From 844220985436468bf620daf15dea8269fec29b2a Mon Sep 17 00:00:00 2001 From: krisztianfekete Date: Mon, 3 Aug 2026 16:23:34 +0200 Subject: [PATCH 1/2] ci: avoid duplicate runs, harden checkout, use rust-cache Signed-off-by: krisztianfekete --- .github/workflows/rust.yml | 74 +++++++++++++++++++------------------- 1 file changed, 38 insertions(+), 36 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index e555478..66c63ba 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,7 +1,21 @@ -on: [push, pull_request] +on: + push: + branches: + - master + pull_request: name: Continuous integration +permissions: + contents: read + +concurrency: + # GitHub concurrency keeps at most one running and one pending run per group. + # Use ref_name for PRs so new commits cancel older PR runs on the same PR, + # but key pushes by SHA so postsubmit runs do not cancel each other. + group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.ref_name) || format('push-{0}', github.sha) }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: check: name: Check @@ -12,9 +26,15 @@ jobs: with: repo-token: ${{ secrets.GITHUB_TOKEN }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: stable + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + with: + # Don't let pull request branches evict the master cache. + save-if: ${{ github.ref == 'refs/heads/master' }} # Install prometheus_client python library. - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 @@ -22,18 +42,6 @@ jobs: python-version: '3.x' - run: pip3 install prometheus_client - # Caching - - name: Cache cargo registry - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 - with: - path: ~/.cargo/registry - key: cargo-registry-${{ hashFiles('Cargo.toml') }} - - name: Cache cargo index - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 - with: - path: ~/.cargo/git - key: cargo-index-${{ hashFiles('Cargo.toml') }} - - run: cargo check --locked - run: cargo test --locked --benches --all-features @@ -47,9 +55,15 @@ jobs: with: repo-token: ${{ secrets.GITHUB_TOKEN }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: stable + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + with: + # Don't let pull request branches evict the master cache. + save-if: ${{ github.ref == 'refs/heads/master' }} # Install prometheus_client python library. - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 @@ -57,18 +71,6 @@ jobs: python-version: '3.x' - run: pip3 install prometheus_client - # Caching - - name: Cache cargo registry - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 - with: - path: ~/.cargo/registry - key: cargo-registry-${{ hashFiles('Cargo.toml') }} - - name: Cache cargo index - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 - with: - path: ~/.cargo/git - key: cargo-index-${{ hashFiles('Cargo.toml') }} - - run: cargo test --locked --all --all-features fmt: @@ -76,6 +78,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: stable @@ -91,22 +95,16 @@ jobs: with: repo-token: ${{ secrets.GITHUB_TOKEN }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: stable components: clippy - - # Caching - - name: Cache cargo registry - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 - with: - path: ~/.cargo/registry - key: cargo-registry-${{ hashFiles('Cargo.toml') }} - - name: Cache cargo index - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: - path: ~/.cargo/git - key: cargo-index-${{ hashFiles('Cargo.toml') }} + # Don't let pull request branches evict the master cache. + save-if: ${{ github.ref == 'refs/heads/master' }} - run: cargo clippy --locked --workspace --all-targets -- -D warnings @@ -119,6 +117,8 @@ jobs: with: repo-token: ${{ secrets.GITHUB_TOKEN }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: toolchain: stable @@ -138,6 +138,8 @@ jobs: - wasm32-unknown-unknown steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 with: From 0f05659f6f8744e738fe6ff837ad27f9d534edee Mon Sep 17 00:00:00 2001 From: krisztianfekete Date: Tue, 4 Aug 2026 11:59:31 +0200 Subject: [PATCH 2/2] ci: also run on release tags Signed-off-by: krisztianfekete --- .github/workflows/rust.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 66c63ba..de02433 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -2,6 +2,8 @@ on: push: branches: - master + tags: + - "v*" pull_request: name: Continuous integration @@ -12,8 +14,9 @@ permissions: concurrency: # GitHub concurrency keeps at most one running and one pending run per group. # Use ref_name for PRs so new commits cancel older PR runs on the same PR, - # but key pushes by SHA so postsubmit runs do not cancel each other. - group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.ref_name) || format('push-{0}', github.sha) }} + # but key pushes by ref and SHA so postsubmit runs do not cancel each other, + # and a release tag does not queue behind the master run for the same commit. + group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.ref_name) || format('push-{0}-{1}', github.ref, github.sha) }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: