ci: cache each job (#2025)

Author: Mirko-von-Leipzig

.github/workflows/ci.yml

@@ -1,6 +1,6 @@
 # Continuous integration jobs.
 #
-# These get run on every pull-request.
+# These get run on every pull-request, with Warp caches updated on push into `main` or `next`.
 name: CI
 
 permissions:
@@ -23,33 +23,12 @@ on:
       - "docs/**"
 
 env:
-  # Shared prefix key for the rust cache.
+  # Shared prefix key for the Rust caches.
   #
-  # This provides a convenient way to evict old or corrupted cache.
-  RUST_CACHE_PREFIX: rust-cache
-  # Shared branch-aware cache namespace for rust-cache.
-  #
-  # Pushes save to the persistent trunk cache, while pull requests append the
-  # PR number so they save into an ephemeral PR-specific cache.
-  #
-  # The format is <main | next> with an optional `-pr-<PR>` for pull requests.
-  # We default to next if no suitable is found.
-  RUST_CACHE_SUFFIX: >-
-    ${{
-      format(
-        '{0}{1}',
-        github.base_ref == 'main' && 'main'
-        || github.base_ref == 'next' && 'next'
-        || github.ref == 'refs/heads/main' && 'main'
-        || github.ref == 'refs/heads/next' && 'next'
-        || 'next',
-        github.event_name == 'pull_request'
-        && format('-pr-{0}', github.event.pull_request.number)
-        || ''
-      )
-    }}
-  # Match rust-cache's compilation mode so restored outputs stay reusable downstream.
-  CARGO_INCREMENTAL: 0
+  # Cache is trunk specific (next|main).
+  CACHE_PREFIX: rust-cache-${{ github.base_ref || github.ref_name }}
+  # Only trusted branch pushes should update caches; PRs restore from the target branch cache.
+  SAVE_CACHE: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/next') }}
   # Reduce cache usage by removing debug information.
   CARGO_PROFILE_DEV_DEBUG: 0
 
@@ -60,11 +39,10 @@ concurrency:
 
 jobs:
   # ===============================================================================================
-  # Conventional builds, lints and tests that re-use a single cache for efficiency
+  # Conventional builds, lints and tests
   # ===============================================================================================
 
-  # Normal cargo build that saves either the persistent trunk cache or a
-  # single per-run cache for downstream jobs to restore immediately.
+  # Normal cargo build that verifies the workspace compiles.
   build:
     runs-on: warp-ubuntu-latest-x64-8x
     steps:
@@ -77,10 +55,9 @@ jobs:
         run: rustup toolchain install --no-self-update
       - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
         with:
-          shared-key: ${{ env.RUST_CACHE_SUFFIX }}
-          prefix-key: ${{ env.RUST_CACHE_PREFIX }}
-          cache-workspace-crates: true
-          save-if: true
+          shared-key: ${{ github.job }}
+          prefix-key: ${{ env.CACHE_PREFIX }}
+          save-if: ${{ env.SAVE_CACHE }}
       - name: cargo build
         run: cargo build --workspace --all-targets --locked
       - name: Check static linkage
@@ -124,7 +101,6 @@ jobs:
   clippy:
     name: lint - clippy
     runs-on: warp-ubuntu-latest-x64-8x
-    needs: [build]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -133,16 +109,14 @@ jobs:
         run: rustup toolchain install --no-self-update
       - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
         with:
-          shared-key: ${{ env.RUST_CACHE_SUFFIX }}
-          prefix-key: ${{ env.RUST_CACHE_PREFIX }}
-          cache-workspace-crates: true
-          save-if: false
+          shared-key: ${{ github.job }}
+          prefix-key: ${{ env.CACHE_PREFIX }}
+          save-if: ${{ env.SAVE_CACHE }}
       - name: clippy
         run: cargo clippy --locked --all-targets --all-features --workspace -- -D warnings
 
   tests:
     runs-on: warp-ubuntu-latest-x64-8x
-    needs: [build]
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -155,10 +129,9 @@ jobs:
           tool: nextest@0.9.122
       - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
         with:
-          shared-key: ${{ env.RUST_CACHE_SUFFIX }}
-          prefix-key: ${{ env.RUST_CACHE_PREFIX }}
-          cache-workspace-crates: true
-          save-if: false
+          shared-key: ${{ github.job }}
+          prefix-key: ${{ env.CACHE_PREFIX }}
+          save-if: ${{ env.SAVE_CACHE }}
       - name: Build tests
         run: cargo nextest run --all-features --workspace --no-run
       - name: Run tests
@@ -167,7 +140,6 @@ jobs:
         run: cargo test --doc --workspace --all-features
 
   doc:
-    needs: [build]
     runs-on: warp-ubuntu-latest-x64-8x
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -177,17 +149,15 @@ jobs:
         run: rustup toolchain install --no-self-update
       - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
         with:
-          shared-key: ${{ env.RUST_CACHE_SUFFIX }}
-          prefix-key: ${{ env.RUST_CACHE_PREFIX }}
-          cache-workspace-crates: true
-          save-if: false
+          shared-key: ${{ github.job }}
+          prefix-key: ${{ env.CACHE_PREFIX }}
+          save-if: ${{ env.SAVE_CACHE }}
       - name: Build docs
         run: cargo doc --no-deps --workspace --all-features --locked
 
   # Ensure the stress-test still functions by running some cheap benchmarks.
   stress-test:
     name: stress test
-    needs: [build]
     runs-on: warp-ubuntu-latest-x64-8x
     timeout-minutes: 20
     env:
@@ -200,10 +170,9 @@ jobs:
         run: rustup toolchain install --no-self-update
       - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
         with:
-          shared-key: ${{ env.RUST_CACHE_SUFFIX }}
-          prefix-key: ${{ env.RUST_CACHE_PREFIX }}
-          cache-workspace-crates: true
-          save-if: false
+          shared-key: ${{ github.job }}
+          prefix-key: ${{ env.CACHE_PREFIX }}
+          save-if: ${{ env.SAVE_CACHE }}
       - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
         with:
           tool: nextest@0.9.122
@@ -216,12 +185,12 @@ jobs:
           cargo run --bin miden-node-stress-test seed-store \
             --data-directory ${{ env.DATA_DIR }} \
             --num-accounts 500 --public-accounts-percentage 50
-      # TODO re-introduce
+  # TODO re-introduce
       # - name: Benchmark state sync
-      # run: |
-      # cargo run --bin miden-node-stress-test benchmark-store \
-      # --data-directory ${{ env.DATA_DIR }} \
-      # --iterations 10 --concurrency 1 sync-state
+        # run: |
+          # cargo run --bin miden-node-stress-test benchmark-store \
+            # --data-directory ${{ env.DATA_DIR }} \
+            # --iterations 10 --concurrency 1 sync-state
       - name: Benchmark notes sync
         run: |
           cargo run --bin miden-node-stress-test benchmark-store \
@@ -233,48 +202,13 @@ jobs:
             --data-directory ${{ env.DATA_DIR }} \
             --iterations 10 --concurrency 1 sync-nullifiers --prefixes 10
 
-  cleanup-run-cache:
-    name: cleanup run cache
-    runs-on: ubuntu-24.04
-    if: ${{ always() && github.event_name == 'pull_request' }}
-    needs:
-      - build
-      - clippy
-      - tests
-      - doc
-      - stress-test
-    permissions:
-      actions: write
-      contents: read
-    steps:
-      - name: Delete PR rust cache
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          mapfile -t cache_entries < <(
-            gh api \
-              -H "Accept: application/vnd.github+json" \
-              "/repos/${{ github.repository }}/actions/caches?key=${{ env.RUST_CACHE_PREFIX }}&ref=${{ github.ref }}" \
-              --jq '.actions_caches[] | @json'
-          )
-          for cache_entry in "${cache_entries[@]}"; do
-            cache_id="$(jq -r '.id' <<< "${cache_entry}")"
-            cache_key="$(jq -r '.key' <<< "${cache_entry}")"
-            echo "Deleting rust cache key=${cache_key}"
-            gh api \
-              --method DELETE \
-              -H "Accept: application/vnd.github+json" \
-              "/repos/${{ github.repository }}/actions/caches/${cache_id}"
-          done
-
   # ===============================================================================================
   # WASM related jobs
   # ===============================================================================================
 
   # Tests the miden-remote-prover-client WASM support.
   #
-  # The WASM build is incompatible with the build job's cache, thankfully this compilation is fairly
-  # quick so we don't need a separate cache here.
+  # The WASM build is incompatible with native build caches, so it uses a dedicated cache.
   client-wasm:
     name: wasm targets
     runs-on: warp-ubuntu-latest-x64-8x
@@ -284,6 +218,11 @@ jobs:
           persist-credentials: false
       - name: Rustup
         run: rustup toolchain install --no-self-update
+      - uses: WarpBuilds/rust-cache@9d0cc3090d9c87de74ea67617b246e978735b1a1 # v2.9.1
+        with:
+          shared-key: ${{ github.job }}
+          prefix-key: ${{ env.CACHE_PREFIX }}
+          save-if: ${{ env.SAVE_CACHE }}
       - name: cargo build
         run: |
           cargo build --locked -p miden-remote-prover-client \