Merge branch 'main' into feat/release-ready-signal

Author: pmaxhogan

.github/workflows/chaos.yml

@@ -38,7 +38,10 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # Cancel only superseded PR runs. Never cancel a push to main (warms the shared
+  # rust-cache) or a `v*` tag push (the release-gate 3-OS run). Matches ci.yml /
+  # coverage.yml.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   CARGO_TERM_COLOR: always
@@ -70,6 +73,12 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \
             libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1
       - uses: Swatinem/rust-cache@v2
+        with:
+          # Same dependency cache as ci.yml's rust-test (per-OS). chaos builds a
+          # subset of the workspace, so it reuses the rust-test-warmed cache.
+          shared-key: "workspace"
+          # Restore-only on PRs; only main (and not `v*` tags) writes the cache.
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       # run-all capability-gates every scenario: on a stock non-elevated runner
       # the admin / real-Drive rows SKIP (recorded, never red); the rest run
       # against the headless core + InMemoryRemoteStore.
@@ -98,6 +107,9 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \
             libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1
       - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: "workspace"
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: chaos run-all (fault-injection)
         run: cargo run -p driven-chaos -- run-all --fault-injection
 
@@ -131,6 +143,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libssl-dev
       - uses: Swatinem/rust-cache@v2
+        with:
+          # Builds driven-drive's test target - a subset of the workspace - so it
+          # restores the same per-OS `workspace` cache. This job only runs on `v*`
+          # tags (save-if false there), so it is purely restore-only.
+          shared-key: "workspace"
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       # Real Drive round-trip against a throwaway UUID folder under the dest
       # folder. Gate-skips cleanly (Ok, never red) when the creds are absent.
       - name: real-drive e2e (google_e2e)

.github/workflows/ci.yml

@@ -8,7 +8,11 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # Only cancel a SUPERSEDED PR run (newer commit on the same PR). NEVER cancel a
+  # push-to-main run: main is the ONLY branch that writes the shared rust-cache
+  # (see save-if below), so a cancelled main run leaves the cache cold/stale and
+  # every later PR pays a full rebuild. Matches coverage.yml's reasoning.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   CARGO_TERM_COLOR: always
@@ -46,6 +50,18 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \
             libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1
       - uses: Swatinem/rust-cache@v2
+        with:
+          # Share ONE dependency cache (per-OS) across the jobs that compile the
+          # workspace in the normal dev profile: this rust-test job plus the two
+          # chaos jobs. `--workspace --all-targets` here is the superset build, so
+          # whichever runs first on main warms a cache the others reuse, instead of
+          # each job hoarding its own ~0.8 GiB copy.
+          shared-key: "workspace"
+          # Only `main` writes caches; PRs are restore-only. A PR-event cache is
+          # scoped to that PR's ref and can't be read by main or other PRs, so
+          # saving it just burns the repo cache budget and evicts the reusable
+          # main caches. PRs still RESTORE the main cache normally.
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: cargo build (compile-only)
         run: cargo build --workspace --all-targets
       - name: cargo clippy
@@ -113,6 +129,8 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           prefix-key: "v1-rust"
+          # Restore-only on PRs; only main warms this cache (see rust-test above).
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: pnpm install
         working-directory: ui
         run: pnpm install --frozen-lockfile

.github/workflows/coverage.yml

@@ -64,7 +64,13 @@ jobs:
         with: { components: llvm-tools-preview }
       - uses: taiki-e/install-action@v2
         with: { tool: cargo-llvm-cov }
+      # This is an instrumented (coverage) build with its own RUSTFLAGS, so it
+      # gets its own cache key and deliberately does NOT share the `workspace`
+      # key. Restore-only on PRs; only main writes it (main coverage runs never
+      # cancel, so the cache stays warm).
       - uses: Swatinem/rust-cache@v2
+        with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - uses: pnpm/action-setup@v4
         with: { version: 10 }