ci: keep rust caches warm on main and stop saving binary caches on branches

.github/actions/build-rust-binary/action.yml

@@ -36,10 +36,12 @@ inputs:
 runs:
   using: composite
   steps:
+    # Per-binary caches are large and other branches can restore main's, so
+    # saving them elsewhere mostly evicts main's from the shared quota.
     - uses: ./.github/actions/setup-rust
       with:
         cache-key: binaries-v2-${{ inputs.binary }}-${{ inputs.triple }}
-        save-cache: "true"
+        save-cache: ${{ github.ref == 'refs/heads/main' }}
 
     - name: Set version
       shell: nix develop -c bash -euo pipefail {0}

.github/actions/setup-rust/action.yml

@@ -13,6 +13,11 @@ inputs:
     required: false
     default: "false"
 
+outputs:
+  cache-hit:
+    description: "true when the cache key matched exactly"
+    value: ${{ steps.cache.outputs.cache-hit }}
+
 runs:
   using: composite
   steps:
@@ -24,6 +29,7 @@ runs:
         echo "hash=$(nix hash file --type sha256 --base16 "$shell_drv")" >> "$GITHUB_OUTPUT"
 
     - name: Cache Rust target and registry
+      id: cache
       uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         shared-key: ${{ inputs.cache-key }}-${{ steps.dev-shell.outputs.hash }}

.github/workflows/rust-cache.yml

@@ -0,0 +1,67 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Rust Cache
+
+# Branch Checks never runs on main, so this saves the rust-checks cache that PR
+# mirrors and merge groups restore. Keep env and build commands aligned with
+# the Branch Checks rust-test job so the cache keys and contents match.
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: "0"
+  MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+permissions:
+  contents: read
+  packages: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # Let runs finish so frequent merges cannot keep cancelling the save.
+  cancel-in-progress: false
+
+jobs:
+  rust-checks:
+    name: Rust checks cache (${{ matrix.system }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: linux-amd64-cpu8
+            system: x86_64-linux
+          - runner: linux-arm64-cpu8
+            system: aarch64-linux
+          - runner: macos-15-xlarge
+            system: aarch64-darwin
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-nix
+        with:
+          prepare-shell: "true"
+          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - id: rust
+        uses: ./.github/actions/setup-rust
+        with:
+          cache-key: rust-checks-v2
+          save-cache: "true"
+
+      - name: Build tests
+        if: steps.rust.outputs.cache-hit != 'true'
+        shell: nix develop -c bash -euo pipefail {0}
+        run: |
+          cargo test --locked -p openshell-crypto --no-default-features --test independent_backend --no-run
+          cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support --no-run
+          cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --no-run
+          cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml --no-run

CI.md

@@ -618,6 +618,8 @@ The bot's full administrator documentation is internal to NVIDIA. The only comma
 | `.github/actions/setup-e2e-*` | Shared artifact, Podman, KVM, and kind setup used by the runtime lanes. |
 | `.github/workflows/helm-lint.yml` | Helm chart validation. PR mirror pushes skip lint jobs unless Helm inputs changed; merge groups always validate Helm because they represent the final integration state. |
 | `.github/actions/setup-nix/action.yml` | Installs Nix and configures the OpenShell Cachix cache, using read-only cache access when no authentication token is available. |
+| `.github/actions/setup-rust/action.yml` | Restores the Rust target and registry cache. Other branches can restore only their own caches and `main`'s, so per-binary release build caches are saved only on `main`. |
+| `.github/workflows/rust-cache.yml` | Builds the Branch Checks test targets on each push to `main` to save the `rust-checks` cache that PR mirrors and merge groups restore. Skips the build when the cache already matches. |
 | `.github/actions/pr-gate/action.yml` | Composite action that resolves PR metadata and verifies the required label is set for PR mirror pushes. Non-push events are allowed through. |
 | `.github/actions/pr-merge-base/action.yml` | Composite action that resolves and fetches the merge-base commit for `pull-request/<N>` push workflows. |
 | `.github/workflows/required-ci-gates.yml` | Posts required PR-head and merge-group statuses for gated CI workflows. This is what branch protection and merge queue should require. |