[Mavrick-F]

Summary

The repository's Actions cache is at GitHub's 10 GB limit (10.6 GB in 67 entries, the oldest two days old), and GitHub evicts the least recently used entries first. Caches pull requests use all day stay warm. A cache used once a day is gone by the next. Two kinds of cache were saved and never restored:

• The nightly's test caches. test-rust.yml kept the nightly's cache apart (key: release) so that the release build wouldn't bloat the cache pull requests restore. Saved every night, it was evicted before the next one: on the last three nights all four platforms logged No cache found and built from nothing, 30 to 75 minutes each. A run with the release build (the nightly, ci:full) now restores main's test cache and saves nothing. Its test build starts warm; the release build itself still compiles from nothing, as it did when its cache was evicted.
• Each pull request's preview build. docs-preview.yml saved a 435 MB cache per pull request, which only later pushes to that pull request could restore. The first preview of each pull request built from nothing (12 to 13 minutes, against 9 to 11 warm). The preview now shares the cache of web-deploy.yml, which builds the same app on main with the same commands (trunk build --release, xtask web-pwa). It restores that cache and saves none, and web-deploy.yml saves it only from pushes to main, not from a run started by hand on another ref.

That takes about 3 GB a night and 435 MB per pull request out of the cache, leaving room for main's caches to stay. It should also keep the nightly's Census files (16 MB), which were evicted every day (#1550).

Testing

• The three workflow files parse. No step changes; only the rust-cache settings do.
• Cache keys: with shared-key: web, both web builds use the key v0-rust-web-Linux-x64-<env>-<lock>, built from the same toolchain, environment and lock file. The nightly and ci:full now use the same key as main's Test job, which runs on the same runners with the same environment.
• What it does is seen in the next runs: the nightly's test jobs should log Restored from cache key "v0-rust-test-…", and a pull request's first preview Restored from cache key "v0-rust-web-…" once main has deployed after this change.

UI evidence

No visible UI change.

Related issue

Follow-up to #1550, which found the nightly's Census cache evicted every day.

Summary by CodeRabbit

• Chores
  • Updated build workflows to share the Rust cache across web builds, documentation previews, and Rust tests.
  • Documentation previews and release-build test runs can restore the shared cache but do not save cache updates.
  • Rust tests save cache updates only on the main branch when they are not release builds; web deployments save updates only for push events.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Three GitHub Actions workflows now use the shared Rust cache key web. Cache saving is disabled for docs preview and release-build runs, and is limited to push events in the web deployment workflow.

Changes: Rust cache configuration

Layer / File(s)	Summary
Configure shared Rust cache policy .github/workflows/test-rust.yml, .github/workflows/web-deploy.yml, .github/workflows/docs-preview.yml	The workflows use the shared web cache key. Docs preview runs do not save cache updates. Release-build runs do not save cache updates, and the separate release cache key is removed. The web deployment workflow saves cache updates only for push events.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: giswqs

Merge Risk: Minimal · up to 2cb6d

The cache changes are ready to merge; normal workflow checks should confirm restoration.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title identifies the cache-sharing changes for nightly tests and previews.
Description check		The description covers the changes, rationale, testing, UI impact, and related issue. It notes that cache restoration requires verification in later runs.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the cache at dawn,
The shared key waits for builds to run.
Preview restores, then leaves it be,
Push events save what they can see.
The rabbit hops as workflows pass.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 96fe377b-abf2-4ca6-b93f-3203b62f0cf1

Commits

Reviewing files that changed from the base of the PR and between c0156c3 and 2cb6d2e.

Files selected for processing: 1

• .github/workflows/web-deploy.yml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 4 remain after this review.

[github-actions]

Security (low confidence, about 30%): this key now links untrusted runs to the deploy job's cache. Before this PR, docs-preview.yml (which runs pull request code with no secrets) had its own per-PR key, so web-deploy.yml never restored anything a PR could influence. With shared-key: web, a preview restores the same key that the deploy job, which holds WEB_DEPLOY_KEY, restores and saves. A PR cannot write that key, because docs-preview.yml sets save-if: false and PR-scoped caches are not visible to main. The remaining writer is workflow_dispatch: a maintainer who dispatches this workflow from main with an arbitrary ref input saves a main-scoped cache. Its key includes the Cargo.lock hash and rust-cache does not save the workspace's own crates, so the impact is limited. But a restore-key prefix match could still hand previews a cache built from that ref's dependencies. Options to consider: save only on push (github.event_name == 'push'), or give previews a key that dispatches cannot write. Not blocking if the maintainers accept that trust boundary.

[Mavrick-F]

Fixed in 2cb6d2e: web-deploy.yml saves the web cache only on push (save-if: ${{ github.event_name == 'push' }}), so a run started by hand on another ref restores it but writes nothing previews could restore. Previews still save nothing.

[github-actions]

Code review

Bugs: None found. I checked the save-if expressions in test-rust.yml, the ci-label.yml trigger (pull_request, so its ref is never main), and the three callers of the reusable workflow (ci.yml, ci-label.yml, nightly.yml). The save guard holds in each case.

Security:

• The shared web cache key now links PR preview runs (untrusted code, no secrets) to the cache that the deploy job (which holds WEB_DEPLOY_KEY) restores. PRs cannot write that key, because docs-preview.yml sets save-if: false, so no direct poisoning path exists. The remaining writer is a workflow_dispatch of web-deploy.yml with an arbitrary ref. The impact is limited, but previews now read that cache. Posted inline on web-deploy.yml:49. Confidence about 30%.

Performance: None. The change removes a 435 MB per-PR cache save and the nightly's release-keyed save, which reduces cache pressure.

Quality:

• The PR body says the nightly's dependencies and test build start warm. That holds for the debug test build. The cargo build --release step still compiles release-profile dependencies cold each night, as it effectively did before, since the old cache was evicted. Worth stating precisely in the PR body. Confidence 90%.
• The shared-key claim relies on rust-cache resolving the callee job id (test) rather than the caller's job id, since the callers use different job ids (test in ci.yml, rust in the other two). The PR's planned check (the log line Restored from cache key "v0-rust-test-…" in the next nightly) would confirm it. Confidence about 80% that the claim holds.

AGENTS.md: No violations. The workflow files fall outside the Rust and asset rules, and the comments and the save-if logic follow the repository's cache conventions.

Already raised in earlier threads: none. prior-reviews.json contains no threads, so I left nothing out.

Change size

Compared with main (merge base c506aa1 to PR head c0156c3).

Measure	Value
Files changed	3 (0 added, 3 modified, 0 removed, 0 renamed)
Size before	13.4 KB (13,672 B)
Size after	13.8 KB (14,165 B)
Total size change	+493 B

Path	Before	After	Change
.github/workflows/docs-preview.yml	4.1 KB (4,233 B)	4.4 KB (4,457 B)	+224 B
.github/workflows/web-deploy.yml	6.7 KB (6,893 B)	6.9 KB (7,091 B)	+198 B
.github/workflows/test-rust.yml	2.5 KB (2,546 B)	2.6 KB (2,617 B)	+71 B

[github-actions]

📖 Docs preview

Item	Value
Preview	https://preview.rustgis.app/pr-1558/
Web app	https://preview.rustgis.app/pr-1558/app/
Commit	2cb6d2e

GitHub Pages takes a minute or two to publish a new commit. Newer commits from the fork aren't published until a maintainer adds the preview label (once per commit).

[github-actions]

Code review

Reviewed the three workflow changes (test-rust.yml, docs-preview.yml, web-deploy.yml) against the callers (ci.yml, ci-label.yml, nightly.yml), .github/scripts/platforms.sh, and the prior thread. I found no bugs, security issues or AGENTS.md violations, and I'm not posting inline comments because nothing rises to a finding. The cache behaviour itself (shared-key, save-if: false, restore fallback) is a runtime property of Swatinem/rust-cache that I can't check offline, so it still needs confirming in the next nightly and preview runs, as the PR says.

Bugs: None found.

• Both save-if expressions evaluate to booleans. ci.yml and ci-label.yml pass release-build as a boolean, and the input defaults to false, so the non-nightly paths still save on main as before. (High confidence)
• The nightly's hard-coded OS list matches what platforms.sh emits for pushes to main, so its restored Test cache is the one main produces on the same runners. (High confidence)

Security: None new.

• Previews (docs-preview.yml) only restore and never save (save-if: false), so they can't write to the main-scoped web cache that the deploy job reads.
• web-deploy.yml saves only on push, which the trigger limits to main. That closes the workflow_dispatch path with an arbitrary ref.
• WEB_DEPLOY_KEY is written to $HOME/.ssh, and the analytics ID is injected into dist/ after the build, so neither reaches the cached cargo/target directories. (Medium-high confidence)
• The earlier bot thread on web-deploy.yml:50 is answered by commit 2cb6d2e, which the diff confirms.

Performance:

• The release build of ci:full now always compiles from nothing. Before, it could restore the nightly's release cache if that survived eviction. The PR says it didn't survive, so the practical cost is small, and the author acknowledges the trade-off. (Medium confidence, low impact)

Quality:

• Nothing worth raising. save-if: false is a literal while the other sites use expressions, which is consistent enough. The comments explain the reasoning accurately. (High confidence)

AGENTS.md:

• No violations. The change is workflow-only, so no code, layering, wasm, i18n or asset rules apply, and no dependency changed.

Already raised, left alone: 1 earlier thread (web-deploy.yml:50, the shared-key security concern). It is answered and the fix is in the diff. I did not re-raise it.

Change size

Compared with main (merge base c506aa1 to PR head 2cb6d2e).

Measure	Value
Files changed	3 (0 added, 3 modified, 0 removed, 0 renamed)
Size before	13.4 KB
Size after	14.0 KB
Total size change	+674 B

Path	Before	After	Change
.github/workflows/web-deploy.yml	6.7 KB	7.1 KB	+379 B
.github/workflows/docs-preview.yml	4.1 KB	4.4 KB	+224 B
.github/workflows/test-rust.yml	2.5 KB	2.6 KB	+71 B