Use local S3 cache for shared-downloads

Signed-off-by: Kyle Harding <[email protected]>

.github/workflows/yocto-build-deploy.yml

@@ -522,11 +522,32 @@ jobs:
           EOF
           cat "${AUTO_CONF_FILE}"
 
-      # Use local S3 cache on self-hosted runners, but allow fallback to the default GitHub cache.
+      # Use local S3 cache on self-hosted runners
+      # https://github.com/tespkg/actions-cache
+      # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
+      - name: Restore downloads cache
+        id: downloads-restore
+        uses: tespkg/actions-cache/[email protected]
+        with:
+          endpoint: minio
+          port: 9000
+          insecure: "true"
+          accessKey: yocto-svcacct
+          secretKey: ${{ secrets.YOCTO_CACHE_SECRET_KEY }}
+          bucket: yocto-cache
+          region: local
+          use-fallback: ${{ github.event.repository.private != true }}
+          key: ${{ inputs.machine }}-downloads-${{ github.sha }}
+          restore-keys: |
+            ${{ inputs.machine }}-downloads-
+          path: |
+            ${{ github.workspace }}/shared/shared-downloads
+
+      # Use local S3 cache on self-hosted runners
       # https://github.com/tespkg/actions-cache
       # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
       - name: Restore sstate cache
-        id: cache-restore
+        id: sstate-restore
         uses: tespkg/actions-cache/[email protected]
         with:
           endpoint: minio
@@ -538,10 +559,10 @@ jobs:
           region: local
           use-fallback: ${{ github.event.repository.private != true }}
           key: ${{ inputs.machine }}-sstate-${{ github.sha }}
-          path: |
-            ${{ github.workspace }}/shared/${{ inputs.machine }}/sstate
           restore-keys: |
             ${{ inputs.machine }}-sstate-
+          path: |
+            ${{ github.workspace }}/shared/${{ inputs.machine }}/sstate
 
       # All preperation complete before this step
       # Start building balenaOS
@@ -580,16 +601,40 @@ jobs:
           fi
 
       # If there was a cache miss for this key, save a new cache.
-      # Use local S3 cache on self-hosted runners, but allow fallback to the default GitHub cache.
+      # Use local S3 cache on self-hosted runners.
+      # https://github.com/tespkg/actions-cache
+      # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
+      - name: Save downloads cache
+        uses: tespkg/actions-cache/[email protected]
+        # Do not save cache for pull_request_target events
+        # as they run in the context of the main branch and would be vulnerable to cache poisoning.
+        # https://0xn3va.gitbook.io/cheat-sheets/ci-cd/github/actions#cache-poisoning
+        # https://adnanthekhan.com/2024/05/06/the-monsters-in-your-build-cache-github-actions-cache-poisoning/
+        if: steps.downloads-restore.outputs.cache-hit != true && github.event_name != 'pull_request_target'
+        with:
+          endpoint: minio
+          port: 9000
+          insecure: "true"
+          accessKey: yocto-svcacct
+          secretKey: ${{ secrets.YOCTO_CACHE_SECRET_KEY }}
+          bucket: yocto-cache
+          region: local
+          use-fallback: ${{ github.event.repository.private != true }}
+          key: ${{ inputs.machine }}-downloads-${{ github.sha }}
+          path: |
+            ${{ github.workspace }}/shared/shared-downloads
+
+      # If there was a cache miss for this key, save a new cache.
+      # Use local S3 cache on self-hosted runners.
       # https://github.com/tespkg/actions-cache
       # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
-      - name: Save actions cache
+      - name: Save sstate cache
         uses: tespkg/actions-cache/[email protected]
         # Do not save cache for pull_request_target events
         # as they run in the context of the main branch and would be vulnerable to cache poisoning.
         # https://0xn3va.gitbook.io/cheat-sheets/ci-cd/github/actions#cache-poisoning
         # https://adnanthekhan.com/2024/05/06/the-monsters-in-your-build-cache-github-actions-cache-poisoning/
-        if: steps.cache-restore.outputs.cache-hit != true && github.event_name != 'pull_request_target'
+        if: steps.sstate-restore.outputs.cache-hit != true && github.event_name != 'pull_request_target'
         with:
           endpoint: minio
           port: 9000