feat(remote-cache): add self-hosted public cache server

[fengmk2]

Add packages/remote-cache for the server in #716, using Cloudflare Workers, primary D1 metadata, and a private R2 bucket. The server supports public reads and GitHub Actions OpenID Connect checks for writes. Stores use streaming uploads, atomic publication, storage limits, and automatic cleanup.

Cloudflare workflows deploy isolated PR previews and main-branch staging when related files change. PR comments report the tested commit and provide manual verification instructions. Closed PRs trigger resource cleanup. Deployment requires the remote-cache-staging environment and the documented repository variables.

The e2e plan defines automated checks and manual exercises. PR runs check public reads and rejected writes. Main-branch pushes also check authorized uploads, concurrent 64 MiB blobs, and real Cron cleanup. The shared test driver also runs locally against workerd.

/fetch returns only { kind: "fallback", key } for fallback matches and does not read R2. Exact matches return the value and blob_id. A missing or unreadable exact value returns 503. Fetch misses and unavailable blobs return plain-text 404, as specified in the local RFC.

Setup rejects incompatible origins and repositories before it changes existing policies or saved configuration. Each Worker has separate rate-limit counters. These counters remain stable across revisions.

Workers Free CPU support remains unverified. The guide recommends Workers Paid for the full payload limits.

Motivation

Maintainers need a cache service in their own Cloudflare account. Developers and fork contributors must reuse public task results without login. Only trusted main-branch jobs should publish those results. Reviewers need an isolated deployment and a clear verification result after each related change.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​esbuild@​0.28.1
	npm/​tsx@​4.23.13
	npm/​jsonc-parser@​3.3.1
	npm/​wrangler@​4.131.1
	npm/​jose@​6.2.12
	npm/​cborg@​6.1.2
	npm/​miniflare@​5.20260911.0-alpha

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.49%  [-10.75% .. +12.48%]  overhead  +283.43%
dynamic/access             change  -1.47%  [-28.93% .. +34.03%]  overhead    +9.48%
dynamic/access-relative    change  -0.46%  [-19.55% .. +22.36%]  overhead   +62.47%
dynamic/access-contended   change  +1.76%  [ -9.22% .. +10.59%]  overhead   +13.24%
static/launch              change  +0.30%  [ -7.42% .. +11.71%]  overhead  +602.19%
static/access              change  +0.45%  [ -9.86% .. +11.16%]  overhead +1035.44%
static/access-relative     change  -0.17%  [ -4.40% ..  +4.76%]  overhead +1366.77%
static/access-contended    change  -2.33%  [-10.55% ..  +3.70%]  overhead +1827.82%

macos

windows

dynamic/launch             change  +2.87%  [-11.47% .. +14.66%]  overhead   +26.98%
dynamic/access             change  +1.07%  [ -6.52% .. +12.96%]  overhead    +2.78%
dynamic/access-relative    change  -0.85%  [-19.01% ..  +7.47%]  overhead    +2.28%
dynamic/access-contended   change  +0.11%  [ -6.98% ..  +6.12%]  overhead    +5.22%

[github-actions]

Remote cache preview

Commit: e461d474cb005f061d468c8edbbc96443bf97090

Cloudflare deployment is disabled. Configure the staging environment described in the e2e plan, then set REMOTE_CACHE_DEPLOY_ENABLED=true and rerun this workflow. No live deployment passed verification.

Manual checks and complete e2e plan.