djc · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
diff --git a/ci/actions-templates/centos-fmt-clippy-template.yaml b/ci/actions-templates/centos-fmt-clippy-template.yaml
@@ -35,20 +35,31 @@ jobs: # skip-all
             ~/.cargo/registry
             ~/.cargo/git
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-      - name: Get rustc commit hash
+      - name: Install Rustup using ./rustup-init.sh
+        run: |
+          sh ./rustup-init.sh --default-toolchain=stable --profile=minimal -c=clippy -y
+      - name: Compute cache key inputs
         id: cargo-target-cache
+        env:
+          MERGE_GROUP_BASE_REF: ${{ github.event.merge_group.base_ref }}
         run: |
-          echo "{rust_hash}={$(rustc -Vv | grep commit-hash | awk '{print $2}')}" >> $GITHUB_OUTPUT
+          echo "rust_hash=$(rustc -Vv | grep commit-hash | awk '{print $2}')" >> $GITHUB_OUTPUT
+          # The branch whose caches PR and merge queue builds fall back to.
+          case "$GITHUB_EVENT_NAME" in
+            pull_request) branch="$GITHUB_BASE_REF" ;;
+            merge_group) branch="${MERGE_GROUP_BASE_REF#refs/heads/}" ;;
+            *) branch="$GITHUB_REF_NAME" ;;
+          esac
+          echo "branch=$branch" >> $GITHUB_OUTPUT
         shell: bash
       - name: Cache cargo build
         uses: actions/cache@v6
         with:
           path: target
-          key: ${{ github.base_ref }}-${{ github.head_ref }}-${{ runner.os }}-cargo-clippy-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ github.base_ref }}-${{ runner.os }}-cargo-clippy-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}
-      - name: Install Rustup using ./rustup-init.sh
-        run: |
-          sh ./rustup-init.sh --default-toolchain=stable --profile=minimal -c=clippy -y
+          key: ${{ steps.cargo-target-cache.outputs.branch }}-${{ runner.os }}-cargo-clippy-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.head_ref }}
+          restore-keys: |
+            ${{ steps.cargo-target-cache.outputs.branch }}-${{ runner.os }}-cargo-clippy-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}-
+            ${{ steps.cargo-target-cache.outputs.branch }}-${{ runner.os }}-cargo-clippy-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-
       - name: Run the centos check within the docker image
         run: |
           docker run \

diff --git a/ci/actions-templates/gen-workflows.sh b/ci/actions-templates/gen-workflows.sh
@@ -27,6 +27,13 @@ on:
   schedule:
     - cron: "30 0 * * 1,3,5" # At 00:30 UTC on Monday, Wednesday, and Friday
 
+# A new push to a PR cancels the run for its previous push. Every other
+# run gets a group of its own so that pushes to main and stable, which
+# deploy artifacts, always run to completion.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
 EOF
 

diff --git a/ci/actions-templates/linux-builds-template.yaml b/ci/actions-templates/linux-builds-template.yaml
@@ -14,8 +14,10 @@ jobs: # skip-main skip-pr skip-stable
     strategy:
       fail-fast: false
       matrix:
+        # Every target gets a release build. Targets whose test suite runs
+        # natively on a hosted runner also get a dev build that runs the tests;
+        # those are the `mode: dev` entries under `include` below.
         mode:
-          - dev
           - release
         target:
           - x86_64-unknown-linux-gnu
@@ -48,7 +50,7 @@ jobs: # skip-main skip-pr skip-stable
           - loongarch64-unknown-linux-musl # skip-pr skip-main
         include:
           - target: x86_64-unknown-linux-gnu
-            run_tests: YES
+            mode: dev
             #snap_arch: amd64
           - target: i686-unknown-linux-gnu # skip-pr skip-main
             #snap_arch: i386  # skip-pr skip-main
@@ -57,7 +59,9 @@ jobs: # skip-main skip-pr skip-stable
             # to generate their Dockerfiles.
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-24.04-arm
-            run_tests: YES
+          - target: aarch64-unknown-linux-gnu
+            mode: dev
+            os: ubuntu-24.04-arm
           - target: armv7-unknown-linux-gnueabihf
             #snap_arch: armhf
           - target: powerpc64le-unknown-linux-gnu # skip-pr skip-main
@@ -85,7 +89,7 @@ jobs: # skip-main skip-pr skip-stable
           echo "$HOME/.cargo/bin" >> $GITHUB_PATH
           echo "TARGET=${{ matrix.target }}" >> $GITHUB_ENV
       - name: Skip tests
-        if: matrix.run_tests == '' || matrix.mode == 'release'
+        if: matrix.mode == 'release'
         run: |
           echo "SKIP_TESTS=yes" >> $GITHUB_ENV
       - name: Cache cargo registry and git trees
@@ -95,17 +99,6 @@ jobs: # skip-main skip-pr skip-stable
             ~/.cargo/registry
             ~/.cargo/git
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-      - name: Get rustc commit hash
-        id: cargo-target-cache
-        run: |
-          echo "{rust_hash}={$(rustc -Vv | grep commit-hash | awk '{print $2}')}" >> $GITHUB_OUTPUT
-        shell: bash
-      - name: Cache cargo build
-        uses: actions/cache@v6
-        with:
-          path: target
-          key: ${{ github.base_ref }}-${{ github.head_ref }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ github.base_ref }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}
       - name: Install Rustup using ./rustup-init.sh
         run: |
           sh ./rustup-init.sh --default-toolchain=none --profile=minimal -y
@@ -115,6 +108,28 @@ jobs: # skip-main skip-pr skip-stable
             rustup toolchain uninstall stable
           fi
           rustup toolchain install --profile=minimal stable
+      - name: Compute cache key inputs
+        id: cargo-target-cache
+        env:
+          MERGE_GROUP_BASE_REF: ${{ github.event.merge_group.base_ref }}
+        run: |
+          echo "rust_hash=$(rustc -Vv | grep commit-hash | awk '{print $2}')" >> $GITHUB_OUTPUT
+          # The branch whose caches PR and merge queue builds fall back to.
+          case "$GITHUB_EVENT_NAME" in
+            pull_request) branch="$GITHUB_BASE_REF" ;;
+            merge_group) branch="${MERGE_GROUP_BASE_REF#refs/heads/}" ;;
+            *) branch="$GITHUB_REF_NAME" ;;
+          esac
+          echo "branch=$branch" >> $GITHUB_OUTPUT
+        shell: bash
+      - name: Cache cargo build
+        uses: actions/cache@v6
+        with:
+          path: target
+          key: ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.head_ref }}
+          restore-keys: |
+            ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}-
+            ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-
       - name: Ensure we have our goal target installed
         run: |
           rustup target install "$TARGET"

diff --git a/ci/actions-templates/macos-builds-template.yaml b/ci/actions-templates/macos-builds-template.yaml
@@ -52,17 +52,6 @@ jobs: # skip-x86_64 skip-aarch64
             ~/.cargo/registry
             ~/.cargo/git
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-      - name: Get rustc commit hash
-        id: cargo-target-cache
-        run: |
-          echo "{rust_hash}={$(rustc -Vv | grep commit-hash | awk '{print $2}')}" >> $GITHUB_OUTPUT
-        shell: bash
-      - name: Cache cargo build
-        uses: actions/cache@v6
-        with:
-          path: target
-          key: ${{ github.base_ref }}-${{ github.head_ref }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ github.base_ref }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}
       - name: Install Rustup using ./rustup-init.sh
         run: |
           sh ./rustup-init.sh --default-toolchain=none --profile=minimal -y
@@ -72,6 +61,28 @@ jobs: # skip-x86_64 skip-aarch64
             rustup toolchain uninstall stable
           fi
           rustup toolchain install --profile=minimal stable
+      - name: Compute cache key inputs
+        id: cargo-target-cache
+        env:
+          MERGE_GROUP_BASE_REF: ${{ github.event.merge_group.base_ref }}
+        run: |
+          echo "rust_hash=$(rustc -Vv | grep commit-hash | awk '{print $2}')" >> $GITHUB_OUTPUT
+          # The branch whose caches PR and merge queue builds fall back to.
+          case "$GITHUB_EVENT_NAME" in
+            pull_request) branch="$GITHUB_BASE_REF" ;;
+            merge_group) branch="${MERGE_GROUP_BASE_REF#refs/heads/}" ;;
+            *) branch="$GITHUB_REF_NAME" ;;
+          esac
+          echo "branch=$branch" >> $GITHUB_OUTPUT
+        shell: bash
+      - name: Cache cargo build
+        uses: actions/cache@v6
+        with:
+          path: target
+          key: ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.head_ref }}
+          restore-keys: |
+            ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}-
+            ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-
       - name: Ensure we have our goal target installed
         run: |
           rustup target install "$TARGET"

diff --git a/ci/actions-templates/windows-builds-template.yaml b/ci/actions-templates/windows-builds-template.yaml
@@ -21,8 +21,10 @@ jobs: # skip-main skip-pr skip-stable
     strategy:
       fail-fast: false
       matrix:
+        # Every target gets a release build. Targets whose test suite runs
+        # natively on a hosted runner also get a dev build that runs the tests;
+        # those are the `mode: dev` entries under `include` below.
         mode:
-          - dev
           - release
         target:
           - x86_64-pc-windows-msvc
@@ -33,7 +35,7 @@ jobs: # skip-main skip-pr skip-stable
           - aarch64-pc-windows-gnullvm
         include:
           - target: x86_64-pc-windows-msvc
-            run_tests: YES
+            mode: dev
           - target: x86_64-pc-windows-gnu
             arch: x86_64
             mingwdir: mingw64
@@ -42,7 +44,10 @@ jobs: # skip-main skip-pr skip-stable
             # Architecture of the rustup build that installs Rust in this workflow.
             rustup_arch: aarch64
             os: windows-11-arm
-            run_tests: YES
+          - target: aarch64-pc-windows-msvc
+            mode: dev
+            rustup_arch: aarch64
+            os: windows-11-arm
           - target: aarch64-pc-windows-gnullvm
             rustup_arch: aarch64
             os: windows-11-arm
@@ -108,7 +113,7 @@ jobs: # skip-main skip-pr skip-stable
           echo "${env:USERPROFILE}\.cargo\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
           echo "TARGET=${{ matrix.target }}" | Out-File -Append -FilePath $env:GITHUB_ENV -Encoding utf8
       - name: Skip tests
-        if: matrix.run_tests == '' || matrix.mode == 'release'
+        if: matrix.mode == 'release'
         run: |
           echo "SKIP_TESTS=yes" >> $GITHUB_ENV
         shell: bash
@@ -119,17 +124,6 @@ jobs: # skip-main skip-pr skip-stable
             ~/.cargo/registry
             ~/.cargo/git
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-      - name: Get rustc commit hash
-        id: cargo-target-cache
-        run: |
-          echo "{rust_hash}={$(rustc -Vv | grep commit-hash | awk '{print $2}')}" >> $GITHUB_OUTPUT
-        shell: bash
-      - name: Cache cargo build
-        uses: actions/cache@v6
-        with:
-          path: target
-          key: ${{ github.base_ref }}-${{ github.head_ref }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ github.base_ref }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}
       - name: Install Rustup using win.rustup.rs
         env:
           RUSTUP_ARCH: ${{ matrix.rustup_arch || 'x86_64' }}
@@ -141,6 +135,28 @@ jobs: # skip-main skip-pr skip-stable
           del rustup-init.exe
       - name: Ensure stable toolchain is up to date
         run: rustup update stable
+      - name: Compute cache key inputs
+        id: cargo-target-cache
+        env:
+          MERGE_GROUP_BASE_REF: ${{ github.event.merge_group.base_ref }}
+        run: |
+          echo "rust_hash=$(rustc -Vv | grep commit-hash | awk '{print $2}')" >> $GITHUB_OUTPUT
+          # The branch whose caches PR and merge queue builds fall back to.
+          case "$GITHUB_EVENT_NAME" in
+            pull_request) branch="$GITHUB_BASE_REF" ;;
+            merge_group) branch="${MERGE_GROUP_BASE_REF#refs/heads/}" ;;
+            *) branch="$GITHUB_REF_NAME" ;;
+          esac
+          echo "branch=$branch" >> $GITHUB_OUTPUT
+        shell: bash
+      - name: Cache cargo build
+        uses: actions/cache@v6
+        with:
+          path: target
+          key: ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}-${{ github.head_ref }}
+          restore-keys: |
+            ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-${{ hashFiles('**/Cargo.lock') }}-
+            ${{ steps.cargo-target-cache.outputs.branch }}-${{ matrix.target }}-${{ matrix.mode }}-cargo-target-dir-${{ steps.cargo-target-cache.outputs.rust_hash }}-
       - name: Install the target
         run: |
           rustup target install ${{ matrix.target }}
@@ -150,10 +166,12 @@ jobs: # skip-main skip-pr skip-stable
           BUILD_PROFILE: ${{ matrix.mode }}
         run: bash ci/run.bash
       - name: Run cargo clippy
-        if: matrix.mode == 'release' && matrix.mingwdir == ''
+        # The Linux check job only sees `cfg(unix)` code, so lint the
+        # `cfg(windows)` code here too. The source has no `target_env` or
+        # `target_arch` gates, so one Windows target covers all of them.
+        if: matrix.mode == 'release' && matrix.target == 'x86_64-pc-windows-msvc'
         env:
           TARGET: ${{ matrix.target }}
-        # os-specific code leads to lints escaping if we only run this in one target
         run: |
           rustup component add clippy
           cargo clippy --all-targets --all-features -- -D warnings

diff --git a/ci/run.bash b/ci/run.bash
@@ -54,7 +54,14 @@ target_cargo() {
     cargo "${cmd}" --locked --profile "$BUILD_PROFILE" --target "$TARGET" "${FEATURES[@]}" "$@"
 }
 
-target_cargo build
+# Jobs that skip the tests exist to produce the binary, so build just that.
+# Jobs that run the tests build the binary again below with the `test`
+# feature, and the release job for the same target already covers the
+# build without it, so don't build it twice here.
+if [ -n "$SKIP_TESTS" ]; then
+  target_cargo build
+  exit 0
+fi
 
 # Machines have 7GB of RAM, and our target/ contents is large enough that
 # thrashing will occur if we build-run-build-run rather than
@@ -84,8 +91,6 @@ build_test() {
   fi
 }
 
-if [ -z "$SKIP_TESTS" ]; then
-  target_cargo run --features test -- --dump-testament
-  build_test build
-  RUSTUP_CI=1 build_test test
-fi
+target_cargo run --features test -- --dump-testament
+build_test build
+RUSTUP_CI=1 build_test test