[zackees]

Fixes #1216
Part of zackees/setup-soldr#528

Changes

• rust-cache: every Swatinem/rust-cache step (15 steps in 12 workflows) now has save-if: ${{ github.ref == 'refs/heads/main' }}. PR runs restore main's entries and never save.

  • auto-release.yml: saves only on main pushes, not on tag refs. A cache saved on a tag ref is scoped to that tag, so no later release could restore it. Tag and dispatch runs still restore main's entry.
  • Schedule-triggered workflows (ci-all-features, security-fuzz, security-audit) run on the default-branch ref, so they still save.

• actions/cache: the 4 venv caches, the 2 Dylint caches and the fuzz corpus are split into actions/cache/restore@v4 plus a main-gated actions/cache/save@v4 that reuses cache-primary-key and skips on an exact hit.

• Shared keys: ci-preflight-rust warm/lint/unit-test used key:. rust-cache adds the job id to that, so each job had a private entry and the sub-workers never restored warm's target/. They now use shared-key: <label>-preflight-rust. Only warm saves; lint and unit-test use save-if: false. Keys left as they are:

  • ci-linux and linux-x86-build reproducible: they already share a job id and key.
  • output-shutdown-<label>, independent-fixture-<target>, release-binaries-<target>: each is a different OS or target.
  • <label>-all-features, coverage, security-audit, security-fuzz: each builds a different feature, instrumentation or workspace graph.
  • _build <runner>-<mode>: dev and release are different profiles.

• Guard: ci/cache_save_guard.py, wired into ./lint, with tests/test_ci_cache_save_guard.py. It fails on:

  • a rust-cache step without a main or false save-if
  • any plain actions/cache
  • an actions/cache/save without a main-gated if:

  A step can opt out only with a # cache-save-exempt: <reason> comment.

RED -> GREEN

Before (origin/main): python -m ci.cache_save_guard exits 1 with 22 cache step(s) can save on pull_request (#1216), listing every rust-cache and actions/cache step.
After: cache_save_guard: 21 workflow(s) OK. The unit tests pass (11), and test_repository_workflows_pass fails on origin/main.

Validation

• soldr cargo fmt --all -- --check, soldr cargo clippy --workspace --all-targets -- -D warnings, soldr cargo build --workspace: pass
• soldr cargo check --workspace --target x86_64-pc-windows-msvc and --target aarch64-apple-darwin: pass
• All edited YAML parses with yaml.safe_load.
• Tests: tests.test_ci_cache_save_guard, test_ci_preflight_workflow, test_coverage_workflow, test_independent_spawn_release: pass
• ./lint: the new guard passes inside it. The run then stops at a failure that is already on origin/main and is unrelated to this PR: ci.api_snapshot says docs/api_snapshot_rust.txt is stale (spawn/platform re-exports added upstream). This PR touches no Rust, so the snapshot is left for a separate change.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!