From 635cf61724987cb93bbd79d6b76e514ba0b407a8 Mon Sep 17 00:00:00 2001 From: Rusty Conover Date: Fri, 11 Sep 2026 10:28:06 -0400 Subject: [PATCH 1/2] Use direct R2 vcpkg cache --- .github/workflows/ci.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1ac6fb6..c3b299d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,12 +14,16 @@ concurrency: cancel-in-progress: true env: - VCPKG_BINARY_SOURCES: "clear;x-aws,s3://query-farm-duckdb-vcpkg/,readwrite" - AWS_ACCESS_KEY_ID: ${{ secrets.VCPKG_CACHING_AWS_ACCESS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.VCPKG_CACHING_AWS_SECRET_ACCESS_KEY }} - AWS_ENDPOINT_URL: ${{ secrets.VCPKG_CACHING_AWS_ENDPOINT_URL }} - AWS_DEFAULT_REGION: ${{ secrets.VCPKG_CACHING_AWS_DEFAULT_REGION }} + # Use Cloudflare's S3-compatible R2 endpoint directly because vcpkg binary + # archives can exceed the Worker request-size limit. Fork PRs do not receive + # secrets, so disable the remote cache instead of issuing broken AWS calls. + VCPKG_BINARY_SOURCES: "${{ secrets.R2_ACCESS_KEY_ID != '' && 'clear;x-aws,s3://query-farm-duckdb-vcpkg/,readwrite' || 'clear' }}" + AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_KEY_ID }} + AWS_ENDPOINT_URL: ${{ secrets.R2_ENDPOINT }} + AWS_DEFAULT_REGION: auto AWS_REQUEST_CHECKSUM_CALCULATION: when_required + AWS_RESPONSE_CHECKSUM_VALIDATION: when_required jobs: # Seconds, and it fails the run before anything is built: a formatting-only From b59576f2941034f64a630b51dade8d526bf70c28 Mon Sep 17 00:00:00 2001 From: Rusty Conover Date: Fri, 11 Sep 2026 10:38:24 -0400 Subject: [PATCH 2/2] Require complete R2 cache credentials --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c3b299d..7ff5054 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ env: # Use Cloudflare's S3-compatible R2 endpoint directly because vcpkg binary # archives can exceed the Worker request-size limit. Fork PRs do not receive # secrets, so disable the remote cache instead of issuing broken AWS calls. - VCPKG_BINARY_SOURCES: "${{ secrets.R2_ACCESS_KEY_ID != '' && 'clear;x-aws,s3://query-farm-duckdb-vcpkg/,readwrite' || 'clear' }}" + VCPKG_BINARY_SOURCES: "${{ secrets.R2_ACCESS_KEY_ID != '' && secrets.R2_SECRET_KEY_ID != '' && secrets.R2_ENDPOINT != '' && 'clear;x-aws,s3://query-farm-duckdb-vcpkg/,readwrite' || 'clear' }}" AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_KEY_ID }} AWS_ENDPOINT_URL: ${{ secrets.R2_ENDPOINT }}