Observed
Since #336 landed, any PR whose head lives on a fork fails clippy and test before compiling anything:
sccache: error: Server startup failed: cache storage failed to read: … send http request
url: https://.r2.cloudflarestorage.com/shepherd-sccache/ci/rust-1.94/.sccache_check
^^ empty account-ID segment
… dns error: failed to lookup address information: Name does not resolve
Live confirmation pair (both pushed today, same CI):
Root cause
ci.yml sets the sccache backend unconditionally at the workflow level:
RUSTC_WRAPPER: sccache
SCCACHE_ENDPOINT: https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com
AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
…GitHub does not expose repo secrets to pull_request runs from forks, so R2_ACCOUNT_ID interpolates to empty, the endpoint is a nonexistent host, and sccache's server refuses to start — taking the whole job with it.
Impact
All currently-open fork-headed PRs are hard-red on their next push: #170, #171, #220, #307 (bleu), plus jean-neiverth's #162/#164/#168 and ribeirojose's #172 (their current green checks predate #336). External contributors are blocked entirely.
Suggested fix
Fail open when the secret is absent — e.g. a job-level guard that only enables the wrapper when credentials exist:
env:
RUSTC_WRAPPER: ${{ secrets.R2_ACCOUNT_ID != '' && 'sccache' || '' }}(or equivalently gate the SCCACHE_*/AWS_* block behind the same condition, letting fork PRs build uncached). Fork PRs are exactly the runs where a shared write-capable cache shouldn't be reachable anyway, so uncached-but-green is the right degradation.
Observed
Since #336 landed, any PR whose head lives on a fork fails
clippyandtestbefore compiling anything:Live confirmation pair (both pushed today, same CI):
nullislabs/shepherd) — clippy + test pass, sccache works.bleu/nullis-shepherd) — both jobs fail at sccache startup (run 29339915898).Root cause
ci.ymlsets the sccache backend unconditionally at the workflow level:GitHub does not expose repo secrets to
pull_requestruns from forks, soR2_ACCOUNT_IDinterpolates to empty, the endpoint is a nonexistent host, and sccache's server refuses to start — taking the whole job with it.Impact
All currently-open fork-headed PRs are hard-red on their next push: #170, #171, #220, #307 (bleu), plus jean-neiverth's #162/#164/#168 and ribeirojose's #172 (their current green checks predate #336). External contributors are blocked entirely.
Suggested fix
Fail open when the secret is absent — e.g. a job-level guard that only enables the wrapper when credentials exist:
(or equivalently gate the
SCCACHE_*/AWS_*block behind the same condition, letting fork PRs build uncached). Fork PRs are exactly the runs where a shared write-capable cache shouldn't be reachable anyway, so uncached-but-green is the right degradation.