feat(remote-cache): add self-hosted public cache server

[fengmk2]

Add packages/remote-cache for the server in #716, using Cloudflare Workers, primary D1 metadata, and a private R2 bucket. The server supports public reads and GitHub Actions OpenID Connect checks for writes. Stores use streaming uploads, atomic publication, storage limits, and automatic cleanup.

Cloudflare workflows deploy isolated PR previews and main-branch staging when related files change. PR comments report the tested commit and provide manual verification instructions. Closed PRs trigger resource cleanup. Deployment requires the remote-cache-staging environment and the documented repository variables.

The e2e plan defines automated checks and manual exercises. PR runs check public reads and rejected writes. Main-branch pushes also check authorized uploads, concurrent 64 MiB blobs, and real Cron cleanup. The shared test driver also runs locally against workerd.

/fetch returns 404 when neither key resolves to a live entry. /blob/{blob_id} returns 404 for unavailable blobs. These responses use plain text, as specified in the local RFC. A missing or unreadable value for a live entry returns 503.

Workers Free CPU support remains unverified. The guide recommends Workers Paid for the full payload limits.

Motivation

Maintainers need a cache service in their own Cloudflare account. Developers and fork contributors must reuse public task results without login. Only trusted main-branch jobs should publish those results. Reviewers need an isolated deployment and a clear verification result after each related change.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​esbuild@​0.28.1
	npm/​tsx@​4.23.13
	npm/​jsonc-parser@​3.3.1
	npm/​wrangler@​4.131.1
	npm/​jose@​6.2.12
	npm/​cborg@​6.1.2
	npm/​miniflare@​5.20260911.0-alpha

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.33%  [-13.68% .. +15.31%]  overhead  +264.52%
dynamic/access             change  -0.09%  [ -1.33% ..  +1.57%]  overhead    +7.16%
dynamic/access-relative    change  +0.07%  [ -0.74% ..  +1.26%]  overhead   +53.32%
dynamic/access-contended   change  +0.20%  [ -6.33% ..  +2.79%]  overhead    +8.96%
static/launch              change  +0.34%  [ -9.95% ..  +9.55%]  overhead  +641.37%
static/access              change  -0.52%  [ -3.39% ..  +2.56%]  overhead  +728.36%
static/access-relative     change  +0.13%  [ -1.74% ..  +1.61%]  overhead +1163.04%
static/access-contended    change  -0.99%  [ -8.15% ..  +3.97%]  overhead +2551.71%

macos

dynamic/launch             change  -0.15%  [ -5.27% ..  +6.16%]  overhead  +233.35%
dynamic/access             change  -0.52%  [-21.75% .. +48.00%]  overhead    +2.37%
dynamic/access-relative    change  -0.69%  [-48.89% .. +10.43%]  overhead  +253.12%
dynamic/access-contended   change  -0.25%  [ -4.39% .. +11.16%]  overhead    +2.95%

windows

dynamic/launch             change  +0.43%  [ -3.72% ..  +3.62%]  overhead   +25.94%
dynamic/access             change  +0.19%  [ -0.95% ..  +1.15%]  overhead    +1.33%
dynamic/access-relative    change  +0.38%  [ -0.38% ..  +0.95%]  overhead    +1.12%
dynamic/access-contended   change  +0.18%  [ -0.90% ..  +0.92%]  overhead    +1.11%

[github-actions]

Remote cache preview

Commit: 2dfe8b4b40790109281702f7e4afa685402e77bb

Cloudflare deployment is disabled. Configure the staging environment described in the e2e plan, then set REMOTE_CACHE_DEPLOY_ENABLED=true and rerun this workflow. No live deployment passed verification.

Manual checks and complete e2e plan.