ci(build-infra): add explicit cache validation to SEA and smol builds

jdalton · jdalton · commit 1e37c19a80af · 2025-10-28T10:49:29.000-04:00
Add file existence checks for all cached assets in build-sea.yml and
build-smol.yml workflows to match the robust validation pattern from
build-wasm.yml.

Benefits:
- Earlier failure detection for corrupted or incomplete caches
- Clear validation output (✓ valid / ✗ invalid) in workflow logs
- Consistent cache checking patterns across all build workflows
- Reduced wasted time on expensive setup when caches are invalid

Changes to build-sea.yml:
- Add Verify Yoga Layout cache step (checks yoga.wasm, yoga.js)
- Add Verify AI models cache step (checks ai.bz, ai.js)
- Add Verify ONNX Runtime cache step (checks onnxruntime-web.wasm)
- Replace all cache-hit checks with validation outputs for WASM assets
- Keep cache-hit checks for final SEA binary (verified in separate step)

Changes to build-smol.yml:
- Add Verify smol binary cache step (checks platform-specific binary)
- Replace all cache-hit checks with validation output
- Handle Windows .exe extension in validation logic
diff --git a/.github/workflows/build-sea.yml b/.github/workflows/build-sea.yml
@@ -118,27 +118,63 @@ jobs:
           key: onnx-runtime-${{ steps.wasm-cache-keys.outputs.onnx-hash }}
           restore-keys: onnx-runtime-
 
+      - name: Verify Yoga Layout cache
+        id: yoga-cache-valid
+        shell: bash
+        run: |
+          if [ -f "packages/yoga-layout/build/wasm/yoga.wasm" ] && [ -f "packages/yoga-layout/build/wasm/yoga.js" ]; then
+            echo "valid=true" >> $GITHUB_OUTPUT
+            echo "✓ Yoga Layout cache valid"
+          else
+            echo "valid=false" >> $GITHUB_OUTPUT
+            echo "✗ Yoga Layout cache invalid or missing"
+          fi
+
+      - name: Verify AI models cache
+        id: ai-cache-valid
+        shell: bash
+        run: |
+          if [ -f "packages/socketbin-cli-ai/dist/ai.bz" ] && [ -f "packages/socketbin-cli-ai/dist/ai.js" ]; then
+            echo "valid=true" >> $GITHUB_OUTPUT
+            echo "✓ AI models cache valid"
+          else
+            echo "valid=false" >> $GITHUB_OUTPUT
+            echo "✗ AI models cache invalid or missing"
+          fi
+
+      - name: Verify ONNX Runtime cache
+        id: onnx-cache-valid
+        shell: bash
+        run: |
+          if [ -f "packages/onnx-runtime-builder/dist/onnxruntime-web.wasm" ]; then
+            echo "valid=true" >> $GITHUB_OUTPUT
+            echo "✓ ONNX Runtime cache valid"
+          else
+            echo "valid=false" >> $GITHUB_OUTPUT
+            echo "✗ ONNX Runtime cache invalid or missing"
+          fi
+
       - name: Setup Python for WASM builds
-        if: steps.yoga-cache.outputs.cache-hit != 'true' || steps.ai-cache.outputs.cache-hit != 'true' || steps.onnx-cache.outputs.cache-hit != 'true'
+        if: steps.yoga-cache-valid.outputs.valid != 'true' || steps.ai-cache-valid.outputs.valid != 'true' || steps.onnx-cache-valid.outputs.valid != 'true'
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: '3.11'
 
       - name: Build WASM assets on cache miss
-        if: steps.yoga-cache.outputs.cache-hit != 'true' || steps.ai-cache.outputs.cache-hit != 'true' || steps.onnx-cache.outputs.cache-hit != 'true'
+        if: steps.yoga-cache-valid.outputs.valid != 'true' || steps.ai-cache-valid.outputs.valid != 'true' || steps.onnx-cache-valid.outputs.valid != 'true'
         shell: bash
         run: |
           echo "⚠️  WASM cache miss detected - building from source"
           echo "This will take 30-60 minutes. Consider running build-wasm.yml workflow to prime cache."
           echo ""
           echo "Cache status:"
-          echo "  Yoga Layout: ${{ steps.yoga-cache.outputs.cache-hit == 'true' && '✓ cached' || '✗ missing' }}"
-          echo "  AI Models: ${{ steps.ai-cache.outputs.cache-hit == 'true' && '✓ cached' || '✗ missing' }}"
-          echo "  ONNX Runtime: ${{ steps.onnx-cache.outputs.cache-hit == 'true' && '✓ cached' || '✗ missing' }}"
+          echo "  Yoga Layout: ${{ steps.yoga-cache-valid.outputs.valid == 'true' && '✓ cached' || '✗ missing' }}"
+          echo "  AI Models: ${{ steps.ai-cache-valid.outputs.valid == 'true' && '✓ cached' || '✗ missing' }}"
+          echo "  ONNX Runtime: ${{ steps.onnx-cache-valid.outputs.valid == 'true' && '✓ cached' || '✗ missing' }}"
           echo ""
 
           # Install Emscripten if needed for Yoga/ONNX.
-          if [ "${{ steps.yoga-cache.outputs.cache-hit }}" != "true" ] || [ "${{ steps.onnx-cache.outputs.cache-hit }}" != "true" ]; then
+          if [ "${{ steps.yoga-cache-valid.outputs.valid }}" != "true" ] || [ "${{ steps.onnx-cache-valid.outputs.valid }}" != "true" ]; then
             echo "::group::Installing Emscripten"
             git clone https://github.com/emscripten-core/emsdk.git
             cd emsdk
@@ -160,27 +196,27 @@ jobs:
           fi
 
           # Install Python deps if needed for AI models.
-          if [ "${{ steps.ai-cache.outputs.cache-hit }}" != "true" ]; then
+          if [ "${{ steps.ai-cache-valid.outputs.valid }}" != "true" ]; then
             echo "::group::Installing Python dependencies"
             python3 -m pip install --upgrade pip
             python3 -m pip install transformers torch optimum[onnx] "onnxruntime>=1.20.0"
             echo "::endgroup::"
           fi
 
           # Build missing WASM assets.
-          if [ "${{ steps.yoga-cache.outputs.cache-hit }}" != "true" ]; then
+          if [ "${{ steps.yoga-cache-valid.outputs.valid }}" != "true" ]; then
             echo "::group::Building Yoga Layout WASM"
             pnpm --filter @socketsecurity/yoga-layout run build
             echo "::endgroup::"
           fi
 
-          if [ "${{ steps.ai-cache.outputs.cache-hit }}" != "true" ]; then
+          if [ "${{ steps.ai-cache-valid.outputs.valid }}" != "true" ]; then
             echo "::group::Building AI models (10-15 minutes)"
             pnpm --filter @socketbin/cli-ai run build
             echo "::endgroup::"
           fi
 
-          if [ "${{ steps.onnx-cache.outputs.cache-hit }}" != "true" ]; then
+          if [ "${{ steps.onnx-cache-valid.outputs.valid }}" != "true" ]; then
             echo "::group::Building ONNX Runtime (20-30 minutes)"
             pnpm --filter @socketsecurity/onnx-runtime-builder run build
             echo "::endgroup::"
@@ -204,7 +240,7 @@ jobs:
           restore-keys: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-
 
       - name: Check WASM cache requirements (Windows)
-        if: matrix.os == 'windows' && (steps.yoga-cache.outputs.cache-hit != 'true' || steps.ai-cache.outputs.cache-hit != 'true' || steps.onnx-cache.outputs.cache-hit != 'true')
+        if: matrix.os == 'windows' && (steps.yoga-cache-valid.outputs.valid != 'true' || steps.ai-cache-valid.outputs.valid != 'true' || steps.onnx-cache-valid.outputs.valid != 'true')
         run: |
           echo "::error::WASM assets not cached for Windows build. Run build-wasm.yml workflow first to prime the cache."
           echo "Windows builds require pre-cached WASM assets due to network reliability issues."
diff --git a/.github/workflows/build-smol.yml b/.github/workflows/build-smol.yml
@@ -112,14 +112,31 @@ jobs:
           key: node-smol-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.smol-cache-key.outputs.hash }}
           restore-keys: node-smol-${{ matrix.platform }}-${{ matrix.arch }}-
 
+      - name: Verify smol binary cache
+        id: smol-cache-valid
+        shell: bash
+        run: |
+          BINARY_PATH="packages/node-smol-builder/dist/socket-smol-${{ matrix.platform }}-${{ matrix.arch }}"
+          if [ "${{ matrix.os }}" = "windows" ]; then
+            BINARY_PATH="${BINARY_PATH}.exe"
+          fi
+
+          if [ -f "$BINARY_PATH" ]; then
+            echo "valid=true" >> $GITHUB_OUTPUT
+            echo "✓ Smol binary cache valid: $BINARY_PATH"
+          else
+            echo "valid=false" >> $GITHUB_OUTPUT
+            echo "✗ Smol binary cache invalid or missing: $BINARY_PATH"
+          fi
+
       - name: Setup Python
-        if: steps.smol-cache.outputs.cache-hit != 'true' || inputs.force
+        if: steps.smol-cache-valid.outputs.valid != 'true' || inputs.force
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: '3.11'
 
       - name: Verify Python installation
-        if: steps.smol-cache.outputs.cache-hit != 'true' || inputs.force
+        if: steps.smol-cache-valid.outputs.valid != 'true' || inputs.force
         shell: bash
         run: |
           echo "Python version:"
@@ -128,25 +145,25 @@ jobs:
           echo "PATH=$PATH"
 
       - name: Install build dependencies (Ubuntu)
-        if: (steps.smol-cache.outputs.cache-hit != 'true' || inputs.force) && matrix.platform == 'linux'
+        if: (steps.smol-cache-valid.outputs.valid != 'true' || inputs.force) && matrix.platform == 'linux'
         run: |
           sudo apt-get update
           sudo apt-get install -y build-essential gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
 
       - name: Cache Ninja (Ubuntu)
-        if: (steps.smol-cache.outputs.cache-hit != 'true' || inputs.force) && matrix.platform == 'linux'
+        if: (steps.smol-cache-valid.outputs.valid != 'true' || inputs.force) && matrix.platform == 'linux'
         id: ninja-cache-ubuntu
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: /usr/bin/ninja
           key: ninja-ubuntu-${{ runner.os }}-${{ runner.arch }}
 
       - name: Install Ninja (Ubuntu)
-        if: (steps.smol-cache.outputs.cache-hit != 'true' || inputs.force) && matrix.platform == 'linux' && steps.ninja-cache-ubuntu.outputs.cache-hit != 'true'
+        if: (steps.smol-cache-valid.outputs.valid != 'true' || inputs.force) && matrix.platform == 'linux' && steps.ninja-cache-ubuntu.outputs.cache-hit != 'true'
         run: sudo apt-get install -y ninja-build
 
       - name: Cache Ninja (macOS)
-        if: (steps.smol-cache.outputs.cache-hit != 'true' || inputs.force) && matrix.platform == 'darwin'
+        if: (steps.smol-cache-valid.outputs.valid != 'true' || inputs.force) && matrix.platform == 'darwin'
         id: ninja-cache-macos
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
@@ -156,23 +173,23 @@ jobs:
           key: ninja-macos-${{ runner.os }}-${{ runner.arch }}
 
       - name: Install Ninja (macOS)
-        if: (steps.smol-cache.outputs.cache-hit != 'true' || inputs.force) && matrix.platform == 'darwin' && steps.ninja-cache-macos.outputs.cache-hit != 'true'
+        if: (steps.smol-cache-valid.outputs.valid != 'true' || inputs.force) && matrix.platform == 'darwin' && steps.ninja-cache-macos.outputs.cache-hit != 'true'
         run: brew install ninja
 
       - name: Cache Ninja (Windows)
-        if: (steps.smol-cache.outputs.cache-hit != 'true' || inputs.force) && matrix.platform == 'win32'
+        if: (steps.smol-cache-valid.outputs.valid != 'true' || inputs.force) && matrix.platform == 'win32'
         id: ninja-cache-windows
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: C:\ProgramData\chocolatey\bin\ninja.exe
           key: ninja-windows-${{ runner.os }}-${{ runner.arch }}
 
       - name: Install Ninja (Windows)
-        if: (steps.smol-cache.outputs.cache-hit != 'true' || inputs.force) && matrix.platform == 'win32' && steps.ninja-cache-windows.outputs.cache-hit != 'true'
+        if: (steps.smol-cache-valid.outputs.valid != 'true' || inputs.force) && matrix.platform == 'win32' && steps.ninja-cache-windows.outputs.cache-hit != 'true'
         run: choco install ninja
 
       - name: Build smol binary
-        if: steps.smol-cache.outputs.cache-hit != 'true' || inputs.force
+        if: steps.smol-cache-valid.outputs.valid != 'true' || inputs.force
         run: pnpm --filter @socketbin/node-smol-builder run build
 
       - name: Verify smol binary
