ci: Swatinem caching + opt-in mold + build-once release image#26
Merged
Conversation
Replace the per-job hand-rolled actions/cache (restore + "clean target if Cargo.lock changed" + save), keyed only on Cargo.lock, with Swatinem/rust-cache in clippy / tests / tests-suites / unused-deps. - Each job uses a Swatinem shared-key (clippy, tests, tests-suites, unused-deps) and maps the existing knobs: prefix-key <- rust-cache-prefix, save-if <- rust-cache-save. Swatinem keys on rustc + Cargo.lock + workspace and prunes stale workspace artifacts before saving, fixing the immutable-cache staleness of a Cargo.lock-only key. - Formatting job no longer caches anything: `cargo fmt -- --check` does not compile, so restoring/saving ~/.cargo + target/ was pure waste. - sccache steps removed: no persistent backend was ever configured (the object store was not cached), so it gave no cross-run benefit and disabled incremental compilation, fighting the target/ cache. The `use-sccache` input is kept (deprecated, no-op) so existing callers and ci.yml don't break. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mold is a linker, so it only helps jobs that link a binary — tests and tests-suites, not clippy (check-only) or formatting (no compile). Add a `use-mold` input (default false) and, when enabled, install mold+clang and set RUSTFLAGS before the Swatinem cache step (so the linker flags are part of the cache key) in those two jobs only. Opt-in by default because this is a shared workflow: mold cannot read ThinLTO bitcode objects without the LLVM plugin, so `cargo test --release` / LTO test builds would fail at link time. Plumb the matching `rust-use-mold` input through ci.yml. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
release-app.yml previously published via a parallel matrix over publish-envs, with each env (Staging, Prod) running build-publish.yml — a full Docker compile. Because the legs ran in parallel they couldn't share the gha layer cache, so the identical image was compiled twice (~2x the slowest build). Restructure into build-once / push-per-env (same pattern as pay-core's canary image): - `build`: compiles the image once on the configurable run-label runner and exports it to a tarball artifact (gha layer cache retained). - `publish` (matrix per env): downloads the tarball, docker load, then tags + pushes to that env's ECR (its own role) and GHCR. No compile — runs on ubuntu-latest. Env config is injected at runtime in ECS, so the image is identical across envs. build-publish.yml is left in place for any direct callers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
chris13524
approved these changes
Jun 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Folds the Rust CI/CD improvements that pay-core has been consuming via
@ci/swatinem-rust-cacheinto the canonicalfix/dont_block_on_trivyref, soconsumers can pin to it instead of the floating feature branch.
Clean merge: 3 ahead / 0 behind
fix/dont_block_on_trivy.Changes
ci-check-app.yml→ Swatinem/rust-cache (+53/-153)actions/cache(restore + "clean target" + save, keyed only onCargo.lock→ immutable/frozen) withSwatinem/rust-cache(pinnedv2.9.1) in clippy / tests / tests-suites / udeps.formattingjob (cargo fmtdoesn't compile).sccachesteps (no backend was configured; kept theuse-sccacheinput as a deprecated no-op so callers don't break).Opt-in
moldlinker for the test jobs (ci.yml+ci-check-app.yml,+5)use-mold/rust-use-moldinput (default false). When enabled, installs mold+clang and setsRUSTFLAGSbefore the cache step (so it's in the key) ontests+tests-suitesonly — the jobs that actually link.cargo test --release/LTO builds would break.Build the release image once, push per env (
release-app.yml,+107/-11)publishpreviously ran a parallel matrix over envs, each doing a full Docker compile → the identical image compiled twice.buildcompiles once on the configurablerun-labelrunner;publish(matrix per env) loads the tarball and tags/pushes to each env's ECR + GHCR onubuntu-latest. Env config is injected at runtime, so the image is identical across envs.After merge
Consumers (pay-core) revert their
@ci/swatinem-rust-cacherefs back to@fix/dont_block_on_trivyso everything is on one ref again.