ci: cache gcc as a buildcache node instead of committed lockfiles

Committed lockfiles pinned gcc as a host-path external (from spack compiler
find), which is not portable across runners and broke CI. Cache the gcc
compiler itself as a buildcache node instead, so CI pulls it (~1 min) rather
than building it from source (~1 h).

- push the freshly-built gcc node in setup-deps BEFORE spack compiler find
  (which marks it external and excludes it from buildcache push), gated behind
  a push-gcc input used only by the buildcache workflow
- drop the committed-lockfile approach: remove test/ci/locks, the lockfile
  install path in setup-deps, and the lockfile export in the buildcache workflow
- drop the ignored ref input from setup-spack (v3 renamed it to spack_ref)

.github/actions/setup-deps/action.yml

@@ -11,6 +11,12 @@ inputs:
   fresh:
     description: 'Use fresh concretization'
     default: 'false'
+  push-gcc:
+    description: 'Push the freshly-built gcc node to the buildcache (buildcache workflow only)'
+    default: 'false'
+  push-token:
+    description: 'Token with packages:write, required when push-gcc is true'
+    default: ''
 
 runs:
   using: composite
@@ -20,7 +26,6 @@ runs:
     - name: Setup spack
       uses: spack/setup-spack@v3
       with:
-        ref: v1.1.0
         color: true
         buildcache: true
 
@@ -35,43 +40,29 @@ runs:
       shell: spack-bash {0}
       run: |
         echo "::group::Add FairMQ buildcache mirror"
-        # Register the mirror globally (the env yamls only configure it inside the
-        # env, which is created *after* gcc is installed) so that the "Install GCC"
-        # step below can pull the compiler as a binary instead of building it from
-        # source (~58 min/job otherwise).
         spack mirror add --unsigned --type binary \
           ghcr-buildcache oci://ghcr.io/fairrootgroup/fairmq-spack-buildcache
         echo "::endgroup::"
 
-    - name: Resolve lockfile
-      id: lock
-      shell: bash
-      run: |
-        # Prefer a committed, fully-concretized lockfile so the hashes match the
-        # binaries the buildcache pushed (guaranteed cache hits, no re-solve).
-        # Fresh runs (the buildcache itself) must re-concretize, so skip the lock.
-        lock="test/ci/locks/${{ inputs.env }}-gcc${{ inputs.gcc }}.lock"
-        if [ "${{ inputs.fresh }}" != "true" ] && [ -f "$lock" ]; then
-          echo "Using committed lockfile: $lock"
-          echo "use=true" >> "$GITHUB_OUTPUT"
-          echo "path=$lock" >> "$GITHUB_OUTPUT"
-        else
-          echo "No lockfile for ${{ inputs.env }}-gcc${{ inputs.gcc }}; concretizing from spec"
-          echo "use=false" >> "$GITHUB_OUTPUT"
-        fi
-
     - name: Install GCC
-      if: steps.lock.outputs.use != 'true'
       shell: spack-bash {0}
+      env:
+        GITHUB_TOKEN: ${{ inputs.push-token }}
       run: |
         echo "::group::Install GCC"
         spack install ${{ inputs.fresh == 'true' && '--fresh' || '' }} gcc@${{ inputs.gcc }} target=x86_64_v3
         gcc_hash=$(spack find --json gcc@${{ inputs.gcc }} target=x86_64_v3 | jq -r 'sort_by(.version | split(".") | map(tonumber)) | last | .hash')
+        if [ "${{ inputs.push-gcc }}" = "true" ]; then
+          # Push the gcc node now, BEFORE `spack compiler find` registers it as an
+          # external -- externals are excluded from `buildcache push`. This is what
+          # lets CI pull gcc from the cache (~1 min) instead of building it (~1 h).
+          spack mirror set --oci-username ${{ github.actor }} --oci-password-variable GITHUB_TOKEN ghcr-buildcache
+          spack buildcache push --unsigned ghcr-buildcache /$gcc_hash
+        fi
         spack compiler find "$(spack location -i /$gcc_hash)"
         echo "::endgroup::"
 
     - name: Install dependencies
-      if: steps.lock.outputs.use != 'true'
       shell: spack-bash {0}
       run: |
         echo "::group::Install dependencies"
@@ -79,20 +70,5 @@ runs:
         spack -e fairmq add gcc@${{ inputs.gcc }}
         spack -e fairmq config add "packages:all:require:'%gcc@${{ inputs.gcc }}'"
         spack -e fairmq install --fail-fast ${{ inputs.fresh == 'true' && '--fresh' || '' }}
-        echo "::endgroup::"
-
-    - name: Install dependencies (from lockfile)
-      if: steps.lock.outputs.use == 'true'
-      shell: spack-bash {0}
-      run: |
-        echo "::group::Install dependencies (from lockfile)"
-        spack env create fairmq ${{ steps.lock.outputs.path }}
-        spack -e fairmq install --fail-fast
-        echo "::endgroup::"
-
-    - name: Export environment
-      shell: spack-bash {0}
-      run: |
-        echo "::group::Export environment"
         spack env activate --sh fairmq | grep '^export ' | sed 's/^export //;s/;$//' >> $GITHUB_ENV
         echo "::endgroup::"

.github/workflows/buildcache.yml

@@ -40,6 +40,8 @@ jobs:
           gcc: ${{ matrix.gcc }}
           env: ${{ matrix.env }}
           fresh: 'true'
+          push-gcc: 'true'
+          push-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push to buildcache
         if: ${{ !cancelled() }}
@@ -50,21 +52,6 @@ jobs:
           spack -e fairmq mirror set --oci-username ${{ github.actor }} --oci-password-variable GITHUB_TOKEN ghcr-buildcache
           spack -e fairmq buildcache push --unsigned ghcr-buildcache
 
-      - name: Export lockfile
-        if: ${{ !cancelled() }}
-        shell: spack-bash {0}
-        run: |
-          mkdir -p test/ci/locks
-          cp "$(spack location -e fairmq)/spack.lock" \
-            "test/ci/locks/${{ matrix.env }}-gcc${{ matrix.gcc }}.lock"
-
-      - name: Upload lockfile
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: lock-${{ matrix.env }}-gcc${{ matrix.gcc }}
-          path: test/ci/locks/${{ matrix.env }}-gcc${{ matrix.gcc }}.lock
-
   update-index:
     if: github.repository == 'FairRootGroup/FairMQ' && !cancelled()
     needs: build
@@ -79,7 +66,6 @@ jobs:
       - name: Setup spack
         uses: spack/setup-spack@v3
         with:
-          ref: v1.1.0
           color: true
 
       - name: Update buildcache index

test/ci/locks/README.md

@@ -1,21 +0,0 @@
-# Committed spack lockfiles
-
-`setup-deps` installs from `<env>-gcc<N>.lock` here when a matching file exists,
-skipping concretization so the resolved hashes match the binaries the buildcache
-pushed (guaranteed cache hits). When no lockfile is present it falls back to
-concretizing from `test/ci/spack-<env>.yaml`.
-
-## Regenerating
-
-Lockfiles pin host externals (glibc, system gcc), so they must be concretized on
-the same runner image CI uses (`ubuntu-24.04`) — do **not** generate them on a
-local machine.
-
-1. Run the `Spack Buildcache` workflow (push to `dev`/`master` touching the spack
-   configs, or `workflow_dispatch`). It concretizes fresh (`fresh: 'true'`),
-   pushes binaries, and uploads each env's `spack.lock` as a `lock-<env>-gcc<N>`
-   artifact.
-2. Download the artifacts and commit them here as `<env>-gcc<N>.lock`.
-
-Regenerate whenever the specs in `test/ci/spack-*.yaml` change or the runner
-image is bumped.