Does BoringCache change Bazel's cache keys?

No. Bazel still calculates action inputs, outputs, and cache keys. BoringCache provides the shared HTTP cache endpoint.

Can pull requests use Bazel remote cache safely?

Use restore-only access for untrusted jobs and save access only for trusted branches or isolated write scopes.

No. The same workspace can be used locally when the developer has restore access.

Bazel remote cache

Use Bazel results your team already built.

Share action results and output files between CI and developer machines. Matching actions can read the completed result instead of executing again.

Set up Bazel See the product

.boringcache.toml

workspace = "my-org/app"

[adapters.bazel]
tag = "bazel-cache"
command = ["bazel", "build", "//..."]

boringcache bazel

permissions:
  contents: read
  id-token: write

steps:
  - uses: boringcache/one@f0fb9b2d926a32b10c543e92093ba00c5a291b79 # v1.33.0
    with:
      mode: bazel
      trust-policy: auto
  - run: bazel build //...

steps:
  - label: Build
    command: >
      boringcache ci run
      --oidc-provider buildkite
      -- boringcache bazel

build:
  timeout: 1h
  id_tokens:
    BORINGCACHE_OIDC_TOKEN:
      aud: urn:boringcache:workload
  script:
    - boringcache ci run --oidc-provider gitlab -- boringcache bazel

How BoringCache fits your build.

Action results

Reuse work for actions with matching inputs.

Output files

Make the associated build outputs available to another machine.

Your Bazel graph

Keep the targets, dependencies, and cache keys Bazel already computes.

Share results while Bazel runs the build.

BoringCache supplies the HTTP cache endpoint and workspace access. Bazel retains control of action identity and execution.

See which Bazel actions reused results.

Inspect action-cache hits, misses, and transferred outputs for each run.

Explore the workspace →

Workspace insights

gRPC build cache

GitHub Actionsmainafbb918 23 Sep 2026

Open run

Bazel action-cache reuse

0 cache errors

100.0%

3,787 of 3,787 Bazel action-cache lookups were hits.

Action-cache hits: 3,787
Action-cache misses: 0

Cache data transferred

Restored: 56.7 MB
Uploaded: 0 Bytes

Bazel 56.7 MB restored · 0 Bytes uploaded

Cache activity by tool

Bazel 3,787 hits · 0 misses

28%

Faster than BuildBuddy

gRPC · Bazel builds

Keep shared-cache publication in trusted jobs.

Give consumers restore access and publishers a separate permission. Connect supported CI through OIDC or use scoped credentials.

Connect your CI →

Separate readers and publishers

Trusted builds Publish shared cache for the next build Read + publish
Pull requests Restore cache without replacing it Read only
Local development Use a scoped credential for the workspace Scoped access

Before you connect.

Does BoringCache change Bazel's cache keys?: No. Bazel still calculates action inputs, outputs, and cache keys. BoringCache provides the shared HTTP cache endpoint.
Can pull requests use Bazel remote cache safely?: Use restore-only access for untrusted jobs and save access only for trusted branches or isolated write scopes.
Is this only for CI?: No. The same workspace can be used locally when the developer has restore access.

Read the Bazel setup guide →

Use other tools in the same workspace.

Explore build cache →

Start with your next Bazel build.

Install the CLI. Run onboarding to connect your repository and configure your cache.

30 GB of cache free. No credit card required.

Set up Bazel Use GitHub Actions

curl -sSL https://install.boringcache.com/install.sh | sh
boringcache onboard
boringcache bazel