feat: add server-driven config infrastructure for GC and pre-commit hooks

Add BuildkitdConfig and PreCommitHook interfaces (server-config.ts) that
define the contract for server-driven cache lifecycle management. The
action reads BuildkitdConfig from the GetStickyDisk RPC response (with
hardcoded fallback for Phase 1) and runs pre-commit hooks from the
PrepareCommit RPC response before committing.

Refactor writeBuildkitdTomlFile to accept a BuildkitdConfig parameter
instead of hardcoding GC policy values. This makes it trivial to switch
from hardcoded defaults to server-provided config when the proto is
updated (Phase 2).

Add runPreCommitHooks dispatcher that executes an ordered list of opaque
shell commands with timeout and failure mode handling. The commit flow
now goes through prepareCommit -> runHooks -> conditionalCommit, with
Phase 1 returning unconditional commit + empty hooks.

Phase 1 (now): hardcoded gc=true, keepDuration=192h, no hooks
Phase 2: server returns BuildkitdConfig in GetStickyDiskResponse
Phase 3: server returns hooks via PrepareCommit RPC

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: piob-io

dist/index.js

@@ -33,6 +33,7 @@ import {
 import { shutdownBuildkitd } from "./shutdown";
 import { resolveRemoteBuilderPlatforms } from "./platform-utils";
 import { checkPreviousStepFailures } from "./step-checker";
+import { runPreCommitHooks, type PrepareCommitResponse } from "./server-config";
 import { Metric_MetricType } from "@buf/blacksmith_vm-agent.bufbuild_es/stickydisk/v1/stickydisk_pb.js";
 
 const DEFAULT_BUILDX_VERSION = "v0.23.0";
@@ -933,17 +934,40 @@ void actionsToolkit.run(
               "Skipping sticky disk commit because SIGKILL was used to terminate buildkitd - disk may be in a bad state",
             );
           } else {
-            // No failures detected and cleanup was successful
+            // No failures detected and cleanup was successful — proceed with commit flow.
+            // Phase 3: call PrepareCommit RPC here to get shouldCommit + hooks from the
+            // server. For now, fall back to unconditional commit with no hooks.
+            const commitDecision: PrepareCommitResponse = {
+              shouldCommit: true,
+              hooks: [],
+            };
+
             try {
-              core.info(
-                "No previous step failures detected, committing sticky disk after successful cleanup",
-              );
+              if (commitDecision.hooks.length > 0) {
+                const hookResult = await runPreCommitHooks(
+                  commitDecision.hooks,
+                );
+                if (!hookResult.shouldProceedWithCommit) {
+                  core.warning(
+                    "Pre-commit hook indicated commit should be skipped",
+                  );
+                  commitDecision.shouldCommit = false;
+                }
+              }
 
-              await reporter.commitStickyDisk(
-                exposeId,
-                fsDiskUsageBytes,
-                stateHelper.getCacheKey(),
-              );
+              if (!commitDecision.shouldCommit) {
+                core.info("Server indicated commit should be skipped");
+              } else {
+                core.info(
+                  "No previous step failures detected, committing sticky disk after successful cleanup",
+                );
+
+                await reporter.commitStickyDisk(
+                  exposeId,
+                  fsDiskUsageBytes,
+                  stateHelper.getCacheKey(),
+                );
+              }
             } catch (error) {
               core.error(
                 `Failed to commit sticky disk: ${(error as Error).message}`,

dist/index.js.map

@@ -0,0 +1,94 @@
+import * as core from "@actions/core";
+import { exec } from "child_process";
+import { promisify } from "util";
+
+const execAsync = promisify(exec);
+
+/**
+ * Server-driven buildkitd daemon configuration.
+ * Returned by the GetStickyDisk RPC (Phase 2).
+ * When absent, the action falls back to DEFAULT_BUILDKITD_CONFIG.
+ */
+export interface GCPolicy {
+  keepDuration?: string;
+  keepBytes?: number;
+  all?: boolean;
+  filters?: string[];
+}
+
+export interface BuildkitdConfig {
+  gc: boolean;
+  gcPolicy?: GCPolicy[];
+  maxParallelism?: number;
+}
+
+/**
+ * Server-driven pre-commit hook definition.
+ * Returned by the PrepareCommit RPC (Phase 3).
+ */
+export interface PreCommitHook {
+  command: string;
+  timeoutSeconds?: number;
+  failureMode: "skip_commit" | "commit_anyway" | "abort";
+}
+
+/**
+ * Response from the PrepareCommit RPC (Phase 3).
+ * When the RPC is unavailable (old agent), the action falls back to
+ * unconditional commit with no hooks.
+ */
+export interface PrepareCommitResponse {
+  shouldCommit: boolean;
+  hooks: PreCommitHook[];
+}
+
+export const DEFAULT_BUILDKITD_CONFIG: BuildkitdConfig = {
+  gc: true,
+  gcPolicy: [
+    {
+      keepDuration: "192h",
+      all: true,
+    },
+  ],
+};
+
+/**
+ * Runs an ordered list of pre-commit hooks. Returns whether the commit
+ * should proceed based on hook results and their failure modes.
+ */
+export async function runPreCommitHooks(
+  hooks: PreCommitHook[],
+): Promise<{ shouldProceedWithCommit: boolean }> {
+  for (const hook of hooks) {
+    const timeout = hook.timeoutSeconds ?? 300;
+    core.info(
+      `Running pre-commit hook: ${hook.command} (timeout: ${timeout}s)`,
+    );
+
+    try {
+      const { stdout, stderr } = await execAsync(hook.command, {
+        timeout: timeout * 1000,
+      });
+      if (stdout) core.debug(`Hook stdout: ${stdout.slice(0, 1000)}`);
+      if (stderr) core.debug(`Hook stderr: ${stderr.slice(0, 1000)}`);
+      core.info(`Pre-commit hook completed successfully`);
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      core.warning(`Pre-commit hook failed: ${errorMsg}`);
+
+      switch (hook.failureMode) {
+        case "skip_commit":
+          core.warning("Hook failure mode is skip_commit, skipping commit");
+          return { shouldProceedWithCommit: false };
+        case "abort":
+          core.error("Hook failure mode is abort, failing the action");
+          throw new Error(`Pre-commit hook aborted: ${errorMsg}`);
+        case "commit_anyway":
+          core.warning("Hook failure mode is commit_anyway, continuing");
+          break;
+      }
+    }
+  }
+
+  return { shouldProceedWithCommit: true };
+}

src/main.ts

@@ -7,6 +7,7 @@ import * as reporter from "./reporter";
 import { execa } from "execa";
 import * as stateHelper from "./state-helper";
 import { BOLT_CHECK_MAX_FILE_BYTES } from "./exec-utils";
+import { BuildkitdConfig, DEFAULT_BUILDKITD_CONFIG } from "./server-config";
 
 // Constants for configuration.
 const BUILDKIT_DAEMON_ADDR = "tcp://127.0.0.1:1234";
@@ -166,7 +167,20 @@ async function writeBuildkitdTomlFile(
   parallelism: number,
   addr: string,
   dnsNameservers: string[],
+  serverConfig?: BuildkitdConfig,
 ): Promise<void> {
+  const config = serverConfig ?? DEFAULT_BUILDKITD_CONFIG;
+  const effectiveParallelism = config.maxParallelism ?? parallelism;
+
+  const gcPolicy = config.gcPolicy?.map((p) => {
+    const policy: TOML.JsonMap = {};
+    if (p.keepDuration) policy.keepDuration = p.keepDuration;
+    if (p.keepBytes) policy.keepBytes = p.keepBytes;
+    if (p.all !== undefined) policy.all = p.all;
+    if (p.filters) policy.filters = p.filters;
+    return policy;
+  });
+
   const jsonConfig: TOML.JsonMap = {
     root: "/var/lib/buildkit",
     grpc: {
@@ -184,14 +198,9 @@ async function writeBuildkitdTomlFile(
     worker: {
       oci: {
         enabled: true,
-        gc: true,
-        gcpolicy: [
-          {
-            keepDuration: "192h",
-            all: true,
-          },
-        ],
-        "max-parallelism": parallelism,
+        gc: config.gc,
+        ...(gcPolicy && gcPolicy.length > 0 ? { gcpolicy: gcPolicy } : {}),
+        "max-parallelism": effectiveParallelism,
         snapshotter: "overlayfs",
       },
       containerd: {