alfredtm/Yeet Cache
Content-addressed CI build skip via OCI registry. Skip image builds entirely when source files are unchanged.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 22, 2026
- License
- MIT
Pinned Snippet
uses: alfredtm/yeet-cache-action@a902595a61fac9ca949ce61ee05dc53a94f7b574 # v1.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| paths | Space-separated paths to hash via git tree hashes. Required unless `hash` is provided. | no | "" |
| hash | Pre-computed 12-char source hash. Bypasses paths/git. Useful for skipping checkout on cache hits. | no | "" |
| via-api | When "true" and `paths` is set, compute the hash via GitHub git API (gh api repos/.../git/trees/...) instead of git rev-parse. Lets you skip actions/checkout on cache hits. | no | false |
| image | OCI image repository without tag (e.g. ghcr.io/owner/repo). | yes | — |
| extra | Free-form string mixed into the hash. Include build flags, toolchain version, base image digest. | no | "" |
| registry | Registry hostname. | no | ghcr.io |
| registry-username | Registry username. Defaults to $GITHUB_ACTOR. | no | "" |
| registry-password | Registry token. Typically secrets.GITHUB_TOKEN. | yes | — |
| tags | Comma-separated tags to apply on cache hit. | no | "" |
| sign | "true" to auto-attest the built image on cache miss via the post hook, and verify on cache hit. Requires permissions { id-token: write, attestations: write }. | no | false |
| verify-on-hit | "true" (default) to verify the cosign/attestation signature on cache hit before retagging. Set to "false" for trust-on-first-use semantics — cache hits are retagged without re-verification. Saves ~3-4s per no-op push. Tradeoff: a compromised registry tag would not be caught at hit time; rely on registry write-access controls instead. | no | true |
| verify-identity | Override for the workflow identity regex used during verification. Defaults to any workflow in $GITHUB_REPOSITORY. | no | "" |
| yeet-pack-binary-path | Override path to the yeet-pack binary. Defaults to the bundled binary in dist/. | no | "" |
Outputs
| name | description |
|---|---|
| hit | "true" if an image with the source hash exists (and signature verified, if sign=true). |
| src-hash | 12-char content address. |
| src-tag | Full <image>:src-<hash> reference. Tag your freshly-built image with this on cache miss. |
| cached-tag | Same as src-tag, only set on cache hit. |