ci: skip already-passing app builds via content-hash cache marker

msluszniak · msluszniak · commit 9aef7d09fc0a · 2026-04-29T20:23:22.000+02:00
diff --git a/.github/actions/build-android-app/action.yml b/.github/actions/build-android-app/action.yml
@@ -9,51 +9,77 @@ inputs:
     description: Whether to run `expo prebuild --platform android` before the Gradle build
     required: false
     default: "true"
+  filter-name:
+    description: dorny/paths-filter filter name for this app+platform (e.g. llm-android). Used as the content-hash cache key so a previously-passing build can be skipped if nothing relevant has changed.
+    required: true
 
 runs:
   using: composite
   steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version-file: .nvmrc
+        cache: "yarn"
+
+    - name: Install root dependencies
+      shell: bash
+      run: yarn install --immutable
+
+    - name: Compute build hash
+      id: hash
+      shell: bash
+      run: |
+        h=$(node scripts/compute-app-hash.js "${{ inputs.filter-name }}")
+        echo "key=build-${{ inputs.filter-name }}-$h" >> "$GITHUB_OUTPUT"
+
+    - name: Lookup pass marker
+      id: cache
+      uses: actions/cache/restore@v4
+      with:
+        path: ${{ runner.temp }}/ci-marker
+        key: ${{ steps.hash.outputs.key }}
+        lookup-only: true
+
+    - name: Skip notice
+      if: steps.cache.outputs.cache-hit == 'true'
+      shell: bash
+      run: echo "Skipping build — ${{ inputs.filter-name }} already passed at this content hash."
+
     - name: Free disk space
+      if: steps.cache.outputs.cache-hit != 'true'
       shell: bash
       run: |
         sudo rm -rf /usr/share/dotnet
         sudo rm -rf /opt/ghc
         sudo rm -rf /opt/hostedtoolcache/CodeQL
         sudo docker system prune -af
 
-    - name: Setup Node.js
-      uses: actions/setup-node@v6
-      with:
-        node-version-file: .nvmrc
-        cache: "yarn"
-
     - name: Setup Java 17
+      if: steps.cache.outputs.cache-hit != 'true'
       uses: actions/setup-java@v5
       with:
         distribution: "zulu"
         java-version: 17
         cache: "gradle"
 
-    - name: Install root dependencies
-      shell: bash
-      run: yarn install --immutable
-
     - name: Install Expo CLI
-      if: inputs.expo-prebuild == 'true'
+      if: steps.cache.outputs.cache-hit != 'true' && inputs.expo-prebuild == 'true'
       shell: bash
       run: |
         npm install -g @expo/cli
         echo "$(npm prefix -g)/bin" >> $GITHUB_PATH
 
     - name: Generate native Android project
-      if: inputs.expo-prebuild == 'true'
+      if: steps.cache.outputs.cache-hit != 'true' && inputs.expo-prebuild == 'true'
       working-directory: ${{ inputs.app-path }}
       shell: bash
       run: |
         rm -rf android
         npx expo prebuild --platform android --no-install
 
     - name: Cache Gradle
+      if: steps.cache.outputs.cache-hit != 'true'
       uses: actions/cache@v5
       with:
         path: |
@@ -65,6 +91,7 @@ runs:
           ${{ runner.os }}-gradle-
 
     - name: Build app
+      if: steps.cache.outputs.cache-hit != 'true'
       working-directory: ${{ inputs.app-path }}/android
       shell: bash
       run: |
@@ -76,3 +103,17 @@ runs:
           -PreactNativeArchitectures=arm64-v8a \
           -Dorg.gradle.jvmargs="-Xmx4g -XX:+HeapDumpOnOutOfMemoryError" \
           -Dorg.gradle.workers.max=4
+
+    - name: Save pass marker
+      if: steps.cache.outputs.cache-hit != 'true' && success()
+      shell: bash
+      run: |
+        mkdir -p "${{ runner.temp }}/ci-marker"
+        touch "${{ runner.temp }}/ci-marker/passed"
+
+    - name: Cache pass marker
+      if: steps.cache.outputs.cache-hit != 'true' && success()
+      uses: actions/cache/save@v4
+      with:
+        path: ${{ runner.temp }}/ci-marker
+        key: ${{ steps.hash.outputs.key }}
diff --git a/.github/actions/build-ios-app/action.yml b/.github/actions/build-ios-app/action.yml
@@ -9,15 +9,13 @@ inputs:
     description: Whether to run `expo prebuild --platform ios` before pod install
     required: false
     default: "true"
+  filter-name:
+    description: dorny/paths-filter filter name for this app+platform (e.g. llm-ios). Used as the content-hash cache key so a previously-passing build can be skipped if nothing relevant has changed.
+    required: true
 
 runs:
   using: composite
   steps:
-    - name: Setup Xcode
-      uses: maxim-lobanov/setup-xcode@v1
-      with:
-        xcode-version: latest-stable
-
     - name: Setup Node.js
       uses: actions/setup-node@v6
       with:
@@ -28,27 +26,55 @@ runs:
       shell: bash
       run: yarn install --immutable
 
+    - name: Compute build hash
+      id: hash
+      shell: bash
+      run: |
+        h=$(node scripts/compute-app-hash.js "${{ inputs.filter-name }}")
+        echo "key=build-${{ inputs.filter-name }}-$h" >> "$GITHUB_OUTPUT"
+
+    - name: Lookup pass marker
+      id: cache
+      uses: actions/cache/restore@v4
+      with:
+        path: ${{ runner.temp }}/ci-marker
+        key: ${{ steps.hash.outputs.key }}
+        lookup-only: true
+
+    - name: Skip notice
+      if: steps.cache.outputs.cache-hit == 'true'
+      shell: bash
+      run: echo "Skipping build — ${{ inputs.filter-name }} already passed at this content hash."
+
+    - name: Setup Xcode
+      if: steps.cache.outputs.cache-hit != 'true'
+      uses: maxim-lobanov/setup-xcode@v1
+      with:
+        xcode-version: latest-stable
+
     - name: Install Expo CLI
-      if: inputs.expo-prebuild == 'true'
+      if: steps.cache.outputs.cache-hit != 'true' && inputs.expo-prebuild == 'true'
       shell: bash
       run: |
         npm install -g @expo/cli
         echo "$(npm prefix -g)/bin" >> $GITHUB_PATH
 
     - name: Generate native iOS project
-      if: inputs.expo-prebuild == 'true'
+      if: steps.cache.outputs.cache-hit != 'true' && inputs.expo-prebuild == 'true'
       working-directory: ${{ inputs.app-path }}
       shell: bash
       run: |
         rm -rf ios
         npx expo prebuild --platform ios --no-install
 
     - name: Install CocoaPods dependencies
+      if: steps.cache.outputs.cache-hit != 'true'
       working-directory: ${{ inputs.app-path }}/ios
       shell: bash
       run: pod install
 
     - name: Build app
+      if: steps.cache.outputs.cache-hit != 'true'
       working-directory: ${{ inputs.app-path }}/ios
       shell: bash
       run: |
@@ -65,3 +91,17 @@ runs:
           -jobs $(sysctl -n hw.ncpu) \
           COMPILER_INDEX_STORE_ENABLE=NO \
           ONLY_ACTIVE_ARCH=YES | xcbeautify
+
+    - name: Save pass marker
+      if: steps.cache.outputs.cache-hit != 'true' && success()
+      shell: bash
+      run: |
+        mkdir -p "${{ runner.temp }}/ci-marker"
+        touch "${{ runner.temp }}/ci-marker/passed"
+
+    - name: Cache pass marker
+      if: steps.cache.outputs.cache-hit != 'true' && success()
+      uses: actions/cache/save@v4
+      with:
+        path: ${{ runner.temp }}/ci-marker
+        key: ${{ steps.hash.outputs.key }}
diff --git a/.github/workflows/build-apps.yml b/.github/workflows/build-apps.yml
@@ -157,7 +157,23 @@ jobs:
         uses: actions/checkout@v6
       - name: Setup
         uses: ./.github/actions/setup
+      - name: Compute bundle hash
+        id: hash
+        run: |
+          h=$(node scripts/compute-app-hash.js "${{ matrix.app }}-app")
+          echo "key=bundle-${{ matrix.platform }}-${{ matrix.app }}-$h" >> "$GITHUB_OUTPUT"
+      - name: Lookup pass marker
+        id: cache
+        uses: actions/cache/restore@v4
+        with:
+          path: ${{ runner.temp }}/ci-marker
+          key: ${{ steps.hash.outputs.key }}
+          lookup-only: true
+      - name: Skip notice
+        if: steps.cache.outputs.cache-hit == 'true'
+        run: echo "Skipping bundle — bundle-${{ matrix.platform }}-${{ matrix.app }} already passed at this content hash."
       - name: Bundle JS for ${{ matrix.platform }}
+        if: steps.cache.outputs.cache-hit != 'true'
         working-directory: apps/${{ matrix.app }}
         run: |
           if [ "${{ matrix.app }}" = "bare-rn" ]; then
@@ -171,6 +187,17 @@ jobs:
               --platform ${{ matrix.platform }} \
               --output-dir /tmp/expo-export
           fi
+      - name: Save pass marker
+        if: steps.cache.outputs.cache-hit != 'true' && success()
+        run: |
+          mkdir -p "${{ runner.temp }}/ci-marker"
+          touch "${{ runner.temp }}/ci-marker/passed"
+      - name: Cache pass marker
+        if: steps.cache.outputs.cache-hit != 'true' && success()
+        uses: actions/cache/save@v4
+        with:
+          path: ${{ runner.temp }}/ci-marker
+          key: ${{ steps.hash.outputs.key }}
 
   build-android:
     needs: detect-changes
@@ -193,6 +220,7 @@ jobs:
         with:
           app-path: apps/${{ matrix.app }}
           expo-prebuild: ${{ matrix.app == 'bare-rn' && 'false' || 'true' }}
+          filter-name: ${{ matrix.app }}-android
 
   build-ios:
     needs: detect-changes
@@ -215,3 +243,4 @@ jobs:
         with:
           app-path: apps/${{ matrix.app }}
           expo-prebuild: ${{ matrix.app == 'bare-rn' && 'false' || 'true' }}
+          filter-name: ${{ matrix.app }}-ios
diff --git a/scripts/compute-app-hash.js b/scripts/compute-app-hash.js
@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+// Computes a stable content hash of every tracked file matched by a given
+// filter in .github/workflows/build-apps.yml. Used as a cache key in the
+// build-apps matrix so a previously-passing app/platform cell can be skipped
+// when nothing relevant has changed since.
+
+const fs = require('fs');
+const cp = require('child_process');
+const crypto = require('crypto');
+const yaml = require('js-yaml');
+const picomatch = require('picomatch');
+
+const filterName = process.argv[2];
+if (!filterName) {
+  console.error('Usage: compute-app-hash.js <filter-name>');
+  process.exit(1);
+}
+
+const wf = yaml.load(
+  fs.readFileSync('.github/workflows/build-apps.yml', 'utf8')
+);
+const filtersStr = wf.jobs['detect-changes'].steps.find(
+  (s) => s.id === 'filter'
+).with.filters;
+const filters = yaml.load(filtersStr);
+
+const flatten = (x) => (Array.isArray(x) ? x.flatMap(flatten) : [x]);
+const patterns = flatten(filters[filterName]).filter(
+  (p) => typeof p === 'string'
+);
+if (patterns.length === 0) {
+  console.error(`Unknown filter: ${filterName}`);
+  process.exit(1);
+}
+const matchers = patterns.map((p) => picomatch(p, { dot: true }));
+const matchAny = (file) => matchers.some((m) => m(file));
+
+// `git ls-files -s` outputs: <mode> <hash> <stage>\t<path>
+// The hash is a content-addressable git blob hash, so the same content always
+// produces the same line — the SHA256 below is stable across machines.
+const lines = cp
+  .execSync('git ls-files -s', { encoding: 'utf8' })
+  .trim()
+  .split('\n')
+  .filter((line) => {
+    const tabIdx = line.indexOf('\t');
+    return tabIdx !== -1 && matchAny(line.slice(tabIdx + 1));
+  })
+  .sort();
+
+const sha = crypto
+  .createHash('sha256')
+  .update(lines.join('\n'))
+  .digest('hex')
+  .slice(0, 16);
+console.log(sha);
