ci: remove remote execution configuration

Assisted-by: GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: castrojo

.github/actions/generate-bst-ci-config/action.yml

@@ -1,10 +1,7 @@
 name: Generate BuildStream CI config
-description: Write buildstream-ci.conf for CI builds and optional remote execution.
+description: Write BuildStream cache configuration for runner-side assembly.
 
 inputs:
-  enable-remote-execution:
-    description: Enable x86_64 remote execution settings and max-jobs tuning.
-    required: true
   enable-push:
     description: Push artifacts and sources to the remote cache. Set false for fetch-only jobs (e.g. publish).
     required: false
@@ -16,7 +13,6 @@ runs:
     - name: Generate BuildStream CI config
       shell: bash
       env:
-        ENABLE_REMOTE_EXECUTION: ${{ inputs.enable-remote-execution }}
         ENABLE_PUSH: ${{ inputs.enable-push }}
       run: |
         mkdir -p logs
@@ -39,36 +35,11 @@ runs:
         logdir: /src/logs
         BSTCONF
 
-        if [[ -n "${CASD_CLIENT_CERT:-}" ]] && [[ -n "${CASD_CLIENT_KEY:-}" ]]; then
-          if [[ "$ENABLE_REMOTE_EXECUTION" == "true" ]]; then
-            cat >> buildstream-ci.conf <<'BSTCONFBUILD'
-        build:
-          retry-failed: True
-          # max-jobs does NOT affect cache keys (buildelement.py: "normally
-          # automatically resolved and does not affect the cache key"), so
-          # tuning it preserves the warm CAS. History: max-jobs: 1 made every
-          # big element (llvm, WebKit x2) a 10-30h single-core compile that
-          # mathematically busted the 480m budget (11-day outage). The first
-          # attempt at 16 coincided with a server-wide outage (RST_STREAM
-          # INTERNAL + FetchBlob DEADLINE_EXCEEDED on all pulls, 23:20 UTC
-          # 2026-07-09) — likely OOM: gimple-match.cc compiles eat 4-6 GB
-          # each, and 16 in parallel plus casd cache pressure exceeds the
-          # 128 GB builder. 2 builders x -j8 is a safe 8x speedup over -j1
-          # while staying well under the RAM ceiling.
-          max-jobs: 8
-        BSTCONFBUILD
-          else
-            cat >> buildstream-ci.conf <<'BSTCONFBUILD'
-        build:
-          retry-failed: True
-        BSTCONFBUILD
-          fi
-        else
-          cat >> buildstream-ci.conf <<'BSTCONFBUILD'
+        cat >> buildstream-ci.conf <<'BSTCONFBUILD'
         build:
           retry-failed: True
+          max-jobs: 1
         BSTCONFBUILD
-        fi
 
         if [[ -n "${CASD_CLIENT_CERT:-}" ]] && [[ -n "${CASD_CLIENT_KEY:-}" ]]; then
           PUSH_FLAG="true"
@@ -130,56 +101,6 @@ runs:
 
         BSTCONFCACHE
 
-          # Top-level storage-service (under cache:) is ONLY for enable-push: true.
-          # Remote execution uses the NESTED storage-service inside remote-execution: block.
-          # NEVER add top-level storage-service when only RE is enabled — it puts casd
-          # in proxy mode and causes gRPC flooding. See docs/skills/ci.md.
-
-          if [[ "$ENABLE_REMOTE_EXECUTION" == "true" ]]; then
-            # IMPORTANT: storage-service is NESTED inside remote-execution, NOT at
-            # the top-level cache: block. This satisfies BST's validation requirement
-            # ("Remote execution requires storage-service") without putting buildbox-casd
-            # into write-through proxy mode (--cas-remote). Top-level cache.storage-service
-            # routes ALL casd operations through the remote and causes gRPC connection drops
-            # after ~3.5 hours. The nested form only affects per-action RE blob transfers
-            # (transient connections), avoiding the sustained stream that killed builds.
-            # See docs/skills/ci.md "Remote Execution with Nested storage-service".
-            cat >> buildstream-ci.conf <<'BSTCONFREMOTE'
-        remote-execution:
-          execution-service:
-            url: https://cache.projectbluefin.io:11002
-            connection-config:
-              keepalive-time: 180
-              retry-limit: 5
-              retry-delay: 1000
-              request-timeout: 180
-            auth:
-              client-key: /src/client.key
-              client-cert: /src/client.crt
-          storage-service:
-            url: https://cache.projectbluefin.io:11002
-            connection-config:
-              keepalive-time: 180
-              retry-limit: 5
-              retry-delay: 1000
-              request-timeout: 180
-            auth:
-              client-key: /src/client.key
-              client-cert: /src/client.crt
-          action-cache-service:
-            url: https://cache.projectbluefin.io:11002
-            connection-config:
-              keepalive-time: 180
-              retry-limit: 5
-              retry-delay: 1000
-              request-timeout: 180
-            auth:
-              client-key: /src/client.key
-              client-cert: /src/client.crt
-        BSTCONFREMOTE
-          fi
-        fi
-
         # Write the unified cache configuration block to avoid duplicate keys.
         cat >> buildstream-ci.conf <<'BSTCONFCACHEBLOCK'
 
@@ -204,24 +125,7 @@ runs:
           fi
         fi
 
-        # Preserve the generated config in the uploaded logs artifact so the next run
-        # can confirm the remote-execution block was emitted and not silently skipped.
         cp buildstream-ci.conf logs/buildstream-ci.conf
-
-        if [[ "$ENABLE_REMOTE_EXECUTION" == "true" ]]; then
-          if [[ -z "${CASD_CLIENT_CERT:-}" ]] || [[ -z "${CASD_CLIENT_KEY:-}" ]]; then
-            echo "::error::remote execution was requested but CASD client credentials are missing"
-            exit 1
-          fi
-          if ! grep -Fq 'remote-execution:' buildstream-ci.conf; then
-            echo "::error::remote-execution block missing from generated buildstream-ci.conf"
-            exit 1
-          fi
-          echo "Remote execution enabled: yes"
-        else
-          echo "Remote execution enabled: no"
-        fi
-
         echo "=== BuildStream CI config ==="
         cat buildstream-ci.conf
 

.github/workflows/build-aarch64.yml

@@ -97,7 +97,7 @@ jobs:
           CASD_CLIENT_KEY: ${{ secrets.CASD_CLIENT_KEY }}
         uses: ./.github/actions/generate-bst-ci-config
         with:
-          enable-remote-execution: 'false'
+
           enable-push: 'true'
 
       - name: Build OCI image with BuildStream (aarch64)

.github/workflows/build.yml

@@ -119,7 +119,6 @@ jobs:
           # Remote execution is disabled here so we pull cached artifacts from the CAS
           # and avoid the remote execution queue and server capacity bottlenecks.
           # We perform final image assembly locally on the GHA runner.
-          enable-remote-execution: "false"
           enable-push: "false"
 
       # Count the full element graph so the progress script can show %.

.github/workflows/publish.yml

@@ -134,7 +134,6 @@ jobs:
           CASD_CLIENT_KEY: ${{ secrets.CASD_CLIENT_KEY }}
         uses: ./.github/actions/generate-bst-ci-config
         with:
-          enable-remote-execution: 'false'
           enable-push: 'false'
 
       - name: Export OCI image from BuildStream
@@ -577,7 +576,6 @@ jobs:
           CASD_CLIENT_KEY: ${{ secrets.CASD_CLIENT_KEY }}
         uses: ./.github/actions/generate-bst-ci-config
         with:
-          enable-remote-execution: 'false'
           enable-push: 'false'
 
       # Cache the pip wheel for buildstream-sbom across runs.

.github/workflows/update-filemap.yml

@@ -52,7 +52,6 @@ jobs:
       - name: Generate BuildStream CI config
         uses: ./.github/actions/generate-bst-ci-config
         with:
-          enable-remote-execution: 'false'
           enable-push: 'false'
         env:
           CASD_CLIENT_CERT: ${{ vars.CASD_CLIENT_CERT }}

docs/skills/ci.md

@@ -107,7 +107,7 @@ This is the fast path for stale-image complaints: the image date is usually wron
 
 | Workflow | Trigger | What it does |
 |---|---|---|
-| `build.yml` | `push: testing` for key-busting paths, `workflow_dispatch`, `schedule: daily 13:00 UTC` — NOT `pull_request` or `merge_group` | Pull-only warmup shards → serialized CAS pushes → BST build → artifacts into remote CAS. Does NOT push to GHCR. |
+| `build.yml` | `push: testing` for key-busting paths, `workflow_dispatch`, `schedule: daily 13:00 UTC` — NOT `pull_request` or `merge_group` | Cache-only final OCI assembly → artifact cache. Does NOT push to GHCR. |
 | `publish.yml` | `workflow_run` from `build.yml` (branches: testing, next, + their gh-readonly-queue/* paths) | Export from CAS → push `:$sha` → sign/attest → promote to `:testing`/`:next`. No build happens here. |
 | `execute-release.yml` | `workflow_run` from `publish.yml` on `testing`, `workflow_dispatch` | SHA freshness check (:testing vs :stable). If different: cosign verify → skopeo copy `:testing` → `:stable` → fast-forward main → create GitHub Release. Skips if equal. (Boot-check is in publish.yml before :testing; execute-release trusts the already-boot-checked image.) |
 | ~~`promote-testing-to-main.yml`~~ | DELETED | Was: `push: testing`, schedule Tue 04:00 UTC, manual. |
@@ -158,8 +158,6 @@ is disabled.
 are present. The protected `testing` workflow requires these credentials; without
 them, do not run a source-build fallback.
 
-**Remote-execution sanity check:** when `enable-remote-execution: 'true'`, the generated `buildstream-ci.conf` must contain a real `remote-execution:` block. The workflow now stores the generated config in the `logs/` artifact and fails fast if the block is missing or the remote cache credentials are absent.
-
 ## ⚠️ Pre-Commit BST Syntax Gate
 
 For any change to `project.conf`, `*.bst` elements, or `Justfile`: