Skip to content

fix(cachekey): include config fingerprint in graph keys, skip mapping cache for mutable refs (audit #7) - #263

Draft
sbalabanov wants to merge 2 commits into
mainfrom
audit/fix-07-cache-identity-config
Draft

fix(cachekey): include config fingerprint in graph keys, skip mapping cache for mutable refs (audit #7)#263
sbalabanov wants to merge 2 commits into
mainfrom
audit/fix-07-cache-identity-config

Conversation

@sbalabanov

Copy link
Copy Markdown
Contributor

Summary

Graph cache keys omitted graph-affecting RepositoryConfig fields, so a config change (e.g. enabling bzlmod, adding bazel args) could silently serve stale cached graphs. Additionally, the treehash-mapping cache accepted mutable refs like HEAD, which go stale once the ref moves.

  • Add HashGraphAffectingConfig to compute an md5 digest of the 7 graph-affecting config fields; emit empty suffix for default/zero config so existing cache entries remain valid
  • Extend GetGraphByTreeHash with a configHash parameter and update all call sites (controller, orchestrator)
  • Add IsFullHexSHA guard: treehash mapping lookups and writes are skipped for non-40-hex base_sha values (HEAD, branch names, short SHAs)
  • Add comprehensive table-driven tests for config hashing (default=empty, each field changes key, order-insensitivity) and mutable-ref skipping
  • Update GetTreehashCachePath and ProtoToBuildDescription godocs to document the mutable-ref constraint

Test plan

  • go build ./... passes
  • go test ./core/cachekey/ ./controller/ ./orchestrator/ ./internal/mapper/ -- all pass
  • Full go test ./... passes (integration tests skip due to missing env, pre-existing)
  • make gazelle -- BUILD files in sync

🤖 Generated with Claude Code

… cache for mutable refs (audit #7)

Graph cache keys now include an md5 digest of graph-affecting RepositoryConfig
fields (bzlmod_enabled, bazel_command, bazel_extra_args, bazel_startup_options,
full_hash_repos, exclude_external_targets, excluded_files). When all fields are
at their zero/default values the suffix is omitted, preserving all existing
cache entries.

The treehash-mapping fast path now requires base_sha to be a full 40-hex SHA.
Mutable refs (HEAD, branch names, short SHAs) skip the mapping lookup and write
so the workspace is materialized and the ref resolved fresh each time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Pass cfg as ConfigProvider when constructing the controller in
example/main.go so the controller's fast-path cache lookup uses the
same config fingerprint the orchestrator writes under. Without this,
any deployment with non-default RepositoryConfig would silently miss
the graph cache on every request.

Add a key-symmetry test asserting the controller read path and
orchestrator write path produce identical graph keys for the same
non-default config. Add godoc on Params.ConfigProvider documenting
that it must be the same config source the orchestrator uses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants