de-bespoke build

.dockerignore

@@ -1,9 +1,5 @@
-.scratch/
 .git/
 build/
-build-san/
 _build/
-deps/moxygen/.git/
-deps/moxygen/moxygen/
-deps/moxygen/standalone/
 install/
+.scratch/

.github/actions/setup-build/action.yml

@@ -0,0 +1,92 @@
+name: Set up moqx build
+description: >
+  Install system dependencies and restore the ccache + dependency-download
+  caches shared by every moqx build job. Run right after actions/checkout.
+
+inputs:
+  ccache-key:
+    description: >
+      ccache cache-key namespace — a short slug, distinct per build flavor so
+      lanes with different flags don't share a cache (e.g. "linux", "asan",
+      "conformance", "microbench"). Must be a valid actions/cache key fragment:
+      no commas, so never a human-readable display name.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    # install-system-deps.sh elevates its own package-manager calls, so the same
+    # invocation serves both runner families.
+    - name: Install system dependencies
+      shell: bash
+      run: |
+        scripts/install-system-deps.sh
+        if [[ "$(uname)" == "Darwin" ]]; then
+          brew install coreutils
+          echo "/opt/homebrew/opt/coreutils/libexec/gnubin" >> "$GITHUB_PATH"
+        fi
+
+    # The moqx CMakeLists routes the compiler through ccache automatically when
+    # it is installed (install-system-deps.sh installs it).
+    - name: Cache ccache
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/ccache
+        key: ccache-${{ runner.os }}-${{ inputs.ccache-key }}-${{ github.sha }}
+        restore-keys: |
+          ccache-${{ runner.os }}-${{ inputs.ccache-key }}-
+
+    # The prebuilt tarball is named for the host's *distro* release, so the key
+    # needs that granularity: on runner.os alone a bookworm self-hosted box and
+    # an ubuntu-22.04 runner collide, and the loser re-downloads every run.
+    - name: Derive the dependency-cache platform key
+      id: depkey
+      shell: bash
+      run: |
+        if [[ "$(uname)" == "Darwin" ]]; then
+          plat="macos-$(sw_vers -productVersion | cut -d. -f1)"
+        else
+          plat="$(. /etc/os-release && echo "${ID}-${VERSION_ID}")"
+        fi
+        echo "plat=${plat}-$(uname -m)" >> "$GITHUB_OUTPUT"
+
+    # One shared fetch cache for CPM sources and the prebuilt moxygen install,
+    # ~680 MB of downloads per configure otherwise, content-keyed on the pins.
+    - name: Cache dependency downloads
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/moqx
+        key: deps-${{ steps.depkey.outputs.plat }}-${{ hashFiles('cmake/dependencies.cmake') }}
+        # actions/cache saves only at job end, so a pin bump misses the exact key
+        # in all ~11 concurrent jobs. The prefix starts them from the previous
+        # tree and fetches the delta.
+        restore-keys: |
+          deps-${{ steps.depkey.outputs.plat }}-
+
+    # Restoring by prefix carries every previously pinned rev's install tree
+    # along (~320 MB each), so drop the unusable ones before the save step
+    # re-uploads them. The CPM clones accumulate too, but are far smaller.
+    - name: Prune superseded prebuilt installs
+      shell: bash
+      run: |
+        cache="$HOME/.cache/moqx"
+        [ -d "$cache" ] || exit 0
+        rev="$(cmake -DPIN=MOXYGEN_REV -P cmake/print-pin.cmake)"
+        for d in "$cache"/moxygen-*; do
+          case "${d##*/}" in
+            "moxygen-${rev:0:12}-"*)  ;;                     # this run's install
+            moxygen-????????????-*)   rm -rf "$d" ;;         # a superseded pin's
+          esac
+        done
+        rm -rf "$cache/downloads"
+
+    - name: Route the dependency and ccache dirs through the caches
+      shell: bash
+      run: |
+        # The root only; cmake/DepsCache.cmake puts the CPM clones under it.
+        echo "MOQX_DEPS_CACHE=$HOME/.cache/moqx" >> "$GITHUB_ENV"
+        # Pin ccache's dir to the cached path; its own default is platform-dependent.
+        echo "CCACHE_DIR=$HOME/.cache/ccache" >> "$GITHUB_ENV"
+        # GITHUB_TOKEN stays off $GITHUB_ENV, which would hand it to every later
+        # step in the job, ctest among them — and ctest runs the relay and the
+        # shell integration tests. The configure step sets it for its one API read.

.github/workflows/auto-merge-moxygen.yml

@@ -79,7 +79,7 @@ jobs:
       - name: Generate app token
         if: github.event.workflow_run.conclusion == 'success'
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.OMOQ_APP_ID }}
           private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}