263ebe1495
The rust job cost 21m44s on every PR while only ~1 PR in 40 touches src-tauri/, and the runner has capacity 1 — the frontend job queues behind it, so every PR paid ~24.5 min of feedback. Measured on run 326 (2026-07-21), 12m15s of that was pure waste: - 6m54s tarring target/ and the cargo registry for saves that time out against the runner's unreachable cache server (#234). The restore times out into a miss too, so nothing was ever cached at either end. - 4m41s recompiling cargo-audit from source on every run. - ~40s on the two doomed restores. Split check.yml into check-rust.yml (paths: src-tauri/**) and check-frontend.yml (paths-ignore denylist), drop every actions/cache step until #234 is fixed, and install cargo-audit as a prebuilt binary via taiki-e/install-action. The audit step keeps continue-on-error — advisories are informational and can land on unrelated crates — but loses the `|| true` that also hid tooling failures; the install step is blocking. The frontend filter is a denylist on purpose: that job costs ~2.5 min, so running it needlessly is cheap while silently not running it is not. The expensive job keeps a strict allowlist. Neither workflow filters on `branches:` anymore. `branches: [main]` never matched a PR stacked on another feature branch, which is what /autopilot produces: PRs #305-#308 of the feature-gating milestone ran no CI at all. Adds audit.yml for daily RustSec coverage, since check-rust.yml now only runs on Rust PRs. It skips the Rust toolchain entirely — cargo-audit only reads Cargo.lock — so it costs ~1-2 min rather than the ~22 a scheduled check-rust would burn daily on a capacity-1 runner. The GitHub mirror is left untouched (#233: it receives no PRs). Expected: Rust PR ~9-10 min, frontend-only PR ~2.5 min instead of ~24.5. Resolves #232
88 lines
3.6 KiB
YAML
88 lines
3.6 KiB
YAML
name: PR Check — Rust
|
|
|
|
# Rust half of the former check.yml (split in #232).
|
|
#
|
|
# Only runs when Rust actually changes. On this repo roughly 1 PR in 40 touches
|
|
# src-tauri/, and the runner has capacity 1 — jobs queue instead of running in
|
|
# parallel, so every minute spent here is a minute the next PR waits.
|
|
#
|
|
# No `branches:` filter on purpose. `branches: [main]` never matched a PR
|
|
# stacked on top of another feature branch, which is what /autopilot produces:
|
|
# 4 of the 5 PRs in the feature-gating milestone ran no CI at all.
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'src-tauri/**'
|
|
- '.forgejo/workflows/check-rust.yml'
|
|
|
|
# Cancel obsolete runs (e.g. on force-push) so only the latest commit runs.
|
|
# Distinct from the frontend group: a shared group would make the two
|
|
# workflows cancel each other on a PR that touches both.
|
|
concurrency:
|
|
group: ci-rust-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
rust:
|
|
runs-on: ubuntu
|
|
container: ubuntu:22.04
|
|
env:
|
|
PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
CARGO_TERM_COLOR: always
|
|
# Nothing persists between runs (see the caching note below), so
|
|
# incremental artifacts get written and never reused — pure overhead.
|
|
# Test debug info is dead weight here for the same reason.
|
|
CARGO_INCREMENTAL: 0
|
|
CARGO_PROFILE_TEST_DEBUG: 0
|
|
steps:
|
|
- name: Install system dependencies, Node.js and Rust
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
curl wget git ca-certificates build-essential pkg-config \
|
|
libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libssl-dev \
|
|
libdbus-1-dev
|
|
# Node.js is required by actions/checkout and taiki-e/install-action
|
|
# (they are JavaScript actions and need `node` in the container PATH).
|
|
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
|
apt-get install -y nodejs
|
|
# Rust toolchain
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
|
|
node --version
|
|
rustc --version
|
|
cargo --version
|
|
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
# No actions/cache step here, deliberately. The job container cannot
|
|
# reach the runner's cache server (#234): the restore times out into a
|
|
# miss AND the save times out, so the cache cost ~7 min per run and
|
|
# returned nothing. Bring caching back through Swatinem/rust-cache once
|
|
# #234 is fixed — not before, it shares the same backend.
|
|
|
|
- name: cargo check
|
|
run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets
|
|
|
|
- name: cargo test
|
|
run: cargo test --manifest-path src-tauri/Cargo.toml --all-targets
|
|
|
|
# Prebuilt binary. `cargo install --locked cargo-audit` recompiled the
|
|
# tool from source on every single run (~4m40s). No continue-on-error:
|
|
# a tooling failure should fail the job rather than be swallowed.
|
|
- name: Install cargo-audit
|
|
uses: https://github.com/taiki-e/install-action@v2
|
|
with:
|
|
tool: cargo-audit
|
|
|
|
# Advisories are informational — they can land on unrelated crates and
|
|
# would otherwise stall unrelated work — so the step is non-blocking.
|
|
# It no longer hides real failures behind `|| true` though. Daily
|
|
# RustSec coverage outside Rust PRs lives in audit.yml.
|
|
- name: cargo audit
|
|
continue-on-error: true
|
|
run: cargo audit --file src-tauri/Cargo.lock
|