build.yml

name: CI

on:
  push:
  pull_request_target:

permissions:
  actions: read
  contents: read
  packages: read

# Develop pushes get a group of their own, so a newer push neither cancels nor
# queues behind an older run: every build finishes and saves its caches. Only
# tests share a cancelling group (test-src.yml), and only when the run's build
# and lint both verified it was still develop's tip as they finished; a run
# found superseded skips its tests, and one whose check failed runs them in its
# own group. Otherwise a delayed older run could cancel the newest run's tests.
concurrency:
  group: |
    ${{ github.workflow }}-${{
      (vars.ALLOW_CONCURRENCY != '' && github.sha) ||
      (github.event_name == 'pull_request_target' && github.event.pull_request.number) ||
      (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch && github.run_id) ||
      (github.event_name == 'push' && github.ref)
    }}
  cancel-in-progress: ${{ github.ref_type != 'tag' }}

jobs:
  check-skip:
    name: Check skip conditions
    # Keep the bootstrap job cheap; RUNNER_CHECK_SKIP can point to a small Blacksmith ARM runner.
    runs-on: ${{ vars.RUNNER_CHECK_SKIP || 'ubuntu-24.04-arm' }}
    outputs:
      skip: ${{ steps.skip-check.outputs.skip }}
      runner-amd64: ${{ steps.select-runner.outputs.runner_amd64 }}
      runner-arm64: ${{ steps.select-runner.outputs.runner_arm64 }}
      runner-prelint: ${{ steps.select-runner.outputs.runner_prelint }}
      runner-prelint-arm64: ${{ steps.select-runner.outputs.runner_prelint_arm64 }}
      use-blacksmith: ${{ steps.select-runner.outputs.use_blacksmith }}
      use-blacksmith-amd64: ${{ steps.select-runner.outputs.use_blacksmith_amd64 }}
      use-blacksmith-arm64: ${{ steps.select-runner.outputs.use_blacksmith_arm64 }}
      backlog-count: ${{ steps.select-runner.outputs.backlog_count }}
      # Gates CCACHE_REMOTE_AUTH for the src-* jobs. Their secrets: mapping is
      # resolved before a job reaches a runner, so a run that fails this gate
      # is handed an empty value rather than a credential it could read.
      cache-write: ${{ steps.select-runner.outputs.cache_write }}
      decision-reason: ${{ steps.select-runner.outputs.decision_reason }}
      base-image-digest: ${{ steps.base-image.outputs.digest }}
      runner-check-skip: ${{ vars.RUNNER_CHECK_SKIP || 'ubuntu-24.04-arm' }}
      ci-context-tag: ${{ steps.ci-images.outputs.context_tag }}
      existing-runner-image: ${{ steps.ci-images.outputs.runner_image }}
      existing-slim-image: ${{ steps.ci-images.outputs.slim_image }}
    steps:
      - name: Check skip environment variables
        id: skip-check
        run: |
          if [[ "${{ github.event_name }}" == "push" && "${{ vars.SKIP_ON_PUSH }}" != "" ]]; then
            echo "Skipping build on push due to SKIP_ON_PUSH environment variable"
            echo "skip=true" >> $GITHUB_OUTPUT
          elif [[ "${{ github.event_name }}" == "pull_request_target" && "${{ vars.SKIP_ON_PR }}" != "" ]]; then
            echo "Skipping build on pull request due to SKIP_ON_PR environment variable"
            echo "skip=true" >> $GITHUB_OUTPUT
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi

      - name: Checkout code
        if: ${{ steps.skip-check.outputs.skip == 'false' }}
        uses: actions/checkout@v6

      - name: Select runners
        id: select-runner
        if: ${{ steps.skip-check.outputs.skip == 'false' }}
        env:
          BACKLOG_THRESHOLD: "10"
          BACKLOG_THRESHOLD_ARM64: "30"
          GH_TOKEN: ${{ github.token }}
          RUNNER_AMD64_VAR: ${{ vars.RUNNER_AMD64 }}
          RUNNER_ARM64_VAR: ${{ vars.RUNNER_ARM64 }}
          # Self-hosted rung for the pre-lint jobs (lint, cache-sources, the
          # container builds and manifests). All but the manifest run pull
          # request head code, so all of them are offered our own hardware only
          # for the logins in SELFHOSTED_LINT_AUTHORS. Unset RUNNER_SELFHOSTED
          # or RUNNER_SELFHOSTED_ARM64 to send that arch back to the
          # hosted/Blacksmith ladder; the long builds and tests never use it.
          RUNNER_SELFHOSTED_VAR: ${{ vars.RUNNER_SELFHOSTED }}
          RUNNER_SELFHOSTED_ARM64_VAR: ${{ vars.RUNNER_SELFHOSTED_ARM64 }}
          SELFHOSTED_LINT_AUTHORS: ${{ vars.SELFHOSTED_LINT_AUTHORS }}
          # Fall back to hosted once more jobs than this wait for a self-hosted label
          SELFHOSTED_MAX_QUEUED: "6"
        run: |
          python3 .github/workflows/select_dynamic_runner.py

      - name: Get base image digest
        id: base-image
        if: ${{ steps.skip-check.outputs.skip == 'false' }}
        run: |
          # Fetch the canonical manifest digest for ubuntu:noble so the
          # depends cache key changes when Canonical pushes base image
          # updates (which may bump compiler versions).
          # Falls back to "unknown" on failure so CI is not blocked.
          TOKEN="$(curl -fsSL --max-time 10 \
            'https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/ubuntu:pull' \
            | jq -r '.token')" || true
          if [ -n "$TOKEN" ] && [ "$TOKEN" != "null" ]; then
            DIGEST="$(curl -fsSL --max-time 10 \
              -H "Authorization: Bearer $TOKEN" \
              -H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' \
              'https://registry-1.docker.io/v2/library/ubuntu/manifests/noble' \
              -o /dev/null -D - | grep -i docker-content-digest | awk '{print $2}' | tr -d '\r' | sed 's/^sha256://')" || true
          fi
          echo "digest=${DIGEST:-unknown}" >> "$GITHUB_OUTPUT"

      - name: Find existing CI containers
        id: ci-images
        if: ${{ steps.skip-check.outputs.skip == 'false' }}
        # Reads the commit under test only through the API, never checks it
        # out. A failure here only means the containers get built.
        continue-on-error: true
        timeout-minutes: 2
        env:
          BASE_IMAGE_DIGEST: ${{ steps.base-image.outputs.digest }}
          GH_TOKEN: ${{ github.token }}
          SKIP_CI_IMAGE_REUSE: ${{ vars.SKIP_CI_IMAGE_REUSE }}
        run: |
          python3 .github/workflows/resolve_ci_images.py

  cache-sources:
    name: Cache depends sources
    needs: [check-skip]
    if: ${{ needs.check-skip.outputs.skip == 'false' }}
    uses: ./.github/workflows/cache-depends-sources.yml
    with:
      runs-on: ${{ needs.check-skip.outputs['runner-prelint'] }}

  # Pushes build the trusted-* images that later runs reuse, so they stay on
  # GitHub's runners; only pull request builds use the pre-lint runners.
  container:
    permissions:
      contents: read
      packages: write
    name: Build container
    needs: [check-skip]
    if: ${{ needs.check-skip.outputs.skip == 'false' }}
    uses: ./.github/workflows/build-container.yml
    with:
      context: ./contrib/containers/ci
      file: ./contrib/containers/ci/ci.Dockerfile
      name: dashcore-ci-runner
      runs-on-amd64: ${{ github.event_name == 'push' && needs.check-skip.outputs['runner-amd64'] || needs.check-skip.outputs['runner-prelint'] }}
      runs-on-arm64: ${{ github.event_name == 'push' && needs.check-skip.outputs['runner-arm64'] || needs.check-skip.outputs['runner-prelint-arm64'] }}
      runs-on-manifest: ${{ github.event_name == 'push' && needs.check-skip.outputs['runner-arm64'] || needs.check-skip.outputs['runner-prelint'] }}
      existing-image: ${{ needs.check-skip.outputs['existing-runner-image'] }}
      runs-on-existing: ${{ needs.check-skip.outputs['runner-check-skip'] }}
      context-tag: ${{ needs.check-skip.outputs['ci-context-tag'] }}

  container-slim:
    permissions:
      contents: read
      packages: write
    name: Build slim container
    needs: [check-skip]
    if: ${{ needs.check-skip.outputs.skip == 'false' }}
    uses: ./.github/workflows/build-container.yml
    with:
      context: ./contrib/containers/ci
      file: ./contrib/containers/ci/ci-slim.Dockerfile
      name: dashcore-ci-slim
      runs-on-amd64: ${{ github.event_name == 'push' && needs.check-skip.outputs['runner-amd64'] || needs.check-skip.outputs['runner-prelint'] }}
      runs-on-arm64: ${{ github.event_name == 'push' && needs.check-skip.outputs['runner-arm64'] || needs.check-skip.outputs['runner-prelint-arm64'] }}
      runs-on-manifest: ${{ github.event_name == 'push' && needs.check-skip.outputs['runner-arm64'] || needs.check-skip.outputs['runner-prelint'] }}
      existing-image: ${{ needs.check-skip.outputs['existing-slim-image'] }}
      runs-on-existing: ${{ needs.check-skip.outputs['runner-check-skip'] }}
      context-tag: ${{ needs.check-skip.outputs['ci-context-tag'] }}

  depends-aarch64-linux:
    name: aarch64-linux-gnu
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: ${{ vars.SKIP_ARM_LINUX == '' }}
    with:
      build-target: aarch64-linux
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  depends-linux64:
    name: x86_64-pc-linux-gnu
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: |
      vars.SKIP_LINUX64 == '' ||
      vars.SKIP_LINUX64_ASAN == '' ||
      vars.SKIP_LINUX64_FUZZ == '' ||
      vars.SKIP_LINUX64_SQLITE == ''
    with:
      build-target: linux64
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  depends-linux64_multiprocess:
    name: linux64_multiprocess
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: |
      vars.SKIP_LINUX64_MULTIPROCESS == '' ||
      vars.SKIP_LINUX64_TSAN == ''
    with:
      build-target: linux64_multiprocess
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}

  depends-linux64_nowallet:
    name: x86_64-pc-linux-gnu_nowallet
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: ${{ vars.SKIP_LINUX64_NOWALLET == '' }}
    with:
      build-target: linux64_nowallet
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  depends-mac:
    name: x86_64-apple-darwin
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: ${{ vars.SKIP_MAC == '' }}
    with:
      build-target: mac
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  depends-win64:
    name: x86_64-w64-mingw32
    uses: ./.github/workflows/build-depends.yml
    needs: [check-skip, container, cache-sources]
    if: ${{ vars.SKIP_WIN64 == '' }}
    with:
      build-target: win64
      container-path: ${{ needs.container.outputs.path }}
      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}

  lint:
    name: Lint
    uses: ./.github/workflows/lint.yml
    needs: [check-skip, container-slim]
    with:
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-prelint'] }}

  src-aarch64-linux:
    name: aarch64-linux-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-aarch64-linux]
    with:
      build-target: aarch64-linux
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-aarch64-linux.outputs.key }}
      depends-host: ${{ needs.depends-aarch64-linux.outputs.host }}
      depends-dep-opts: ${{ needs.depends-aarch64-linux.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-aarch64-linux.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
    secrets: &remote-ccache-auth
      CCACHE_REMOTE_AUTH: ${{ needs.check-skip.outputs.cache-write == 'true' && secrets.CCACHE_REMOTE_AUTH || '' }}

  src-linux64:
    name: linux64-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64]
    if: ${{ vars.SKIP_LINUX64 == '' }}
    with:
      build-target: linux64
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64.outputs.key }}
      depends-host: ${{ needs.depends-linux64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-linux64.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
    secrets: *remote-ccache-auth

  src-linux64_asan:
    name: linux64_asan-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64]
    if: ${{ vars.SKIP_LINUX64_ASAN == '' }}
    with:
      build-target: linux64_asan
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64.outputs.key }}
      depends-host: ${{ needs.depends-linux64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-linux64.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
    secrets: *remote-ccache-auth

  src-linux64_fuzz:
    name: linux64_fuzz-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64]
    if: ${{ vars.SKIP_LINUX64_FUZZ == '' }}
    with:
      build-target: linux64_fuzz
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64.outputs.key }}
      depends-host: ${{ needs.depends-linux64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-linux64.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
    secrets: *remote-ccache-auth

  src-linux64_multiprocess:
    name: linux64_multiprocess-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64_multiprocess, lint]
    if: ${{ vars.SKIP_LINUX64_MULTIPROCESS == '' }}
    with:
      build-target: linux64_multiprocess
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64_multiprocess.outputs.key }}
      depends-host: ${{ needs.depends-linux64_multiprocess.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64_multiprocess.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-linux64_multiprocess.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
    secrets: *remote-ccache-auth

  src-linux64_nowallet:
    name: linux64_nowallet-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64_nowallet]
    with:
      build-target: linux64_nowallet
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64_nowallet.outputs.key }}
      depends-host: ${{ needs.depends-linux64_nowallet.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64_nowallet.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-linux64_nowallet.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
    secrets: *remote-ccache-auth

  src-linux64_sqlite:
    name: linux64_sqlite-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64]
    if: ${{ vars.SKIP_LINUX64_SQLITE == '' }}
    with:
      build-target: linux64_sqlite
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64.outputs.key }}
      depends-host: ${{ needs.depends-linux64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-linux64.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
    secrets: *remote-ccache-auth

  src-linux64_tsan:
    name: linux64_tsan-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-linux64_multiprocess]
    if: ${{ vars.SKIP_LINUX64_TSAN == '' }}
    with:
      build-target: linux64_tsan
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-linux64_multiprocess.outputs.key }}
      depends-host: ${{ needs.depends-linux64_multiprocess.outputs.host }}
      depends-dep-opts: ${{ needs.depends-linux64_multiprocess.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-linux64_multiprocess.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
    secrets: *remote-ccache-auth

  src-mac:
    name: mac-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-mac]
    with:
      build-target: mac
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-mac.outputs.key }}
      depends-host: ${{ needs.depends-mac.outputs.host }}
      depends-dep-opts: ${{ needs.depends-mac.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-mac.outputs.built-artifact }}
      sdk-artifact: ${{ needs.depends-mac.outputs.sdk-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
    secrets: *remote-ccache-auth

  src-win64:
    name: win64-build
    uses: ./.github/workflows/build-src.yml
    needs: [check-skip, container, depends-win64]
    with:
      build-target: win64
      container-path: ${{ needs.container.outputs.path }}
      depends-key: ${{ needs.depends-win64.outputs.key }}
      depends-host: ${{ needs.depends-win64.outputs.host }}
      depends-dep-opts: ${{ needs.depends-win64.outputs.dep-opts }}
      depends-artifact: ${{ needs.depends-win64.outputs.built-artifact }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
    secrets: *remote-ccache-auth

  test-linux64:
    name: linux64-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64, lint]
    if: needs.src-linux64.outputs.freshness != 'superseded' && needs.lint.outputs.freshness != 'superseded'
    with:
      bundle-key: ${{ needs.src-linux64.outputs.key }}
      build-target: linux64
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
      cancel-stale: ${{ needs.src-linux64.outputs.freshness == 'current' && needs.lint.outputs.freshness == 'current' }}

  test-linux64_asan:
    name: linux64_asan-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_asan, lint]
    if: needs.src-linux64_asan.outputs.freshness != 'superseded' && needs.lint.outputs.freshness != 'superseded'
    with:
      bundle-key: ${{ needs.src-linux64_asan.outputs.key }}
      build-target: linux64_asan
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
      cancel-stale: ${{ needs.src-linux64_asan.outputs.freshness == 'current' && needs.lint.outputs.freshness == 'current' }}

  test-linux64_multiprocess:
    name: linux64_multiprocess-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_multiprocess, lint]
    if: needs.src-linux64_multiprocess.outputs.freshness != 'superseded' && needs.lint.outputs.freshness != 'superseded'
    with:
      bundle-key: ${{ needs.src-linux64_multiprocess.outputs.key }}
      build-target: linux64_multiprocess
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
      cancel-stale: ${{ needs.src-linux64_multiprocess.outputs.freshness == 'current' && needs.lint.outputs.freshness == 'current' }}

  test-linux64_nowallet:
    name: linux64_nowallet-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_nowallet, lint]
    if: needs.src-linux64_nowallet.outputs.freshness != 'superseded' && needs.lint.outputs.freshness != 'superseded'
    with:
      bundle-key: ${{ needs.src-linux64_nowallet.outputs.key }}
      build-target: linux64_nowallet
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
      cancel-stale: ${{ needs.src-linux64_nowallet.outputs.freshness == 'current' && needs.lint.outputs.freshness == 'current' }}

  test-linux64_sqlite:
    name: linux64_sqlite-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_sqlite, lint]
    if: needs.src-linux64_sqlite.outputs.freshness != 'superseded' && needs.lint.outputs.freshness != 'superseded'
    with:
      bundle-key: ${{ needs.src-linux64_sqlite.outputs.key }}
      build-target: linux64_sqlite
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
      cancel-stale: ${{ needs.src-linux64_sqlite.outputs.freshness == 'current' && needs.lint.outputs.freshness == 'current' }}

  test-linux64_tsan:
    name: linux64_tsan-test
    uses: ./.github/workflows/test-src.yml
    needs: [check-skip, container-slim, src-linux64_tsan, lint]
    if: needs.src-linux64_tsan.outputs.freshness != 'superseded' && needs.lint.outputs.freshness != 'superseded'
    with:
      bundle-key: ${{ needs.src-linux64_tsan.outputs.key }}
      build-target: linux64_tsan
      container-path: ${{ needs.container-slim.outputs.path }}
      runs-on: ${{ needs.check-skip.outputs['runner-arm64'] }}
      cancel-stale: ${{ needs.src-linux64_tsan.outputs.freshness == 'current' && needs.lint.outputs.freshness == 'current' }}

  prune-ccache:
    name: Prune old ccache generations
    # Each develop push saves a new ccache/ctcache entry per target; keep only
    # the newest so the 10 GB repository cache stops evicting fresh ones.
    needs: [src-aarch64-linux, src-linux64, src-linux64_asan, src-linux64_fuzz, src-linux64_multiprocess, src-linux64_nowallet, src-linux64_sqlite, src-linux64_tsan, src-mac, src-win64]
    if: |
      !cancelled() &&
      github.event_name == 'push' &&
      github.ref_name == github.event.repository.default_branch
    runs-on: ubuntu-24.04-arm
    permissions:
      actions: write
    steps:
      - name: Delete all but the newest entry per target
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          REF: ${{ github.ref }}
        run: |
          for prefix in ccache ctcache; do
            gh cache list --ref "${REF}" --key "${prefix}-" --sort created_at --order desc \
              --limit 1000 --json id,key \
              | jq -r --arg p "${prefix}" '
                  map(.target = (.key | capture("^" + $p + "-[0-9a-f]{64}-(?<t>.+)-[0-9a-f]{40}$").t))
                  | group_by(.target)[][1:][] | "\(.id) \(.key)"' \
              | while read -r id key; do
                  echo "Deleting ${key}"
                  # A concurrent prune may have deleted it already.
                  gh cache delete "${id}" || true
                done
          done