || true
+      cacher dir download "$KEY_GOC" ~/.cache/go-build || true
   - build: |
       cd "$REPO"
       # -d: makedepends are already installed via `packages:` above.
       REPODEST=$HOME/packages abuild -d
       find "$HOME/packages" -name '*.apk'
+  - cache_save: |
+      # Seed the caches only when this go.sum has no entry yet — on a hit the
+      # tarballs are already up there and re-uploading identical bytes is waste.
+      cacher exists "$KEY_MOD" || cacher dir upload "$KEY_MOD" ~/go/pkg/mod
+      cacher exists "$KEY_GOC" || cacher dir upload "$KEY_GOC" ~/.cache/go-build
   - publish: |
       set +x   # never echo the S3 credentials into the build log
       . ~/.apk-ci.env
diff --git a/APKBUILD b/APKBUILD
index 57bfe991dc038e5dd3db0c9d8eb160e0f9d589ee..42e72ac6105628909c490cb9cd60abb9912f4e43 100644
--- a/APKBUILD
+++ b/APKBUILD
@@ -22,6 +22,12 @@ builddir="$startdir"
 
 build() {
 	cd "$builddir"
+	# abuild redirects GOCACHE into $tmpdir (wiped after packaging), and an
+	# upstream typo makes GOMODCACHE follow GOCACHE's value rather than its
+	# own. Re-pin both to the stable home locations here — after abuild's own
+	# exports — so CI's cache_restore/cache_save tasks see them survive.
+	export GOCACHE="$HOME/.cache/go-build"
+	export GOMODCACHE="$HOME/go/pkg/mod"
 	# CSS strictly before the binaries: web/ go:embed-s static/, so a
 	# stylesheet built afterwards would never make it into the binary. The
 	# shared scss partials are assembled by CI at ASSETS/scss (no apk ships