[wan9chi]

Motivation

Vite+'s Cloudflare remote cache only accepts uploads with a GitHub Actions OIDC token. The token has to come from a push to the registered repository's main branch, and its audience has to be the endpoint. The file backend accepted any upload, so the e2e cases never sent a token and never exercised the client's OIDC support from #798.

Changes

• GitHub Actions stand-in. The backend process stands in for GitHub's token service. remote-cache-server run --github-actions runs a command as if in a job with id-token: write: it sets ACTIONS_ID_TOKEN_REQUEST_URL, and ACTIONS_ID_TOKEN_REQUEST_TOKEN defaults to main-push. The request token picks the workflow run the token is for: main-push or pull-request.
• Write policy. Like the Worker, the file backend checks each store's token: its RS256 signature against the stand-in's key, its time bounds, its audience, and its claims. It answers other stores as the Worker does, with 401 Invalid credentials or 403 Write not permitted.
• Uploading steps run with --github-actions. The only snapshot changes are those command lines.

Stacked on #808.

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are limited to test tooling (remote-cache-server) and e2e fixtures; production cache client code is only invoked more realistically in tests.

Overview
Aligns the remote-cache test backend with production by requiring a GitHub Actions OIDC token on POST /store (401/403 otherwise), while fetch/read stays unauthenticated.

A new --github-actions flag on remote-cache-server run simulates a job with id-token: write (ACTIONS_ID_TOKEN_REQUEST_URL / default main-push request token). The daemon’s control server exposes a /token endpoint that mints RS256 JWTs; backend.ts verifies signature, time bounds, audience (endpoint), and push-to-main claims before accepting stores. E2E upload steps and snapshot command lines now pass --github-actions so tests exercise the client OIDC path.

^{Reviewed by Cursor Bugbot for commit a31b6bf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.77%  [ -3.36% ..  +4.80%]  overhead   +61.04%
dynamic/access             change  -0.04%  [ -3.71% ..  +2.82%]  overhead   +21.03%
dynamic/access-relative    change  +0.26%  [ -2.88% ..  +3.52%]  overhead   +70.93%
dynamic/access-contended   change  +5.70%  [ -1.27% .. +10.85%]  overhead   +51.74%
static/launch              change  +0.43%  [ -4.18% ..  +4.87%]  overhead  +192.37%
static/access              change  -0.06%  [ -2.20% ..  +0.98%]  overhead +1436.85%
static/access-relative     change  -0.56%  [ -3.40% ..  +1.78%]  overhead +1923.70%
static/access-contended    change  +0.23%  [ -1.30% ..  +5.63%]  overhead +1917.05%

macos

dynamic/launch             change  +0.78%  [ -4.11% ..  +5.66%]  overhead  +251.55%
dynamic/access             change  -0.35%  [ -8.00% ..  +9.27%]  overhead    +2.55%
dynamic/access-relative    change  -2.55%  [-51.15% ..  +4.71%]  overhead  +250.13%
dynamic/access-contended   change  -2.23%  [-77.96% ..  +5.80%]  overhead    +3.61%

windows

dynamic/launch             change  -0.34%  [ -4.31% ..  +2.64%]  overhead   +25.90%
dynamic/access             change  +0.18%  [ -1.27% ..  +1.66%]  overhead    +1.82%
dynamic/access-relative    change  +0.00%  [ -1.40% ..  +1.80%]  overhead    +1.24%
dynamic/access-contended   change  -0.53%  [ -7.31% ..  +1.92%]  overhead    +1.60%