[dhruv8sh]

Summary

• Give each Rust CI job its own rust-cache key. Today every job shares cargo-${{ runner.os }}, and a job with an exact key match never saves. The first job to save (cloudflare or parity) owns the cache, and the axum, fastly, spin and clippy jobs rebuild 150–1,000 dependency crates on every run even though they report a full hit.
• Save Rust caches only from main. PR-scoped caches can't be reused by other PRs and were pushing the repo past its 10 GB limit (12.6 GB, ~10.8 GB of it from PRs), evicting main's caches.
• Remove the runner image's preinstalled stable toolchain and unset the rustup default (rustup default none) before setup. rust-cache hashes every installed toolchain into its key, so each runner-image update was changing the key.
• Move all of this into a shared .github/actions/setup-rust action, and fail the cargo fmt job if a workflow sets up Rust or rust-cache without it.

Changes

File	Change
.github/actions/setup-rust/action.yml	New shared setup: reads the pin from .tool-versions, uninstalls the image's stable and unsets the rustup default, keys the cache as <cache-key>-<os>, and saves only when save-cache is "true" on main
.github/workflows/test.yml	All six Rust jobs use the shared action with per-job keys (cargo-fastly, cargo-axum, cargo-cloudflare, cargo-spin, cargo-parity, cargo-cli)
.github/workflows/format.yml	The clippy job uses it with cargo-clippy; the cargo fmt job fails if anything under .github other than the shared action calls setup-rust-toolchain or rust-cache directly
.github/actions/setup-integration-test-env/action.yml	Restores cargo-axum read-only (save-cache: "false")

Closes

Closes #1258

Spec

Spec: Not a feature

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (ran with NODE_OPTIONS=--no-experimental-webstorage because local Node is 26, not the pinned 24.12.0)
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: local act benchmark of main's test.yml vs this branch, running the cloudflare, fastly and axum jobs sequentially (one cold main-push run, then two warm PR runs per variant)

Job (warm PR run)	Deps rebuilt, before → after	Job time, before → after
axum	749 → 0	242 s → 145 s (−40%)
fastly cargo test	664 → 0	645 s → 585 s (−9%)
cloudflare	0 → 0	73 s → 73 s

What the benchmark confirmed:

• PR runs skip saving.
• main runs save one cache per job.
• The key no longer includes the image's stable toolchain.

Not covered locally:

• The axum job stopped at the CLI browser tests because the image has no Chrome, so its release-WASM step (~1,000 dependency rebuilds in CI) wasn't measured.
• Not run: the spin, clippy, parity and CLI jobs, macOS, and the integration-test workflow.

After merge, check these:

• gh cache list shows Rust caches only for refs/heads/main, under 10 GB.
• PR runs' axum and fastly jobs show ~0 dependency Compiling lines.

The first PR runs after merge build cold until main has saved the new keys.

Checklist

• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests (CI configuration only. Verified with the act benchmark above.)
• No secrets or credentials committed

[ChristianPavilonis]

Review summary

Reviewed b9235ca43d6e7dd1cd484eb5a69daeb3eae671db against 7a0ecb4cbfa39af3d83f7e1ed2733d7eabdc4cb1. No actionable issues introduced by this PR were found.

Inspected all three changed files, every affected job, all four integration-action consumers, and the resolved setup/cache action implementations.

Safety proof

• CI logs show all 12 affected job executions removing stable, installing pinned Rust 1.95.0, and completing successfully. Coverage includes native Linux/macOS, both WASM targets, Clippy, parity, and integration tests.
• Logs from runs 37701852034, 37701851968, and 37701851955 confirm separate OS/job cache namespaces, matching Axum/integration keys, and save-if: false forwarded in every affected PR execution. No Rust cache saves occurred.

Validation and remaining uncertainty

• All 22 PR checks pass. The CI merge tree is identical to the reviewed head tree.
• Diff whitespace checks and actionlint without ShellCheck pass. Actionlint with ShellCheck reports 12 unchanged SC2086 diagnostics, confirmed against the base revision. All new removal scripts pass ShellCheck.
• In-memory assertions pass for all setup definitions, key uniqueness, intentional integration sharing, Rust pins, shell syntax, the absent-rustup branch, and CI log observations.
• Existing reviews, inline comments, issue comments, and review threads were empty.
• Main-branch cache saving, subsequent warm restores, and the claimed storage/performance improvements remain unverified on GitHub after merge.

[aram356]

Summary

Gives each Rust CI job its own rust-cache key, saves Rust caches only from main, and removes the runner image's stable so image updates stop changing the keys. This PR's CI logs confirm the mechanics: cache-save-if reaches rust-cache v2.9.1 as save-if, every job's key now lists only Rust 1.95.0, the four integration jobs compute test-axum's exact key, and nothing saved from the PR ref. One gap remains: the integration action can still save on a workflow_dispatch run from main.

1 of the inline comments below carries a one-click GitHub suggestion: use Commit suggestion to apply it. The other three describe the change in prose because it spans several files or adds a new one.

Blocking

🔧 wrench

• The save gate is open on workflow_dispatch: see inline at .github/actions/setup-integration-test-env/action.yml:69

Non-blocking

🌱 seedling / 🤔 thinking / ♻️ refactor

• 🌱 Most of the integration jobs' Rust compile isn't in cargo-axum: see inline at .github/actions/setup-integration-test-env/action.yml:68
• 🤔 Removing the default toolchain lets rustup reinstall stable silently: see inline at .github/workflows/test.yml:40
• ♻️ One shared Rust setup action instead of nine copies: see inline at .github/workflows/test.yml:36

CI Status

• cargo fmt: PASS (required)
• format-typescript: PASS (required)
• cargo test: PASS (required)
• format-docs: PASS (required)
• CLAUDE.md symlink guard: PASS
• cargo test (axum native): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native) (ubuntu-latest): PASS
• cargo test (ts CLI, native) (macos-latest): PASS
• vitest: PASS
• prepare integration artifacts: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• browser integration tests: PASS
• CodeQL: PASS
• Analyze (rust): PASS
• Analyze (actions): PASS
• Analyze (javascript-typescript) (CodeQL Advanced): PASS
• Analyze (javascript-typescript) (CodeQL - Code Quality): PASS
• Analyze (python): PASS

[prk-Jr]

Summary

Gives each Rust CI job its own rust-cache key, saves Rust caches only from main, and moves the pinned toolchain setup (including removing the runner image's stable and unsetting the default) into a shared .github/actions/setup-rust composite action. The earlier review's wrench, thinking, and refactor findings are all resolved in bcec6ad, and the seedling is reasonably deferred as a follow-up.

Checked beyond the earlier review:

• Save gate still fires where it should: test.yml and format.yml both run on push: [main]; integration-tests.yml is PR + workflow_dispatch only and is now restore-only via save-cache: "false".
• rustup default none is safe for every current Rust call: cargo install viceroy (both copies) and rustup target add wasm32-unknown-unknown run from the checkout, where the directory override applies; the only working-directory changes are JS/docs/browser steps.
• The CLI matrix keeps distinct keys (cargo-cli-Linux / cargo-cli-macOS) because runner.os is appended in the shared action.

Non-blocking

📝 note

• Old caches linger until idle eviction: after merge, the old shared v0-rust-cargo-Linux-… entry and the ~8.5 GB of existing PR-ref caches stay until GitHub's 7-day idle eviction. An optional one-off gh cache delete after merge would free space sooner. No code change needed.

👍 praise

• The shared setup action keeps the toolchain pin, the stable removal, and the main-only save gate in one place, so a new Rust job can't silently skip any of them. The before/after act benchmark in the description is a nice touch.

CI Status

All 22 checks pass (cargo fmt, cargo test, axum, cloudflare, spin, parity, ts CLI on ubuntu and macOS, vitest, format-typescript, format-docs, integration, browser integration, Fastly EC lifecycle, CodeQL/Analyze, CLAUDE.md symlink guard).

[aram356]

Summary

The round-1 findings are resolved in bcec6ad77. The shared .github/actions/setup-rust action holds the pin, the stable removal with rustup default none, and the main-only save gate, and the integration action now restores cargo-axum read-only. This head's CI logs confirm it: all 12 Rust jobs keep their round-1 keys, list only Rust 1.95.0, log default toolchain unset, pass save-if: false to rust-cache, and save nothing. One gap remains: nothing stops a workflow from setting up Rust without the shared action, and three open PR lines already do.

1 of the inline comments below carries a one-click GitHub suggestion: use Commit suggestion to apply it.

Blocking

🔧 wrench

• Nothing stops a job from bypassing setup-rust: see inline at .github/workflows/format.yml:48

Cross-cutting / body-level findings

📝 note: The PR description no longer matches the diff

The Changes table has no row for the new .github/actions/setup-rust/action.yml, still lists the uninstall step under test.yml, and says the integration action gets the "same save and toolchain changes", though it's now restore-only (save-cache: "false"). The summary doesn't mention rustup default none either. Squash merges here use the commit messages, so main's history is fine, but reviewers and the #1258 trail read the description. Suggested rows:

File	Change
.github/actions/setup-rust/action.yml	New shared setup: reads the pin from .tool-versions, uninstalls the image's stable and unsets the rustup default, keys the cache as <cache-key>-<os>, and saves only when save-cache is "true" on main
.github/workflows/test.yml	All six Rust jobs use the shared action with per-job keys (cargo-fastly, cargo-axum, cargo-cloudflare, cargo-spin, cargo-parity, cargo-cli)
.github/workflows/format.yml	The clippy job uses it with cargo-clippy
.github/actions/setup-integration-test-env/action.yml	Restores cargo-axum read-only (save-cache: "false")

📌 out of scope: File the deferred integration follow-up

The reply on the 🌱 thread defers dropping --target from the two integration cargo test steps and switching them to cargo-parity, but no issue exists yet. Please file it and link it here so the deferral is tracked.

CI Status

All checks ran on this head on 2026-10-12. The branch is 10 commits behind main (including #1226's new lint-wasm-clock.sh step in the clippy job) and merges cleanly; that step runs cargo from the repository root, so the rustup default none change doesn't affect it.

• cargo fmt: PASS (required)
• format-typescript: PASS (required)
• cargo test: PASS (required)
• format-docs: PASS (required)
• CLAUDE.md symlink guard: PASS
• cargo test (axum native): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native) (ubuntu-latest): PASS
• cargo test (ts CLI, native) (macos-latest): PASS
• vitest: PASS
• prepare integration artifacts: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• browser integration tests: PASS
• CodeQL: PASS
• Analyze (rust): PASS
• Analyze (actions): PASS
• Analyze (javascript-typescript) (CodeQL Advanced): PASS
• Analyze (javascript-typescript) (CodeQL - Code Quality): PASS
• Analyze (python): PASS

[dhruv8sh]

Filed the deferred integration cache follow-up as #1395: drop --target from the two integration cargo test steps and reuse the cargo-parity cache. The PR description now has the updated Changes table.