From 73894ef15b73a0e6512c942293b79b7e18737181 Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Fri, 23 Oct 2026 12:33:35 -0700 Subject: [PATCH] ci: keep rust caches warm on main and stop saving binary caches on branches Branch Checks never runs on main, so PR mirrors had no main rust-checks cache to restore and each one saved its own. Per-binary release build caches were also saved from every branch. Together they filled the 50 GB cache quota within hours and evicted main's caches. Save per-binary caches only on main, and add a Rust Cache workflow that builds the Branch Checks test targets on each push to main so PRs and merge groups can restore a matching rust-checks cache. Signed-off-by: Kris Hicks --- .github/actions/build-rust-binary/action.yml | 4 +- .github/actions/setup-rust/action.yml | 6 ++ .github/workflows/rust-cache.yml | 67 ++++++++++++++++++++ CI.md | 2 + 4 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/rust-cache.yml diff --git a/.github/actions/build-rust-binary/action.yml b/.github/actions/build-rust-binary/action.yml index 1118e9e244..e5d2b4bdfa 100644 --- a/.github/actions/build-rust-binary/action.yml +++ b/.github/actions/build-rust-binary/action.yml @@ -36,10 +36,12 @@ inputs: runs: using: composite steps: + # Per-binary caches are large and other branches can restore main's, so + # saving them elsewhere mostly evicts main's from the shared quota. - uses: ./.github/actions/setup-rust with: cache-key: binaries-v2-${{ inputs.binary }}-${{ inputs.triple }} - save-cache: "true" + save-cache: ${{ github.ref == 'refs/heads/main' }} - name: Set version shell: nix develop -c bash -euo pipefail {0} diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml index 92320c7f68..99aaeaa11f 100644 --- a/.github/actions/setup-rust/action.yml +++ b/.github/actions/setup-rust/action.yml @@ -13,6 +13,11 @@ inputs: required: false default: "false" +outputs: + cache-hit: + description: "true when the cache key matched exactly" + value: ${{ steps.cache.outputs.cache-hit }} + runs: using: composite steps: @@ -24,6 +29,7 @@ runs: echo "hash=$(nix hash file --type sha256 --base16 "$shell_drv")" >> "$GITHUB_OUTPUT" - name: Cache Rust target and registry + id: cache uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: shared-key: ${{ inputs.cache-key }}-${{ steps.dev-shell.outputs.hash }} diff --git a/.github/workflows/rust-cache.yml b/.github/workflows/rust-cache.yml new file mode 100644 index 0000000000..d9ec30c631 --- /dev/null +++ b/.github/workflows/rust-cache.yml @@ -0,0 +1,67 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +name: Rust Cache + +# Branch Checks never runs on main, so this saves the rust-checks cache that PR +# mirrors and merge groups restore. Keep env and build commands aligned with +# the Branch Checks rust-test job so the cache keys and contents match. +on: + push: + branches: + - main + workflow_dispatch: + +env: + CARGO_TERM_COLOR: always + CARGO_INCREMENTAL: "0" + MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + +permissions: + contents: read + packages: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + # Let runs finish so frequent merges cannot keep cancelling the save. + cancel-in-progress: false + +jobs: + rust-checks: + name: Rust checks cache (${{ matrix.system }}) + strategy: + fail-fast: false + matrix: + include: + - runner: linux-amd64-cpu8 + system: x86_64-linux + - runner: linux-arm64-cpu8 + system: aarch64-linux + - runner: macos-15-xlarge + system: aarch64-darwin + runs-on: ${{ matrix.runner }} + timeout-minutes: 45 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - uses: ./.github/actions/setup-nix + with: + prepare-shell: "true" + cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} + + - id: rust + uses: ./.github/actions/setup-rust + with: + cache-key: rust-checks-v2 + save-cache: "true" + + - name: Build tests + if: steps.rust.outputs.cache-hit != 'true' + shell: nix develop -c bash -euo pipefail {0} + run: | + cargo test --locked -p openshell-crypto --no-default-features --test independent_backend --no-run + cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support --no-run + cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --no-run + cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml --no-run diff --git a/CI.md b/CI.md index fb63409c41..5ed3d7c953 100644 --- a/CI.md +++ b/CI.md @@ -618,6 +618,8 @@ The bot's full administrator documentation is internal to NVIDIA. The only comma | `.github/actions/setup-e2e-*` | Shared artifact, Podman, KVM, and kind setup used by the runtime lanes. | | `.github/workflows/helm-lint.yml` | Helm chart validation. PR mirror pushes skip lint jobs unless Helm inputs changed; merge groups always validate Helm because they represent the final integration state. | | `.github/actions/setup-nix/action.yml` | Installs Nix and configures the OpenShell Cachix cache, using read-only cache access when no authentication token is available. | +| `.github/actions/setup-rust/action.yml` | Restores the Rust target and registry cache. Other branches can restore only their own caches and `main`'s, so per-binary release build caches are saved only on `main`. | +| `.github/workflows/rust-cache.yml` | Builds the Branch Checks test targets on each push to `main` to save the `rust-checks` cache that PR mirrors and merge groups restore. Skips the build when the cache already matches. | | `.github/actions/pr-gate/action.yml` | Composite action that resolves PR metadata and verifies the required label is set for PR mirror pushes. Non-push events are allowed through. | | `.github/actions/pr-merge-base/action.yml` | Composite action that resolves and fetches the merge-base commit for `pull-request/` push workflows. | | `.github/workflows/required-ci-gates.yml` | Posts required PR-head and merge-group statuses for gated CI workflows. This is what branch protection and merge queue should require. |