PrimeCaches.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

# The only workflow that writes the Rust caches pull requests restore. Entries
# saved on main are restorable from every pull request. Every other workflow
# only reads them.
#
# Each job looks up the entry for its current lockfiles and toolchain. If it
# is missing, the job builds from a cold target and saves. rust-cache keeps
# every dependency version it restores, so a build on a restored entry would
# grow it with each lockfile change. Tests build but do not run.
#
# Keys hash lockfiles and toolchains, not build commands. Bump `prefix-key` in
# every rust-cache step after changing what a job here builds.

name: Prime Caches

on:
  push:
    branches: [main]
  workflow_dispatch:

# A new run replaces a pending one and never cancels the running one, so the
# newest commit always saves.
concurrency:
  group: prime-caches-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: full

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  # Populate guest caches (key guests-{arch}-{config}) for both architectures.
  guests:
    strategy:
      fail-fast: false
      matrix:
        arch: [X64, arm64]
        config: [debug, release]
    uses: ./.github/workflows/dep_build_guests.yml
    secrets: inherit
    with:
      arch: ${{ matrix.arch }}
      config: ${{ matrix.config }}
      prime_cache: true

  # Populate v1-rust-code-checks-{linux,windows} caches.
  code-checks:
    uses: ./.github/workflows/dep_code_checks.yml
    secrets: inherit
    with:
      prime_cache: true

  # Populate the fuzz cache (key fuzz-{arch}) with every fuzz target.
  fuzz:
    uses: ./.github/workflows/dep_fuzzing.yml
    secrets: inherit
    with:
      prime_cache: true
      arch: X64
      target: all
      max_total_time: 0
      timeout_minutes: 30

  # Populate the host caches (key {arch}-{os}-{hypervisor}-{config}) used by
  # dep_build_test.yml. Linux is primed once per hypervisor because the kvm
  # pools run Ubuntu and the mshv3 pools run Azure Linux 3, and we want each
  # distro to restore a cache produced under its own libc. The host, its tests
  # and hyperlight-ci are built here. No tests run.
  host:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: X64
            hypervisor: kvm
            config: debug
          - arch: X64
            hypervisor: kvm
            config: release
          - arch: X64
            hypervisor: mshv3
            config: debug
          - arch: X64
            hypervisor: mshv3
            config: release
          - arch: X64
            hypervisor: hyperv-ws2025
            config: debug
          - arch: X64
            hypervisor: hyperv-ws2025
            config: release
          - arch: arm64
            hypervisor: kvm
            config: debug
          - arch: arm64
            hypervisor: kvm
            config: release
    timeout-minutes: ${{ fromJSON(vars.PRIME_CACHES_JOB_TIMEOUT || '30') }}
    # Spread load across vendor pools: AMD when run_id ends in 0,2,4,6,8, Intel otherwise.
    runs-on: ${{ fromJson(matrix.arch == 'X64'
        && format('["self-hosted", "{0}", "X64", "1ES.Pool=hld-{1}-{2}", "JobId=prime-cache-{3}-{4}-{5}-{6}-{7}"]',
            matrix.hypervisor == 'hyperv-ws2025' && 'Windows' || 'Linux',
            matrix.hypervisor == 'hyperv-ws2025' && 'win2025' || matrix.hypervisor == 'mshv3' && 'azlinux3-mshv' || matrix.hypervisor,
            (endsWith(github.run_id, '0') || endsWith(github.run_id, '2') || endsWith(github.run_id, '4') || endsWith(github.run_id, '6') || endsWith(github.run_id, '8')) && 'amd' || 'intel',
            matrix.hypervisor,
            matrix.config,
            github.run_id,
            github.run_number,
            github.run_attempt)
        || '["self-hosted", "Linux", "arm64", "kvm"]') }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - uses: hyperlight-dev/ci-setup-workflow@59673866360458f8dd035f4a9fa766aeebad2038  # v2.3.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Keep the steps before this one in sync with dep_build_test.yml. The key
      # hashes the installed toolchains and the Rust and C build env vars.
      - name: Rust cache
        id: rust-cache
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3
        with:
          prefix-key: v1-rust
          shared-key: "${{ matrix.arch }}-${{ runner.os }}-${{ matrix.hypervisor }}-${{ matrix.config }}"
          lookup-only: true

      - name: Build host and tests
        if: steps.rust-cache.outputs.cache-hit != 'true'
        run: just prime-caches ${{ matrix.config }}

  # Rust keys end in a toolchain hash and a lockfile hash. Sysroot keys end in
  # one hash. Each change leaves the old entry behind. Keep the newest entry
  # per key and delete the rest to stay under the repository cache quota.
  cleanup:
    needs: [guests, code-checks, fuzz, host]
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    permissions:
      actions: write
    env:
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
    steps:
      - name: Delete superseded caches
        run: |
          # Filter by key prefix. The listing caps at 1000 entries.
          for prefix in v1-rust- sysroot-; do
            gh cache list --ref "$GITHUB_REF" --key "$prefix" --limit 1000 --json id,key,createdAt
          done | jq -s -r '
            add
            | group_by(.key | if startswith("sysroot-") then sub("-[^-]*$"; "") else sub("-[^-]*-[^-]*$"; "") end)
            | map(sort_by(.createdAt) | reverse | .[1:][])
            | .[] | "\(.id) \(.key)"' |
          while read -r id key; do
            echo "Deleting $key"
            gh cache delete "$id" || echo "::warning::Failed to delete $key"
          done