fix(ci): prevent poisoned Rust caches

.github/workflows/ci.yml

@@ -87,6 +87,10 @@ jobs:
           scripts/test-mobile-release-candidate-publisher.sh
       - name: Mobile worktree identity contract
         run: scripts/test-mobile-worktree-overrides.sh
+      - name: Rust cache contract
+        run: |
+          scripts/test-rust-cache-contract.sh
+          scripts/test-rust-cache-contract-regressions.sh
       - name: File size policy
         run: just file-size-check
 
@@ -101,7 +105,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
       - name: Format check
@@ -123,8 +127,9 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
+          key: sherpa-cache-v1
           save-if: ${{ github.event_name != 'pull_request' }}
       - name: Install cargo-nextest
         uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
@@ -147,7 +152,7 @@ jobs:
           fetch-depth: 2
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
           workspaces: desktop/src-tauri
           save-if: ${{ github.event_name != 'pull_request' }}
@@ -340,7 +345,7 @@ jobs:
           key: relay-artifacts-${{ runner.os }}-${{ hashFiles('crates/**', 'migrations/**', 'Dockerfile', 'Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo/config.toml', '.github/workflows/ci.yml') }}
       - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
         with:
           workspaces: |
@@ -763,7 +768,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
       # Reuse the relay + git-credential-nostr built by Desktop E2E Relay
@@ -952,7 +957,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
           key: cross-${{ matrix.target }}
           save-if: ${{ github.event_name != 'pull_request' }}
@@ -993,7 +998,7 @@ jobs:
       # toolchain (1.95.0 + clippy via profile = default) comes from the
       # repo-root rust-toolchain.toml, which the runner's preinstalled rustup
       # honors on demand; the host triple already is x86_64-pc-windows-msvc.
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
           workspaces: |
             .
@@ -1070,7 +1075,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
           workspaces: desktop/src-tauri
           save-if: ${{ github.event_name != 'pull_request' }}

.github/workflows/mesh-lifecycle.yml

@@ -55,7 +55,7 @@ jobs:
 
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
 

.github/workflows/release.yml

@@ -511,7 +511,7 @@ jobs:
 
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
         with:
           workspaces: desktop/src-tauri
           lookup-only: true

renovate.json

@@ -23,6 +23,12 @@
       "separateMinorPatch": true,
       "separateMultipleMinor": false
     },
+    {
+      "description": "rust-cache v2.9.2 cleanup can preserve sherpa's prebuilt directory after removing its static archive, poisoning warm Unit Tests caches. Keep v2.9.1 until the action or sherpa validates the archive before reuse.",
+      "matchManagers": ["github-actions"],
+      "matchPackageNames": ["Swatinem/rust-cache"],
+      "allowedVersions": "<=2.9.1"
+    },
     {
       "description": "evalexpr v13 relicensed from MIT to AGPL-3.0 — pin below v13 until migrated to an MIT alternative.",
       "matchPackageNames": ["evalexpr"],

scripts/test-rust-cache-contract-regressions.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root=$(cd "$(dirname "$0")/.." && pwd)
+known_good='e18b497796c12c097a38f9edb9d0641fb99eee32'
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+mkdir -p "$tmp/.github/workflows"
+cp "$root"/.github/workflows/*.yml "$tmp/.github/workflows/"
+for workflow in "$root"/.github/workflows/*.yaml; do
+  [[ -e "$workflow" ]] || continue
+  cp "$workflow" "$tmp/.github/workflows/"
+done
+cp "$root/renovate.json" "$tmp/renovate.json"
+
+run_contract() {
+  BUZZ_RUST_CACHE_CONTRACT_ROOT="$tmp" "$root/scripts/test-rust-cache-contract.sh"
+}
+
+expect_failure() {
+  local expected=$1
+  local output
+  if output=$(run_contract 2>&1); then
+    echo "expected rust cache contract failure containing: $expected" >&2
+    exit 1
+  fi
+  if [[ "$output" != *"$expected"* ]]; then
+    printf 'unexpected rust cache contract error:\n%s\n' "$output" >&2
+    exit 1
+  fi
+}
+
+write_cache_workflow() {
+  cat > "$tmp/.github/workflows/new-cache-user.yaml"
+}
+
+run_contract >/dev/null
+
+write_cache_workflow <<'YAML'
+name: Bad digest
+on: workflow_dispatch
+jobs:
+  cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+YAML
+expect_failure 'restored rust-cache v2.9.2'
+
+write_cache_workflow <<'YAML'
+name: Mutable tag
+on: workflow_dispatch
+jobs:
+  cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: Swatinem/rust-cache@v2
+YAML
+expect_failure 'rust-cache must stay on the v2.9.1 digest'
+
+write_cache_workflow <<'YAML'
+name: Expression ref
+on: workflow_dispatch
+jobs:
+  cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: Swatinem/rust-cache@${{ matrix.cache-ref }}
+YAML
+expect_failure 'rust-cache must stay on the v2.9.1 digest'
+
+write_cache_workflow <<'YAML'
+name: Spaced key
+on: workflow_dispatch
+jobs:
+  cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses : Swatinem/rust-cache@v2
+YAML
+expect_failure 'rust-cache must stay on the v2.9.1 digest'
+
+write_cache_workflow <<'YAML'
+name: Flow mapping
+on: workflow_dispatch
+jobs:
+  cache:
+    runs-on: ubuntu-latest
+    steps:
+      - { uses: Swatinem/rust-cache@v2 }
+YAML
+expect_failure 'rust-cache must stay on the v2.9.1 digest'
+
+write_cache_workflow <<'YAML'
+name: Quoted key
+on: workflow_dispatch
+jobs:
+  cache:
+    runs-on: ubuntu-latest
+    steps:
+      - "uses": Swatinem/rust-cache@v2
+YAML
+expect_failure 'rust-cache must stay on the v2.9.1 digest'
+rm "$tmp/.github/workflows/new-cache-user.yaml"
+
+mkdir -p "$tmp/.github/actions/cache"
+cat > "$tmp/.github/actions/cache/action.yml" <<'YAML'
+name: Unsafe cache wrapper
+runs:
+  using: composite
+  steps:
+    - { uses: Swatinem/rust-cache@v2 }
+YAML
+write_cache_workflow <<'YAML'
+name: Local cache wrapper
+on: workflow_dispatch
+jobs:
+  cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/actions/cache
+YAML
+expect_failure 'rust-cache must stay on the v2.9.1 digest'
+
+cat > "$tmp/.github/actions/cache/action.yml" <<YAML
+name: Safe preferred cache wrapper
+runs:
+  using: composite
+  steps:
+    - uses: Swatinem/rust-cache@$known_good
+YAML
+cat > "$tmp/.github/actions/cache/action.yaml" <<'YAML'
+name: Unreachable stale cache wrapper
+runs:
+  using: composite
+  steps:
+    - uses: Swatinem/rust-cache@v2
+YAML
+run_contract >/dev/null
+rm -rf "$tmp/.github/actions" "$tmp/.github/workflows/new-cache-user.yaml"
+
+python3 - "$tmp/.github/workflows/ci.yml" <<'PY'
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+workflow = path.read_text()
+needle = "          key: sherpa-cache-v1\n          save-if:"
+replacement = "          save-if:"
+if workflow.count(needle) != 1:
+    raise SystemExit("expected one Unit Tests cache generation key")
+workflow = workflow.replace(needle, replacement)
+job = "  unit-tests:\n"
+if workflow.count(job) != 1:
+    raise SystemExit("expected one Unit Tests job")
+workflow = workflow.replace(job, job + "    env:\n      key: sherpa-cache-v1\n", 1)
+path.write_text(workflow)
+PY
+expect_failure 'rust-cache action must keep with.key set to sherpa-cache-v1'
+
+echo "rust cache contract regressions passed"