ci: enable moon remote caching via Depot Cache - #602
Conversation
Add a remote block to .moon/workspace.yml pointing at Depot Cache. Depot- hosted runners inject DEPOT_TOKEN at launch, so CI authenticates with no repo secret; without the token (local dev, forks) moon runs fully local. localReadOnly keeps uploads CI-only, verifyIntegrity guards downloads, and compression stays off because Depot's capabilities response rejects zstd. This is the enabling investment for splitting the serial full-pr job into parallel shards: each shard can pull warm task outputs instead of rebuilding the world. Deliberately touches no workflow files to stay conflict-free with #487.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
There was a problem hiding this comment.
Pull request overview
Enables Moon’s remote task-output caching backed by Depot Cache, with opt-in local reads via DEPOT_TOKEN and automatic authentication on Depot CI runners. This is a build/CI acceleration change intended to reduce redundant rebuilds and enable future CI sharding without changing shipped product behavior.
Changes:
- Configure Moon 2.x remote cache in
.moon/workspace.yml(Depot host, token env var, integrity verification, read-only for local runs). - Document the remote-cache behavior and local opt-in in
CONTRIBUTING.md. - Add an empty changeset to record release intent for build wiring only.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| CONTRIBUTING.md | Adds contributor-facing note about Moon remote caching and local DEPOT_TOKEN behavior. |
| .moon/workspace.yml | Configures Moon remote cache against Depot Cache (host/auth/cache settings). |
| .changeset/moon-remote-cache.md | Records an empty changeset for CI/build-wiring-only change intent. |
Summary
Enables Moon's remote task-output cache against Depot Cache and closes the authentication and fork trust gaps found during review:
.moon/workspace.ymlforgrpcs://cache.depot.devwith Depot's runner-injectedDEPOT_CACHE_TOKEN,instanceName: zitadel-nextgen,localReadOnly: true, and integrity verification.ubuntu-24.04runners in bothci.ymlandadr-index.yml, so untrusted fork code never receives Depot's ambient cache credential. Internal PRs, merge groups, and release jobs continue using Depot runners.CONTRIBUTING.md.This is the enabling investment for splitting the serial
full-prjob into parallel shards without rebuilding the affected graph in every shard.Validation
moon ci :build— passed locally: 50 tasks completed (8 cached) in 1m20s withDEPOT_CACHE_TOKENabsent, proving the local fallback still works.DEPOT_CACHE_TOKEN; no remote-cache authentication or connection warnings.108 completed (107 cached), the log contained 160 explicitcached from remotetask results, and zero remote-cache failures.moon run workspace:check-adrs— passed (40 records).node scripts/check-changesets-status.mjs --base origin/main --summary— passed; no changeset required..github/workflows/ci.yml,.github/workflows/adr-index.yml, and.moon/workspace.ymlas YAML.git diff --check— passed.Release notes / changeset
No changeset required — this PR changes CI/build wiring and contributor documentation only; no shipped product behavior changes.
Notes
invalid tokenwarnings and fell back to local execution.DEPOT_CACHE_TOKEN; trusted jobs continue on Depot.DEPOT_CACHE_TOKEN.env -u CI -u GITHUB_ACTIONSrehearsal steps continue to behave as local Moon invocations and therefore do not upload whenlocalReadOnlyis enabled.remoteblock and restoring the original static Depot runner labels.