ci: improve cache keys, observability, and node_modules caching strategy (RocketChat#39709)

ggazzo · web-flow · commit b0f026b40317 · 2026-04-07T19:47:25.000-03:00
diff --git a/.github/actions/meteor-build/action.yml b/.github/actions/meteor-build/action.yml
@@ -22,7 +22,7 @@ inputs:
     type: string
   source-hash:
     required: true
-    description: 'Source code hash'
+    description: 'RC cache id (e.g. packages-build-cache-key + meteor apps/meteor archive hash from CI)'
     type: string
 
 runs:
diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
@@ -33,46 +33,48 @@ outputs:
   node-version:
     description: 'Node version'
     value: ${{ steps.node-version.outputs.node-version }}
+  cache-deno-hit:
+    description: 'Exact key hit for Deno cache'
+    value: ${{ steps.cache-deno.outputs.cache-hit }}
 
 runs:
   using: composite
 
   steps:
-    - name: Cache Node Modules & Deno
+    # Turbo local cache: use rharkor/caching-for-turbo in workflows — not stored here to avoid huge redundant keys.
+    - name: Cache Deno (apps-engine)
       if: inputs.cache-modules
-      id: cache-node-modules
+      id: cache-deno
       uses: actions/cache@v5
       with:
-        # We need to cache node_modules for all workspaces with "hoistingLimits" defined
-        path: |
-          .turbo/cache
-          node_modules
-          apps/meteor/node_modules
-          apps/meteor/ee/server/services/node_modules
-          packages/apps-engine/node_modules
-          packages/apps-engine/.deno-cache
-        key: node-modules-${{ inputs.type }}-${{ runner.arch }}-${{ runner.os }}-${{ hashFiles('package.json') }}-${{ hashFiles('yarn.lock') }}-${{ hashFiles('.yarnrc.yml') }}-deno-v${{ inputs.deno-version }}-${{ hashFiles('packages/apps-engine/deno-runtime/deno.lock') }}-v5
-        # key: node-modules-${{ inputs.type }}-${{ runner.arch }}-${{ runner.os }}-${{ hashFiles('package.json') }}-${{ hashFiles('yarn.lock') }}-${{ hashFiles('.yarnrc.yml') }}-deno-v${{ inputs.deno-version }}-${{ hashFiles('packages/apps-engine/deno-runtime/deno.lock') }}-v${{ github.run_id }}
-    #
-    # Could use this command to list all paths to save:
-    # find . -name 'node_modules' -prune | grep -v "/\.meteor/" | grep -v "/meteor/packages/"
+        path: packages/apps-engine/.deno-cache
+        key: deno-${{ runner.os }}-${{ runner.arch }}-v${{ inputs.deno-version }}-${{ hashFiles('packages/apps-engine/deno-runtime/deno.lock') }}
+        restore-keys: |
+          deno-${{ runner.os }}-${{ runner.arch }}-v${{ inputs.deno-version }}-
 
     - name: Use Node.js ${{ inputs.node-version }}
       id: node-version
       uses: actions/setup-node@v6.0.0
       with:
         node-version: ${{ inputs.node-version }}
-        cache: 'yarn'
+        cache: ${{ inputs.cache-modules && 'yarn' || '' }}
 
     - name: Use Deno ${{ inputs.deno-version }}
       uses: denoland/setup-deno@v1
       with:
         deno-version: ${{ inputs.deno-version }}
 
+    - name: Cache mongodb-memory-server binary
+      if: inputs.cache-modules
+      uses: actions/cache@v5
+      with:
+        path: ${{ runner.temp }}/mongodb-memory-server
+        key: mongoms-${{ runner.arch }}-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
+
     - name: Configure mongodb-memory-server cache
       shell: bash
       run: |
-        CACHE_DIR="${GITHUB_WORKSPACE}/node_modules/.cache/mongodb-memory-server"
+        CACHE_DIR="${{ runner.temp }}/mongodb-memory-server"
         mkdir -p "$CACHE_DIR"
         echo "MONGOMS_DOWNLOAD_DIR=$CACHE_DIR" >> $GITHUB_ENV
         echo "MONGOMS_PREFER_GLOBAL_PATH=false" >> $GITHUB_ENV
diff --git a/.github/workflows/ci-code-check.yml b/.github/workflows/ci-code-check.yml
@@ -45,15 +45,21 @@ jobs:
 
       - uses: ./.github/actions/restore-packages
 
-      - name: Cache TypeCheck
-        uses: actions/cache@v5
+      - name: Restore TypeScript incremental cache
+        id: restore-typecheck
+        if: matrix.check == 'ts'
+        uses: actions/cache/restore@v5
         with:
           path: ./apps/meteor/tsconfig.typecheck.tsbuildinfo
-          key: typecheck-cache-${{ runner.OS }}-${{ hashFiles('yarn.lock') }}-${{ github.event.issue.number }}
+          key: typecheck-cache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
           restore-keys: |
-            typecheck-cache-${{ runner.OS }}-${{ hashFiles('yarn.lock') }}
-            typecheck-cache-${{ runner.OS }}
-            typecheck-cache
+            typecheck-cache-${{ runner.os }}-
+
+      - name: Cache observability (typecheck)
+        if: matrix.check == 'ts'
+        run: |
+          echo "### TypeScript incremental cache" >> $GITHUB_STEP_SUMMARY
+          echo "- **exact hit**: \`${{ steps.restore-typecheck.outputs.cache-hit }}\`" >> $GITHUB_STEP_SUMMARY
 
       - name: Install Meteor
         shell: bash
@@ -79,17 +85,36 @@ jobs:
         if: matrix.check == 'ts'
         run: yarn turbo run typecheck --concurrency=5
 
-      - name: Cache eslint
-        uses: actions/cache@v5
+      - name: Save TypeScript incremental cache
+        if: matrix.check == 'ts' && github.ref == 'refs/heads/develop' && github.event_name == 'push'
+        uses: actions/cache/save@v5
+        with:
+          path: ./apps/meteor/tsconfig.typecheck.tsbuildinfo
+          key: typecheck-cache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
+
+      - name: Restore ESLint cache
+        id: restore-eslint
         if: matrix.check == 'lint'
+        uses: actions/cache/restore@v5
         with:
           path: ./apps/meteor/.eslintcache
-          key: eslintcache-cache-${{ runner.OS }}-${{ hashFiles('yarn.lock') }}-${{ github.event.issue.number }}
+          key: eslintcache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
           restore-keys: |
-            eslintcache-cache-${{ runner.OS }}-${{ hashFiles('yarn.lock') }}
-            eslintcache-cache-${{ runner.OS }}
-            eslintcache-cache
+            eslintcache-${{ runner.os }}-
+
+      - name: Cache observability (eslint)
+        if: matrix.check == 'lint'
+        run: |
+          echo "### ESLint cache" >> $GITHUB_STEP_SUMMARY
+          echo "- **exact hit**: \`${{ steps.restore-eslint.outputs.cache-hit }}\`" >> $GITHUB_STEP_SUMMARY
 
       - name: Lint
         if: matrix.check == 'lint'
         run: yarn lint
+
+      - name: Save ESLint cache
+        if: matrix.check == 'lint' && github.ref == 'refs/heads/develop' && github.event_name == 'push'
+        uses: actions/cache/save@v5
+        with:
+          path: ./apps/meteor/.eslintcache
+          key: eslintcache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -33,6 +33,8 @@ jobs:
       node-version: ${{ steps.var.outputs.node-version }}
       deno-version: ${{ steps.var.outputs.deno-version }}
       source-hash: ${{ steps.source.outputs.hash }}
+      packages-build-cache-key: ${{ steps.ci-cache-keys.outputs.packages-build-cache-key }}
+      meteor-rc-cache-key: ${{ steps.ci-cache-keys.outputs.meteor-rc-cache-key }}
       # this is 100% intentional, secrets are not available for forks, so ee-tests will always fail
       # to avoid this, we are using a dummy license, expiring at 2026-07-01
       enterprise-license: Uo7Jcr6WW0XYA8ydHd+Sk6pZ9/0V6dIASnyTwvUrNym/zJg2Ma3eYNKkC8osXLCc72y1ahohnWY7/+7IYkvono3GYXQR+IGvYbbrVgNR6OjMahd9P/odHZL1GFTm2qHrEL5Hh/XEOG+YluFeRdWPzCizQlp4zGGOi0+PkQo096TR9NVCLrsErVl2MW1WM6ZM1W5EUJG9pKly4BQnaOTUAlor1im6i8qPTDCKrISZfLiZEWuQKaPW/GE3mRKjQNjDh0CabX1N2S880pRRGoozBYAnp2NmFfrQW0+5ihKisBTIeMbMZ7K5NE5PkYU1nhQDcc+rpDHtwG9Ceg5X0J+oea3UfrPTmDON2aSI0iO22kvL6G7QI3fyrEIvJrMbxcNKxAFeQYgnjisw/b06+chWSG4jG686Fx58XrVS87dFhWL9WoGltsk1dJCntUQvI1sX6zOfpvyg1iWRnHfYDOrwoWlX57XMm29fWineEoqnOOTOVnA/uP+DKEhercQ9Xuo7Cr6zJxpQpwd03e7ODVjiEbTDqlkZE687rmxRCD4Wmu8L86WIl2xSEIajKLX301Ww5mz/FdLqk+Mg32lkW66W3azQKvJ1440NBrYxhpJ+dl9vSFMb3s1+xnz1cYUbjUcq9mARvORcgy5mLwKulmqT6Sq0Uvbv10YCO0TW0beXYW8=
@@ -91,6 +93,14 @@ jobs:
           echo "DENO_VERSION: ${DENO_VERSION}"
           echo "deno-version=${DENO_VERSION}" >> $GITHUB_OUTPUT
 
+      - id: ci-cache-keys
+        run: |
+          set -euo pipefail
+          PACKAGES_HASH=$(cat yarn.lock .yarnrc.yml package.json turbo.json | sha256sum | awk '{print $1}')
+          echo "packages-build-cache-key=${PACKAGES_HASH}" >> "$GITHUB_OUTPUT"
+          METEOR_HASH=$(git archive HEAD apps/meteor | sha256sum | awk '{print $1}')
+          echo "meteor-rc-cache-key=${METEOR_HASH}" >> "$GITHUB_OUTPUT"
+
       - id: by-tag
         run: |
           if echo "$GITHUB_REF_NAME" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$' ; then
@@ -175,10 +185,13 @@ jobs:
         with:
           path: |
             /tmp/RocketChat-packages-build.tar.gz
-          key: ${{ runner.arch }}-${{ runner.os }}-packages-build-${{ needs.release-versions.outputs.source-hash }}
+          key: ${{ runner.arch }}-${{ runner.os }}-packages-build-${{ needs.release-versions.outputs.packages-build-cache-key }}
 
-      - name: Debug cache-hit
-        run: echo "cache-hit=${{ steps.packages-cache-build.outputs.cache-hit }}"
+      - name: Cache observability (packages-build)
+        run: |
+          echo "### 📦 packages-build cache" >> $GITHUB_STEP_SUMMARY
+          echo "- **hit**: \`${{ steps.packages-cache-build.outputs.cache-hit }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- **key**: \`${{ needs.release-versions.outputs.packages-build-cache-key }}\`" >> $GITHUB_STEP_SUMMARY
 
       - name: Set Swap Space
         uses: pierotofy/set-swap-space@master
@@ -190,6 +203,7 @@ jobs:
         if: steps.packages-cache-build.outputs.cache-hit != 'true'
 
       - name: Setup NodeJS
+        id: setup-node-packages
         uses: ./.github/actions/setup-node
         if: steps.packages-cache-build.outputs.cache-hit != 'true'
         with:
@@ -200,6 +214,13 @@ jobs:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           HARDENED_MODE: '1'
 
+      - name: Cache observability (node_modules)
+        if: steps.packages-cache-build.outputs.cache-hit != 'true'
+        run: |
+          echo "### 🟢 node_modules cache" >> $GITHUB_STEP_SUMMARY
+          echo "- **deno cache hit**: \`${{ steps.setup-node-packages.outputs.cache-deno-hit }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- **node_modules size**: \`$(du -sh node_modules 2>/dev/null | cut -f1 || echo 'n/a')\`" >> $GITHUB_STEP_SUMMARY
+
       - name: Cache vite
         uses: actions/cache@v5
         if: steps.packages-cache-build.outputs.cache-hit != 'true'
@@ -259,7 +280,7 @@ jobs:
         with:
           node-version: ${{ needs.release-versions.outputs.node-version }}
           deno-version: ${{ needs.release-versions.outputs.deno-version }}
-          source-hash: ${{ needs.release-versions.outputs.source-hash }}
+          source-hash: ${{ needs.release-versions.outputs.packages-build-cache-key }}-${{ needs.release-versions.outputs.meteor-rc-cache-key }}
           type: ${{ matrix.type }}
 
   build-gh-docker:
