Add CI workflow with sccache integration test

.github/workflows/ci.yml

@@ -0,0 +1,73 @@
+name: CI
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
+  CARGO_NET_GIT_FETCH_WITH_CLI: true
+
+jobs:
+  ci:
+    name: Format, lint, build, and test
+    # Self-hosted macOS runner required for CommonCrypto FFI and NAS access
+    runs-on: spiceai-macos
+    permissions:
+      contents: read
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt,clippy
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Check formatting
+        run: cargo fmt --all --check
+
+      - name: Run cargo check
+        run: cargo check --locked --all-targets --all-features
+
+      - name: Run clippy
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings -D clippy::all -D clippy::cargo -A clippy::cargo-common-metadata
+
+      - name: Check rustdoc
+        run: RUSTDOCFLAGS="-D warnings" cargo doc --locked --workspace --no-deps --document-private-items
+
+      - name: Build debug binary
+        run: cargo build --locked
+
+      - name: Run unit tests
+        run: cargo test --locked
+
+      - name: Run sccache integration test
+        # Skipped on fork PRs where the secret is unavailable
+        if: ${{ secrets.UNAS_SMB_PASS != '' }}
+        env:
+          SPICEIO_SMB_SERVER: ${{ vars.SPICEIO_SMB_SERVER || '192.168.3.148' }}
+          SPICEIO_SMB_USER: ${{ vars.SPICEIO_SMB_USER || 'runner' }}
+          SPICEIO_SMB_PASS: ${{ secrets.UNAS_SMB_PASS }}
+          SPICEIO_SMB_SHARE: ${{ vars.SPICEIO_SMB_SHARE || 'ai_platform_dev' }}
+          SPICEIO_BUCKET: ${{ vars.SPICEIO_BUCKET || 'spiceio' }}
+          SPICEIO_REGION: ${{ vars.SPICEIO_REGION || 'us-west-1' }}
+        run: ./scripts/test-sccache.sh
+
+      - name: Build release artifact
+        run: cargo build --release --locked --bin spiceio
+
+      - name: Upload release artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: spiceio-${{ runner.os }}-${{ runner.arch }}
+          path: target/release/spiceio
+          if-no-files-found: error

.github/workflows/release.yml

@@ -0,0 +1,49 @@
+name: Release
+
+on:
+  release:
+    types: [created]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
+  CARGO_NET_GIT_FETCH_WITH_CLI: true
+
+jobs:
+  build:
+    name: Build release binary
+    # Self-hosted macOS runner required for CommonCrypto FFI
+    runs-on: spiceai-macos
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Build release binary
+        run: cargo build --release --locked --bin spiceio
+
+      - name: Package binary
+        run: |
+          cd target/release
+          tar czf spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz spiceio
+          shasum -a 256 spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz > spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz.sha256
+
+      - name: Upload release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "${{ github.event.release.tag_name }}" \
+            target/release/spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz \
+            target/release/spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz.sha256

scripts/test-sccache.sh

@@ -267,3 +267,17 @@ echo "[test] sccache stats:"
 echo "======================================="
 sccache --show-stats
 echo "======================================="
+
+# ── Verify cache hits ───────────────────────────────────────────────────────
+
+STATS=$(sccache --show-stats 2>&1)
+CACHE_HITS=$(echo "$STATS" | grep -m1 "^Cache hits" | awk '{print $NF}')
+WRITE_ERRORS=$(echo "$STATS" | grep -m1 "Cache write errors" | awk '{print $NF}')
+
+echo ""
+if [[ "${CACHE_HITS:-0}" -gt 0 && "${WRITE_ERRORS:-0}" -eq 0 ]]; then
+    echo "[test] PASS: warm build got $CACHE_HITS cache hits, 0 write errors"
+else
+    echo "[test] FAIL: expected cache hits > 0 (got ${CACHE_HITS:-0}) and write errors == 0 (got ${WRITE_ERRORS:-0})"
+    exit 1
+fi