ci: share Rust builds across jobs (sccache + build-once CLI artifact)#401
Open
bordumb wants to merge 3 commits into
Open
ci: share Rust builds across jobs (sccache + build-once CLI artifact)#401bordumb wants to merge 3 commits into
bordumb wants to merge 3 commits into
Conversation
Every compiling CI job recompiled the same dependency graph in its own per-job cache namespace, so nothing was shared across jobs. This wires three levers to fix that: 1. sccache — the setup-rust composite now installs mozilla-actions/ sccache-action and sets RUSTC_WRAPPER=sccache with the GHA backend, so a crate compiled once (in any job/runner) is reused everywhere its inputs match. Added to ci.yml jobs, node-sdk, python-sdk, verify-commits, and test-windows-build. 2. build-once, fan-out — a new build-cli job compiles auths-cli + auths-mcp-gateway once per OS and uploads the binaries as an artifact; smoke and e2e download and run them instead of recompiling (and drop the Rust toolchain entirely). e2e keeps its gate via needs: [test, build-cli]. 3. consolidated caching — the composite is now the single place that configures the toolchain and swaps the hand-rolled actions/cache for Swatinem/rust-cache (deps-only, auto-pruned). Jobs whose build dir is not the workspace target (fuzz-smoke, node-sdk, python-sdk) pass cache: false and keep their own scoped cache. No CI check was removed: same jobs (plus build-cli), same lint/test/ verify commands; only build and cache plumbing changed. Validated with actionlint (clean) and a before/after check inventory. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 1/1 commits verified |
Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 2/2 commits verified |
They had no server in CI, so each spent the 30s sqlx acquire_timeout retrying a dead socket then skipped (PASS, ~13min serial, zero coverage). Give them a dedicated ubuntu job with a postgres:16 service (service containers are Linux-only; the macOS leg never enabled backend-postgres) and filter the binary out of the main run so it no longer times out there. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 3/3 commits verified |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Nearly every CI job compiled the same dependency graph, and each job cached
target/+~/.cargounder its own key namespace (-clippy-,-test-,-smoke-, …). Nothing was shared across jobs — on a single PR the workspace was compiled cold well over a dozen times, and the crate registry was stored redundantly under ~10 keys.What this does
Three levers, no check changes:
setup-rustcomposite now installsmozilla-actions/sccache-actionand setsRUSTC_WRAPPER=sccachewith the GHA backend. sccache is content-addressed, so a crate compiled once in any job/runner is reused everywhere its inputs match. Applied toci.yml,node-sdk,python-sdk,verify-commits, andtest-windows-build.build-climatrix job compilesauths-cli+auths-mcp-gatewayonce per OS and uploads the binaries as an artifact.smokeande2edownload and run them instead of recompiling, dropping the Rust toolchain entirely.e2ekeeps its gate vianeeds: [test, build-cli].Swatinem/rust-cache(deps-only, auto-pruned) in place of the hand-rolledactions/cacheblocks. Jobs whose build dir isn't the workspacetarget/(fuzz-smoke,node-sdk,python-sdk) passcache: falseand keep their own scoped cache.No checks removed
Same job set plus
build-cli; every lint/test/verify command is unchanged (verified by a before/after command inventory — the only removedrun:lines were the two redundantcargo buildCLI invocations, now centralized inbuild-cli). Each job's toolchain was preserved exactly (stable/1.93/1.93.0/nightly).actionlintis clean across all workflows.Notes for review
v0.0.9— worth confirming that's the intended/latest tag for this org.release.yml,publish-*.yml,docs.yml,fuzz.yml(nightly cron). Happy to extend sccache there in a follow-up.🤖 Generated with Claude Code