From a879cf951b393342dd12739dcc134efa3c40586a Mon Sep 17 00:00:00 2001
From: Daniel McCarney <daniel@binaryparadox.net>
Date: Tue, 22 Sep 2026 09:28:13 -0400
Subject: [PATCH] ci: use targeted Rust build caches

The hand-written actions/cache setup stores the full target directory
under keys that require an exact Cargo.lock hash. This has three
practical failure modes:

- the repository cache reached 9.86 GB of GitHub's 10 GB quota, so
  useful entries are evicted;
- the stable build and coverage jobs share a key, allowing coverage to
  save instrumented artifacts that the stable build cannot reuse; and
- any lockfile update misses every prior entry and rebuilds all
  dependencies.

Clippy, one of the longest-running jobs, is not cached at all.

Use Swatinem/rust-cache for Clippy, the platform build matrix, and
coverage. It derives keys from the job, compiler, and Rust build
environment, falls back across lockfile revisions, and removes
workspace, incremental, stale, and unused artifacts before saving.

Keeping that Rust-specific policy in the cache action avoids duplicating
fragile path, key, and cleanup logic in the workflow. It also reduces
cache pressure while preventing incompatible jobs from sharing entries.

Co-authored-by: Codex <codex@openai.com>
---
 .github/workflows/ci.yml | 36 ++++++------------------------------
 1 file changed, 6 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b1354ceb..8d3d4f86 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,6 +44,7 @@ jobs:
               uses: dtolnay/rust-toolchain@stable
               with:
                   components: clippy
+            - uses: Swatinem/rust-cache@v2
             # `fips` and `aws_lc_rs_unstable` cannot be used together, so avoid `--all-features`
             - run: cargo clippy --features ring,pem,x509-parser --all-targets
             # rustls-cert-gen require either aws_lc_rs or ring feature
@@ -140,21 +141,12 @@ jobs:
             - uses: actions/checkout@v7
               with:
                   persist-credentials: false
-            - uses: actions/cache@v6
-              with:
-                  path: |
-                      ~/.cargo/bin/
-                      ~/.cargo/registry/index/
-                      ~/.cargo/registry/cache/
-                      ~/.cargo/git/db/
-                      target/
-                      $VCPKG_DEFAULT_BINARY_CACHE
-                  key: ${{ runner.os }}-cargo-stable-${{ hashFiles('Cargo.lock') }}
             - uses: egor-tensin/vs-shell@v2
               with:
                   arch: amd64
             - name: Install Rust
               uses: dtolnay/rust-toolchain@stable
+            - uses: Swatinem/rust-cache@v2
             - name: Install NASM for aws-lc-rs on Windows
               uses: ilammy/setup-nasm@v1
             - name: Run cargo check
@@ -186,19 +178,11 @@ jobs:
             - uses: actions/checkout@v7
               with:
                   persist-credentials: false
-            - uses: actions/cache@v6
-              with:
-                  path: |
-                      ~/.cargo/bin/
-                      ~/.cargo/registry/index/
-                      ~/.cargo/registry/cache/
-                      ~/.cargo/git/db/
-                      target/
-                  key: ${{ runner.os }}-cargo-${{matrix.toolchain}}-${{ hashFiles('Cargo.lock') }}
             - name: Install Rust
               uses: dtolnay/rust-toolchain@master
               with:
                   toolchain: ${{ matrix.toolchain }}
+            - uses: Swatinem/rust-cache@v2
             - name: Run cargo check
               run: cargo check --all-targets
             - name: Run the tests
@@ -231,21 +215,13 @@ jobs:
               uses: actions/checkout@v7
               with:
                   persist-credentials: false
-            - uses: actions/cache@v6
-              with:
-                  path: |
-                      ~/.cargo/bin/
-                      ~/.cargo/registry/index/
-                      ~/.cargo/registry/cache/
-                      ~/.cargo/git/db/
-                      target/
-                  key: ${{ runner.os }}-cargo-stable-${{ hashFiles('Cargo.lock') }}
-            - name: Install cargo-llvm-cov
-              uses: taiki-e/install-action@cargo-llvm-cov
             - name: Install rust toolchain
               uses: dtolnay/rust-toolchain@stable
               with:
                   components: llvm-tools
+            - uses: Swatinem/rust-cache@v2
+            - name: Install cargo-llvm-cov
+              uses: taiki-e/install-action@cargo-llvm-cov
             - name: Measure coverage
               run: cargo llvm-cov --features ring,pem,x509-parser --lcov --output-path ./lcov.info
             - name: Report to codecov.io