ci: tolerate optional S3 cache export outages on v4.3-dev

[ktechmidas]

Issue being fixed or feature implemented

Backport the merged CI-only optional S3 cache-export repair #5165 to v4.3-dev. An unavailable optimization must not invalidate a successful build or image publication.

What was done?

• Exact two-file backport from merge 5f4ab6c2f98cf3c01f35a5ffa81f61957a4cd50f onto target 67340ad82406cb36147234bc46f6c572c78ecef9.
• Tolerate only Docker layer-cache export failures (ignore-error=true). Imports, architecture prefixes and explicit shared-writer opt-in remain unchanged.
• Keep compilation, application tests and registry publication failures fatal. No runner recipe, routing, credentials, access policy or application source changes.
• Separate infrastructure branch: no contributor PR was pushed, rebased, retargeted or rerun, and no live worker was changed.

How Has This Been Tested?

• Three executable Node-backed cache-action regression tests pass on this exact head.
• The same tests against the unmodified target action reproduce two expected failures.
• YAML/Python syntax and git diff --check pass; every non-.github root-tree object equals the exact target.
• CI and independent reviews remain required; local tests are not a claim of target adoption or real runner execution.

Author recovery guidance (after merge only)

If your exact failed step is optional S3 cache export, update your own PR from v4.3-dev after this repair lands and let the new head start CI. Re-running an unchanged old head does not adopt this action repair. This does not fix Android/sudo setup faults or application/test failures; those remain separate.

Breaking Changes

None. Existing image eligibility and legacy runner capacity are preserved.

Checklist

• I have performed a self-review of my own code
• I have commented non-obvious behavior
• I have added relevant CI unit regressions
• Independent reviews and protected merge gates complete

Authored and operated by infraclaw under latte's scoped CI authorization. Protected transport account attribution is not its owner's personal review or approval. No bypass or self-approval is requested.

Independently confirmed thread verification — 2026-09-29 17:08 UTC

Hosted discovery of the optional-cache regression suite (reviewer receipt4133563010).

The original independent reviewer explicitly answered Resolved on each finding and subsequently approved the current head. Infraclaw re-ran 3 focused regressions, which pass on unchanged fbbf13ee41f8bd8b9f03f1dc5afec6a619967d97; clean worktree and diff checks also pass. After those checks, only these already-confirmed findings were marked resolved in GitHub thread state, with an acknowledged mutation and a separate live readback for each. No substantive finding was discarded, no review was submitted or dismissed, and no approval/check/status was written.

The remaining independent review and ordinary PR Hygiene gates still apply; skipped CodeRabbit status is not completed coverage. This verification does not claim new runner capacity, application execution, target adoption, or permission to merge. Protected account attribution is infraclaw's authorized transport, not a personal review or approval by that account owner.

PR Hygiene · fbbf13e

• Bots — coderabbitai skipped after the window · thepastaclaw ✓
• Self-review — post /self-reviewed
• Build green
• Approvals — you own every area touched; none needed

When every merge requirement is met, the PR Hygiene check passes. Reviewer limits do not block merging; other required GitHub checks and protections still apply.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: a4dafd1f-aa72-4191-8124-06fc5b952cd7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit fbbf13e) · triage: low

[thepastaclaw]

Final validation — Phase 1 + Phase 2

At head 630580f, the two changed files match the cited upstream merge, and the action narrowly tolerates cache-export errors without changing imports or Docker publication wiring. All three regression tests and the diff whitespace check pass locally. One non-blocking gap remains: no workflow executes the newly added regression tests.

🟡 1 suggestion(s)

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: glm-5.3-flash (agent: phase1-reviewer, role: architecture-layering); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: low by gpt-6-astra (effort low) — The diff adds a single cache-export error-tolerance option to a CI action plus focused regression tests, making it a small, contained behavioral change with no critical-surface changes.
• Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer, glm-5.3-flash — architecture-layering (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 80% left, weekly 86% left; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 13% left, 5h 100% left)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `.github/scripts/tests/test_s3_layer_cache.py`:
- [SUGGESTION] .github/scripts/tests/test_s3_layer_cache.py:11-12: Wire the new cache-action regression tests into CI
  These tests pass locally, but no workflow discovers `.github/scripts/tests/`, so future regressions in the export-only tolerance will not produce a CI failure. The discovery command in `kotlin-sdk-build.yml` runs against repository-root `scripts/tests/`, a different directory; adding the cache action to that workflow's path filters alone would not execute these tests. Add a lightweight CI step running `python3 -m unittest discover -s .github/scripts/tests -p 'test_*.py'` with Python and Node available, and ensure it is triggered by changes to the cache action, the Docker action, and these tests.

[thepastaclaw]

Re-review — Final validation — Phase 1 + Phase 2

Verified the complete three-file diff at fbbf13e. Error tolerance is confined to S3 cache exports, and the new workflow resolves the previous CI coverage gap; all three regression tests and git diff --check pass locally. No actionable in-scope findings remain.

🔴 0 blocking | 🟡 0 suggestion(s) | 💬 0 nitpick(s)

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: architecture-layering); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 5: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: low by gpt-6-astra (effort low) — Small, well-contained CI configuration and regression-test changes that only make optional Docker layer-cache export failures non-fatal, with compilation, tests, and image publication remaining fatal.
• Phase 1 reviewers: glm-5.3-flash — architecture-layering (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 94% left, weekly 85% left; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 13% left, 5h 100% left)
• Fresh final gate: an independent Phase-2 review ran after iterative findings were reconciled
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer, gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify the current code and confirm that no unresolved issues remain.

No unresolved findings remain from the prior review on this head.

[github-actions]

Bots are done — your move: post /self-reviewed.
Full checklist in the description.