From 45e5e81c3ee6e61e293f186e96f0a88baf6e7fbb Mon Sep 17 00:00:00 2001 From: Wes Date: Fri, 7 Aug 2026 12:15:03 -0600 Subject: [PATCH 1/2] perf(ci): experiment with sccache for relay builds Reuse unchanged workspace compilation units when the exact relay artifact cache misses. Keep pull requests read-only, preserve trusted push writes for main and release, and stop creating isolated PR artifact caches that cannot warm other refs. Co-authored-by: Carl Signed-off-by: Wes --- .github/workflows/ci.yml | 16 +++++++++++++++- Cargo.toml | 4 ++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 299fc9efe75..279c1ba2a33 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -317,6 +317,9 @@ jobs: if: github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true' permissions: contents: read + env: + SCCACHE_GHA_ENABLED: "true" + SCCACHE_GHA_RW_MODE: ${{ github.event_name == 'push' && 'READ_WRITE' || 'READ_ONLY' }} steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 @@ -341,6 +344,13 @@ jobs: . desktop/src-tauri save-if: ${{ github.event_name != 'pull_request' }} + # Cache rustc outputs for unchanged workspace crates. PRs restore trusted + # push caches read-only; only main and release pushes write shared outputs. + - name: Set up sccache + if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 + with: + version: v0.16.0 - name: Install cargo-nextest if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15 @@ -348,6 +358,8 @@ jobs: tool: cargo-nextest@0.9.136 - name: Build relay artifacts if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' + env: + RUSTC_WRAPPER: sccache run: | cargo build --profile ci -p buzz-relay -p git-credential-nostr cargo nextest archive \ @@ -359,7 +371,9 @@ jobs: --test e2e_event_reminder \ --archive-file target/ci/backend-integration-tests.tar.zst - name: Save relay artifacts cache - if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' + # PR-scoped exact-source entries cannot warm main or other PRs and churn + # the shared cache pool. sccache provides read-only PR reuse instead. + if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' && github.event_name == 'push' uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: | diff --git a/Cargo.toml b/Cargo.toml index cc1dd0f9dff..98d68fb5215 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -148,8 +148,8 @@ buzz-relay-mesh = { path = "crates/buzz-relay-mesh" } # release optimization (warm from main's cache; they carry the runtime hot # path: tokio/sqlx/axum). Workspace crates build at opt-level 1 — enough for # stable e2e timing (PR #307 flakiness was opt-0 + debug-assertions) at -# roughly half the codegen cost. `incremental` is irrelevant in CI: -# rust-cache exports CARGO_INCREMENTAL=0 and never caches member artifacts. +# roughly half the codegen cost. Incremental stays disabled: rust-cache exports +# CARGO_INCREMENTAL=0, and the CI compiler cache requires non-incremental units. [profile.ci] inherits = "release" lto = false From 54cfe936c87a90c44388c592f3dc992abfc9edc0 Mon Sep 17 00:00:00 2001 From: Wes Date: Fri, 7 Aug 2026 13:02:46 -0600 Subject: [PATCH 2/2] ci: allow isolated sccache proof on PR 5224 Let only PR 5224 write compiler outputs to its PR-scoped cache during the bounded experiment. Document the matching cache-poisoning suppression; the trial output cannot be restored by main, release, or unrelated pull requests. Co-authored-by: Carl Signed-off-by: Wes --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 279c1ba2a33..46277cbb6fe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -319,7 +319,7 @@ jobs: contents: read env: SCCACHE_GHA_ENABLED: "true" - SCCACHE_GHA_RW_MODE: ${{ github.event_name == 'push' && 'READ_WRITE' || 'READ_ONLY' }} + SCCACHE_GHA_RW_MODE: ${{ (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.number == 5224)) && 'READ_WRITE' || 'READ_ONLY' }} steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 @@ -344,11 +344,11 @@ jobs: . desktop/src-tauri save-if: ${{ github.event_name != 'pull_request' }} - # Cache rustc outputs for unchanged workspace crates. PRs restore trusted - # push caches read-only; only main and release pushes write shared outputs. + # Cache rustc outputs for unchanged workspace crates. Trusted pushes write; + # the bounded PR 5224 trial writes only to its isolated merge-ref scope. - name: Set up sccache if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' - uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 # zizmor: ignore[cache-poisoning] Bounded trial: only PR 5224 writes to its isolated merge-ref scope; trusted pushes retain production writes. with: version: v0.16.0 - name: Install cargo-nextest