From 3f30c3040e6e3662dff0f9ce72acdb105dc97fa2 Mon Sep 17 00:00:00 2001
From: codex <codex@bstein.dev>
Date: Sun, 4 Oct 2026 05:28:09 -0500
Subject: [PATCH] ci: move build scratch off node runtime storage

---
 Jenkinsfile | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index a3aea10..b7d28e3 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -1,6 +1,8 @@
 pipeline {
   agent {
     kubernetes {
+      // Keep build I/O off the node's runtime USB drive.
+      workspaceVolume dynamicPVC(accessModes: 'ReadWriteOnce', requestsSize: '40Gi', storageClassName: 'ci-scratch')
       defaultContainer 'builder'
       retries 2
       yaml """
@@ -10,6 +12,9 @@ metadata:
   labels:
     app: metis
 spec:
+  securityContext:
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   nodeSelector:
     kubernetes.io/arch: arm64
     node-role.kubernetes.io/worker: "true"
@@ -56,8 +61,9 @@ spec:
         - --host=tcp://0.0.0.0:2375
         - --tls=false
       volumeMounts:
-        - name: dind-storage
+        - name: workspace-volume
           mountPath: /var/lib/docker
+          subPath: .cache/docker
     - name: builder
       image: registry.bstein.dev/bstein/docker:27
       command: ["cat"]
@@ -105,12 +111,8 @@ spec:
         - name: workspace-volume
           mountPath: /home/jenkins/agent
   volumes:
-    - name: workspace-volume
-      emptyDir: {}
     - name: docker-config-writable
       emptyDir: {}
-    - name: dind-storage
-      emptyDir: {}
     - name: harbor-config
       secret:
         secretName: harbor-robot-pipeline
@@ -121,6 +123,13 @@ spec:
     }
   }
   environment {
+    PIP_CACHE_DIR = '/home/jenkins/agent/.cache/pip'
+    NPM_CONFIG_CACHE = '/home/jenkins/agent/.cache/npm'
+    SONAR_USER_HOME = '/home/jenkins/agent/.cache/sonar'
+    TMPDIR = '/home/jenkins/agent/.cache/tmp'
+    GOCACHE = '/home/jenkins/agent/.cache/go-build'
+    GOMODCACHE = '/home/jenkins/agent/.cache/go-mod'
+    GOTMPDIR = '/home/jenkins/agent/.cache/go-tmp'
     REGISTRY = 'registry.bstein.dev/bstein'
     IMAGE = "${REGISTRY}/metis"
     SENTINEL_IMAGE = "${REGISTRY}/metis-sentinel"
@@ -153,6 +162,11 @@ spec:
     pollSCM('H/5 * * * *')
   }
   stages {
+    stage('Prepare build scratch') {
+      steps {
+        sh 'mkdir -p /home/jenkins/agent/.cache/tmp /home/jenkins/agent/.cache/go-tmp'
+      }
+    }
     stage('Checkout') {
       steps {
         checkout scm