Notable Changes
GitHub Enterprise Server (GHES) Support
The OIDC token issuer used to verify GitHub Actions tokens is now configurable via ACTIONS_TOKEN_ISSUER (default: https://token.actions.githubusercontent.com). This lets the cache server run against GitHub Enterprise Server instances, which serve their own Actions token issuer. Signature verification stays mandatory — the JWKS endpoint is derived from the configured issuer.
Prometheus Metrics
A new /metrics endpoint exposes basic Prometheus metrics, including default Node.js process metrics plus:
cache_requests_total{result="hit"|"miss"}— cache download-URL lookups by result (a restore-key prefix match counts as a hit)cache_uploads_total— uploads finalized into cache entries
ℹ️ Metrics are per-process. The shipped image runs a single worker per container (
NITRO_CLUSTER_WORKERS=1) — scale with replicas and aggregate in PromQL.
Protobuf / Twirp API Support
The server now handles the newer protobuf-encoded Twirp CacheService requests (CreateCacheEntry, FinalizeCacheEntryUpload, GetCacheEntryDownloadURL) in addition to JSON. This unblocks clients like sccache and newer actions/cache releases that speak protobuf.
Configurable S3 Request Timeout
The S3 socket timeout is now configurable via STORAGE_S3_SOCKET_TIMEOUT_MS (default: 10000, previously a hardcoded 3000). Helps with slower or higher-latency S3-compatible backends that were hitting spurious timeouts.
Storage Reliability Improvements
Two changes make concurrent upload/download/cleanup safer:
- Atomically visible uploads replace the old merge-promotion step, so a cache entry becomes visible only once its storage is fully written.
- Reader and merge leases protect active downloads, preventing cleanup jobs from deleting storage that an in-flight download is still reading.
⚠️ These should not break existing deployments. If you run into any issues, please feel free to create an issue.
Commits
✨ Enhancements
- configurable s3 request timeout - by @LouisHaftmann (4c2b1)
- protobuf support - by @LouisHaftmann (21b72)
- basic prometheus metrics - by @LouisHaftmann (609ed)
- GHES support - by @LouisHaftmann (56b0f)
- storage: protect active downloads with reader and merge leases - by @LouisHaftmann (8d9d1)
🐛 Fixes
- swallow client-aborted download errors after headers sent - by @colachg in #232 (d6ea4)
- handle dangling cache entries - by @LouisHaftmann (3246f)
- s3: iterate all pages for deletion/counting - by @LouisHaftmann (e89f0)
- storage: replace merge promotion with atomically visible uploads - by @LouisHaftmann (19c45)
🔧 Chore
- coding agent setup & docs - by @LouisHaftmann (c3527)
- release: v9.5.0 - (9833b)
📦 Build
- deps: upgrade deps - by @LouisHaftmann (2f046)
- docker: pnpm v11 - by @LouisHaftmann (873ac)
✅ Tests
- global unhandled request fallback - by @LouisHaftmann (7228d)
- cleanup-lifecycle: wait for download destroy - by @LouisHaftmann (eef5d)
🤖 CI
- release: bump helm chart version - by @LouisHaftmann (9e0f3)