Skip to content

ci: fix cargo cache eviction — rust-cache, per-suite e2e keys, main-only saves#121

Open
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
mainfrom
fix/ci-cargo-cache
Open

ci: fix cargo cache eviction — rust-cache, per-suite e2e keys, main-only saves#121
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
mainfrom
fix/ci-cargo-cache

Conversation

@mikolalysenko

Copy link
Copy Markdown
Collaborator

Problem

Every ubuntu e2e matrix leg cold-compiles the full ~275-crate dependency graph on every PR run (verified in run 28838256247: Cache not found for input keys on all legs, then 275 Compiling lines each, vs 4 on a cache-hit job). Two compounding causes:

  1. Matrix key collision — all ~9 same-OS e2e legs share one cache key (${{ matrix.os }}-cargo-e2e-<lockhash>). Only one leg wins the cache reserve per run; the other 8 log Failed to save: Unable to reserve cache … another job may be creating this cache.
  2. 10 GiB budget blowout — caching the whole target/ dir puts a single main run's footprint at ~8.2 GiB (windows-latest-cargo-* 3.96 GB, macos-latest-cargo-* 2.19 GB). Against GitHub's 10 GiB LRU budget, every PR save evicts the main-branch caches (the big e2e ones first) — the cache listing shows only the most recent main run's caches ever survive.

Fix

  • Swap the five raw actions/cache blocks (clippy, test matrix, test-release, coverage, e2e) for Swatinem/rust-cache@v2.9.1 (SHA-pinned), which prunes caches to dependency artifacts (~5-10× smaller) and keys on rustc host triple + job automatically.
  • Per-suite key: ${{ matrix.suite }} on the e2e job — no more reserve races.
  • save-if: github.ref == 'refs/heads/main' everywhere — PR branches restore but never write, so they stop churning the budget.

Workspace crates (socket-patch-core/-cli) recompile each run by design — that ~1-2 min is the tradeoff that keeps the dependency caches small enough to survive. The docker-image jobs keep their deliberate no-cache stance (zizmor cache-poisoning audit).

Expected effect

e2e legs go from ~275-crate cold builds per leg per PR run to dependency-cached builds; total repo cache footprint drops well under the 10 GiB budget so main caches stop being evicted.

🤖 Generated with Claude Code

…nly saves

Every ubuntu e2e leg has been cold-compiling the full ~275-crate graph
on every PR run. Two compounding causes:

1. Matrix key collision: all ~9 same-OS e2e legs shared one cache key
   (`<os>-cargo-e2e-<lockhash>`), so a single leg won the cache reserve
   per run and the other 8 logged "Unable to reserve cache".
2. Budget blowout: caching the entire target/ dir put a single main
   run's cache footprint at ~8.2 GiB (windows 3.96 GB, macos 2.19 GB)
   against GitHub's 10 GiB LRU budget, so PR-branch saves evicted the
   main caches (and vice versa) — the big e2e caches always first.

Fix: swap the five raw actions/cache blocks (clippy, test matrix,
test-release, coverage, e2e) for Swatinem/rust-cache, which prunes the
cache to dependency artifacts (~5-10x smaller) and keys on the rustc
host triple + job automatically; give e2e legs a per-suite key; and
restrict saves to main (`save-if`) so PR branches restore without
churning the budget. Workspace crates recompile per run by design —
that's the ~1-2 min tradeoff that keeps dependency caches alive.

The docker-image jobs keep their deliberate no-cache stance (zizmor
cache-poisoning audit).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedgithub/​swatinem/​rust-cache@​c19371144df3bb44fab255c43d04cbc2ab54d1c49910010010070

View full report

@socket-security-staging

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedgithub/​swatinem/​rust-cache@​c19371144df3bb44fab255c43d04cbc2ab54d1c49910010010070

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant