[A-1638] Establish uncached Agent CI baseline

.buildkite/cache.yml

@@ -0,0 +1,166 @@
+# Cache v2 definitions for the Agent's own CI.
+#
+# Every key ends at the dependency checksum and carries no per-commit part, so
+# an unchanged dependency graph resolves to an exact key. That matters on save
+# as much as on restore: `cache save` skips building and uploading an archive
+# when the exact key already exists, whereas a key containing the commit can
+# never match and so re-uploads on every job of every build. The trade is that
+# an entry is sealed until dependencies change, leaving packages that drift in
+# between to be recompiled -- correct, via Go's content-addressed build cache,
+# but not free.
+#
+# fallback_limit marks where matching may stop: parts after it are optional on
+# restore, so a dependency bump still lands on a compatible entry.
+#
+# One producer per key, and the producer must leave behind what the consumers
+# need. Exact keys make saves free but remove accumulation: once an entry
+# exists it is frozen until the checksum changes, so a key with two
+# differently-shaped producers keeps whichever one happened to win the first
+# build after a dependency bump, and no later build can add to it. Jobs that
+# compile this module but leave different artifacts behind therefore get
+# separate keys rather than sharing one.
+#
+# Checksums use go.mod, not go.sum, which would be redundant here.
+caches:
+  - name: gomodcache
+    # Prefer an exact go.mod match, while allowing a compatible cache from the
+    # same OS, architecture, and Go version as a fallback.
+    cache_key:
+      - agent-go-modules-v1
+      - { agent: os }
+      - { agent: arch }
+      - { env: AGENT_GO_VERSION, fallback_limit: true }
+      - { checksum: go.mod }
+    target_paths:
+      - ~/.gomodcache
+
+  - name: gocache
+    # Owned by shard 0 of each platform's test job, which is also the only
+    # consumer: a test run leaves compiled test binaries behind, which nothing
+    # else here produces. Lint has its own key for the same reason -- see
+    # lint_gocache.
+    cache_key:
+      - agent-go-build-v2
+      - { agent: os }
+      - { agent: arch }
+      - { env: AGENT_GO_VERSION, fallback_limit: true }
+      - { checksum: go.mod }
+    target_paths:
+      - ~/.gocache
+
+  - name: gocache_race
+    # Race objects compile to different build hashes. Go would keep them apart
+    # within one directory, but a separate cache gives the race job its own key
+    # and therefore its own single writer.
+    cache_key:
+      - agent-go-build-race-v2
+      - { agent: os }
+      - { agent: arch }
+      - { env: AGENT_GO_VERSION, fallback_limit: true }
+      - { checksum: go.mod }
+    target_paths:
+      - ~/.gocache_race
+
+  - name: lint_gocache
+    # Owned and consumed by the lint step alone. It runs custom analyzers whose
+    # results are cached under their own action IDs, and nothing else in the
+    # pipeline runs them, so a cache written by any other job sends lint back to
+    # analysing the module from scratch. Only ever built on one platform, but
+    # keyed by os/arch anyway so it cannot be shared across queues by accident.
+    cache_key:
+      - agent-go-build-lint-v1
+      - { agent: os }
+      - { agent: arch }
+      - { env: AGENT_GO_VERSION, fallback_limit: true }
+      - { checksum: go.mod }
+    target_paths:
+      - ~/.gocache-lint
+
+  - name: target_gocache
+    # Cross-compiled objects are reusable only for the same target and build
+    # mode, so the target is the key. The agent's own os/arch belongs there
+    # too: the cache also holds host-compiled tool artifacts, which two
+    # builder architectures sharing one key would thrash.
+    cache_key:
+      - agent-go-target-build-v2
+      - { agent: os }
+      - { agent: arch }
+      - { env: TARGET_GOOS }
+      - { env: TARGET_GOARCH }
+      - { env: TARGET_GOARM }
+      - { env: TARGET_BUILD_MODE }
+      - { env: TARGET_GO_VERSION, fallback_limit: true }
+      - { checksum: go.mod }
+    target_paths:
+      - ~/.gocache-target
+
+  - name: acknowledgements
+    # The generated attributions file is a pure function of the dependency
+    # graph and the build target, so it is cached rather than regenerated for
+    # every target. go-licenses output varies by GOOS/GOARCH (see
+    # google/go-licenses#187), hence the target in the key -- as the matrix
+    # labels rather than the normalised values, which over-partitions (arm and
+    # armhf get identical entries) but can never under-partition. Every key part
+    # is mandatory because reusing an attribution file from a different go.mod
+    # could omit newly added dependencies.
+    cache_key:
+      - agent-acknowledgements-v1
+      - { env: TARGET_GOOS }
+      - { env: TARGET_GOARCH }
+      - { env: TARGET_GO_VERSION }
+      - { checksum: go.mod }
+    target_paths:
+      - clicommand/ACKNOWLEDGEMENTS.md.gz
+
+  - name: e2e_gomodcache
+    # The triggered E2E pipeline has one job, so it can safely own both its
+    # module cache and its compiled test cache without competing writers. Both
+    # are separate from the main pipeline's caches so the job transfers only
+    # its own dependencies.
+    cache_key:
+      - agent-e2e-go-modules-v1
+      - { agent: os }
+      - { agent: arch }
+      - { env: E2E_GO_VERSION, fallback_limit: true }
+      - { checksum: go.mod }
+    target_paths:
+      - ~/.e2e-gomodcache
+
+  - name: e2e_gocache
+    # Compiled E2E test objects, under the same single-writer ownership as the
+    # module cache above.
+    cache_key:
+      - agent-e2e-go-build-v2
+      - { agent: os }
+      - { agent: arch }
+      - { env: E2E_GO_VERSION, fallback_limit: true }
+      - { checksum: go.mod }
+    target_paths:
+      - ~/.e2e-gocache
+
+  - name: bk_cli
+    # The pinned bk executable is immutable for a Go target. Cache only the
+    # installed binary instead of restoring the Agent repository's Go caches.
+    cache_key:
+      - bk-cli-v1
+      - { env: BK_CLI_COMMIT }
+      - { env: BK_CLI_GOOS }
+      - { env: BK_CLI_GOARCH }
+    target_paths:
+      - ~/.bk-cli/bin
+
+  - name: protobuf_tools
+    # Cache the installed protobuf tools as well as the Go caches used to build
+    # them. Any toolchain or tool version change gets a fresh entry.
+    cache_key:
+      - protobuf-tools-v1
+      - { agent: os }
+      - { agent: arch }
+      - { env: PROTOBUF_GO_VERSION }
+      - { env: PROTOBUF_BUF_VERSION }
+      - { env: PROTOBUF_PROTOC_GEN_GO_VERSION }
+      - { env: PROTOBUF_PROTOC_GEN_CONNECT_GO_VERSION }
+    target_paths:
+      - ~/.protobuf-tools/bin
+      - ~/.protobuf-tools/gocache
+      - ~/.protobuf-tools/gomodcache

.buildkite/docker-compose.yml

@@ -5,29 +5,20 @@ services:
       dockerfile: Dockerfile-lint
     volumes:
       - ../:/work:cached
-      - ~/gocache:/gocache
-      - ~/gomodcache:/gomodcache
     working_dir: /work
-    environment:
-      - GOCACHE=/gocache
-      - GOMODCACHE=/gomodcache
 
   agent:
     build:
       context: .
       dockerfile: Dockerfile-compile
     volumes:
       - ../:/work:cached
-      - ~/gocache:/gocache
-      - ~/gomodcache:/gomodcache
     working_dir: /work
     environment:
       - BUILDKITE_BUILD_NUMBER
       - BUILDKITE_JOB_ID
       - "BUILDKITE_AGENT_TAGS=queue=default"
       - "BUILDKITE_BUILD_PATH=/buildkite"
-      - GOCACHE=/gocache
-      - GOMODCACHE=/gomodcache
       - BUILDKITE_TEST_ENGINE_API_ACCESS_TOKEN
 
   e2e:

.buildkite/pipeline.e2e.yml

@@ -1,3 +1,7 @@
+env:
+  BUILDKITE_AGENT_CACHE_REGISTRY: "agent-cache"
+  BUILDKITE_AGENT_CACHE_STORE_URL: "s3://bk-agent-cache-v2-dogfood-445615400570-us-east-1?region=us-east-1"
+
 agents:
   queue: agent-runners-linux-amd64
 
@@ -9,13 +13,27 @@ steps:
       - CI_E2E_TESTS_AGENT_TOKEN
       - CI_E2E_TESTS_ANALYTICS_TOKEN
     plugins:
+      - aws-assume-role-with-web-identity#v1.4.0:
+          role_arn: "arn:aws:iam::445615400570:role/pipeline-buildkite-agent"
+          session-tags:
+            - organization_slug
+            - organization_id
+            - pipeline_slug
       - docker-compose#v4.14.0:
           config: .buildkite/docker-compose.yml
           cli-version: 2
           mount-buildkite-agent: true
           run: e2e
+          env:
+            - BUILDKITE_AGENT_ACCESS_TOKEN
+            - BUILDKITE_AGENT_CACHE_REGISTRY
+            - BUILDKITE_AGENT_CACHE_STORE_URL
+            - AWS_ACCESS_KEY_ID
+            - AWS_SECRET_ACCESS_KEY
+            - AWS_SESSION_TOKEN
+            - BUILDKITE_BRANCH
+            - BUILDKITE_COMMIT
       - test-collector#v1.11.0:
           files: "junit.xml"
           format: "junit"
           api-token-env-name: CI_E2E_TESTS_ANALYTICS_TOKEN
-