From a33c5a7861fcbd2519cb696d60045d4821a83451 Mon Sep 17 00:00:00 2001 From: bherbruck Date: Sat, 17 Oct 2026 22:11:31 -0400 Subject: [PATCH] CI: restore main's Rust cache in fork pull request jobs on the untrusted runners (#2254) Fork pull requests now run on the untrusted self-hosted runners, which start every job empty. Let them restore main's rust-cache like GitHub's runners do (save-if stays main only, so a fork job never writes a cache). Co-authored-by: Claude Opus 5.5 --- .github/workflows/ci.yml | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cc433558..8894f3b5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -186,8 +186,9 @@ jobs: - uses: dtolnay/rust-toolchain@stable with: components: rustfmt - # The self-hosted runner keeps its build directory and Cargo home instead. - - if: runner.environment == 'github-hosted' + # The trusted self-hosted runners keep their build directory and Cargo home instead; the + # untrusted ones (fork pull requests) start empty and restore main's cache, read-only. + - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: repo-checks @@ -227,8 +228,9 @@ jobs: - uses: dtolnay/rust-toolchain@stable with: components: clippy - # The self-hosted runner keeps its build directory and Cargo home instead. - - if: runner.environment == 'github-hosted' + # The trusted self-hosted runners keep their build directory and Cargo home instead; the + # untrusted ones (fork pull requests) start empty and restore main's cache, read-only. + - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: native-clippy @@ -451,8 +453,9 @@ jobs: if: runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) run: scripts/ci/warm-target.sh doc-tests - uses: dtolnay/rust-toolchain@stable - # The self-hosted runner keeps its build directory and Cargo home instead. - - if: runner.environment == 'github-hosted' + # The trusted self-hosted runners keep their build directory and Cargo home instead; the + # untrusted ones (fork pull requests) start empty and restore main's cache, read-only. + - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: doc-tests @@ -501,8 +504,9 @@ jobs: if: runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) run: scripts/ci/warm-target.sh oracle - uses: dtolnay/rust-toolchain@stable - # The self-hosted runner keeps its build directory and Cargo home instead. - - if: runner.environment == 'github-hosted' + # The trusted self-hosted runners keep their build directory and Cargo home instead; the + # untrusted ones (fork pull requests) start empty and restore main's cache, read-only. + - if: runner.environment == 'github-hosted' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: oracle