Address CI PR review comments

- Remove workflow_dispatch trigger (PR-only)
- Add comment explaining self-hosted runner requirement
- Use repository variables with defaults for SMB config
- Skip integration test on fork PRs (secret unavailable)
- Assert cache hits > 0 and write errors == 0 in test script

Author: lukekim

.github/workflows/ci.yml

@@ -2,7 +2,6 @@ name: CI
 
 on:
   pull_request:
-  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -16,6 +15,7 @@ env:
 jobs:
   ci:
     name: Format, lint, build, and test
+    # Self-hosted macOS runner required for CommonCrypto FFI and NAS access
     runs-on: spiceai-macos
     permissions:
       contents: read
@@ -51,13 +51,15 @@ jobs:
         run: cargo test --locked
 
       - name: Run sccache integration test
+        # Skipped on fork PRs where the secret is unavailable
+        if: ${{ secrets.UNAS_SMB_PASS != '' }}
         env:
-          SPICEIO_SMB_SERVER: 192.168.3.148
-          SPICEIO_SMB_USER: runner
+          SPICEIO_SMB_SERVER: ${{ vars.SPICEIO_SMB_SERVER || '192.168.3.148' }}
+          SPICEIO_SMB_USER: ${{ vars.SPICEIO_SMB_USER || 'runner' }}
           SPICEIO_SMB_PASS: ${{ secrets.UNAS_SMB_PASS }}
-          SPICEIO_SMB_SHARE: ai_platform_dev
-          SPICEIO_BUCKET: spiceio
-          SPICEIO_REGION: us-west-1
+          SPICEIO_SMB_SHARE: ${{ vars.SPICEIO_SMB_SHARE || 'ai_platform_dev' }}
+          SPICEIO_BUCKET: ${{ vars.SPICEIO_BUCKET || 'spiceio' }}
+          SPICEIO_REGION: ${{ vars.SPICEIO_REGION || 'us-west-1' }}
         run: ./scripts/test-sccache.sh
 
       - name: Build release artifact

scripts/test-sccache.sh

@@ -267,3 +267,17 @@ echo "[test] sccache stats:"
 echo "======================================="
 sccache --show-stats
 echo "======================================="
+
+# ── Verify cache hits ───────────────────────────────────────────────────────
+
+STATS=$(sccache --show-stats 2>&1)
+CACHE_HITS=$(echo "$STATS" | grep -m1 "^Cache hits" | awk '{print $NF}')
+WRITE_ERRORS=$(echo "$STATS" | grep -m1 "Cache write errors" | awk '{print $NF}')
+
+echo ""
+if [[ "${CACHE_HITS:-0}" -gt 0 && "${WRITE_ERRORS:-0}" -eq 0 ]]; then
+    echo "[test] PASS: warm build got $CACHE_HITS cache hits, 0 write errors"
+else
+    echo "[test] FAIL: expected cache hits > 0 (got ${CACHE_HITS:-0}) and write errors == 0 (got ${WRITE_ERRORS:-0})"
+    exit 1
+fi