Build releases without the turbo cache

.github/workflows/binary-preview.yaml

@@ -35,6 +35,7 @@ jobs:
       artifact-name: native-bin-macos-preview
     secrets:
       OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
+      DEPOT_TURBO_TOKEN: ${{ secrets.DEPOT_TURBO_TOKEN }}
 
   # Build Rust native binaries for Linux and Windows
   build-native-rust:

.github/workflows/binary-release.yaml

@@ -45,8 +45,7 @@ jobs:
           node-version: "24.x"
       - name: Install node deps
         run: bun install
-      - name: Enable turborepo build cache
-        uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14
+      # No turbo cache: published artifacts are always built from source.
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:

.github/workflows/build-native-macos.yaml

@@ -27,6 +27,10 @@ on:
     secrets:
       OP_CI_TOKEN:
         required: true
+      # PR callers pass this so the varlock libs build reuses Depot's turbo cache.
+      # Release callers leave it out, so release builds always run from source.
+      DEPOT_TURBO_TOKEN:
+        required: false
 
 jobs:
   build-swift-binary:
@@ -42,8 +46,10 @@ jobs:
       - name: Install node deps
         run: bun install
 
-      - name: Enable turborepo build cache
-        uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14
+      - name: Enable turborepo remote cache
+        uses: ./.github/actions/depot-turbo-cache
+        with:
+          token: ${{ secrets.DEPOT_TURBO_TOKEN }}
 
       # Cache the Swift .build directory so compilation is fast on unchanged source
       - name: Compute Swift source hash

.github/workflows/deploy-tests.yaml

@@ -52,8 +52,10 @@ jobs:
       - name: Install dependencies
         run: bun install
 
-      - name: Enable turborepo build cache
-        uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14
+      - name: Enable turborepo remote cache
+        uses: ./.github/actions/depot-turbo-cache
+        with:
+          token: ${{ secrets.DEPOT_TURBO_TOKEN }}
 
       # builds the packed tarballs under test AND the varlock CLI used below
       - name: Build libraries

.github/workflows/nextjs-canary.yaml

@@ -36,8 +36,10 @@ jobs:
       - name: Install dependencies
         run: bun install
 
-      - name: Enable turborepo build cache
-        uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14
+      - name: Enable turborepo remote cache
+        uses: ./.github/actions/depot-turbo-cache
+        with:
+          token: ${{ secrets.DEPOT_TURBO_TOKEN }}
 
       - name: Build libraries
         run: bun run build:libs

.github/workflows/notarize-native-macos.yaml

@@ -40,9 +40,7 @@ jobs:
       - name: Install node deps
         run: bun install
 
-      - name: Enable turborepo build cache
-        uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14
-
+      # No turbo cache: published artifacts are always built from source.
       - name: Build varlock libs
         run: bun run build:libs
 

.github/workflows/release.yaml

@@ -269,9 +269,7 @@ jobs:
           node-version: "24.x"
       - name: Install node deps
         run: bun install
-      - name: Enable turborepo build cache
-        uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14
-
+      # No turbo cache: published artifacts are always built from source.
       # Ensure npm >= 11.15.0 for OIDC/provenance
       - name: Update npm
         run: npm install -g npm@latest
@@ -461,8 +459,7 @@ jobs:
           node-version: "24.x"
       - name: Install node deps
         run: bun install
-      - name: Enable turborepo build cache
-        uses: rharkor/caching-for-turbo@56219402aacc0d06b650d898c222996dbc1191ec # v2.3.14
+      # No turbo cache: published artifacts are always built from source.
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:

.github/workflows/test.yaml

@@ -159,6 +159,7 @@ jobs:
       artifact-name: native-bin-macos-ci
     secrets:
       OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
+      DEPOT_TURBO_TOKEN: ${{ secrets.DEPOT_TURBO_TOKEN }}
 
   # Build Rust native binaries if varlock is being released AND (source changed or cache missing)
   build-native-rust: