ci: consolidate fix/dont_block_on_trivy onto main (Trivy stays blocking)#29
Merged
Conversation
Replace the per-job hand-rolled actions/cache (restore + "clean target if Cargo.lock changed" + save), keyed only on Cargo.lock, with Swatinem/rust-cache in clippy / tests / tests-suites / unused-deps. - Each job uses a Swatinem shared-key (clippy, tests, tests-suites, unused-deps) and maps the existing knobs: prefix-key <- rust-cache-prefix, save-if <- rust-cache-save. Swatinem keys on rustc + Cargo.lock + workspace and prunes stale workspace artifacts before saving, fixing the immutable-cache staleness of a Cargo.lock-only key. - Formatting job no longer caches anything: `cargo fmt -- --check` does not compile, so restoring/saving ~/.cargo + target/ was pure waste. - sccache steps removed: no persistent backend was ever configured (the object store was not cached), so it gave no cross-run benefit and disabled incremental compilation, fighting the target/ cache. The `use-sccache` input is kept (deprecated, no-op) so existing callers and ci.yml don't break. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mold is a linker, so it only helps jobs that link a binary — tests and tests-suites, not clippy (check-only) or formatting (no compile). Add a `use-mold` input (default false) and, when enabled, install mold+clang and set RUSTFLAGS before the Swatinem cache step (so the linker flags are part of the cache key) in those two jobs only. Opt-in by default because this is a shared workflow: mold cannot read ThinLTO bitcode objects without the LLVM plugin, so `cargo test --release` / LTO test builds would fail at link time. Plumb the matching `rust-use-mold` input through ci.yml. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
release-app.yml previously published via a parallel matrix over publish-envs, with each env (Staging, Prod) running build-publish.yml — a full Docker compile. Because the legs ran in parallel they couldn't share the gha layer cache, so the identical image was compiled twice (~2x the slowest build). Restructure into build-once / push-per-env (same pattern as pay-core's canary image): - `build`: compiles the image once on the configurable run-label runner and exports it to a tarball artifact (gha layer cache retained). - `publish` (matrix per env): downloads the tarball, docker load, then tags + pushes to that env's ECR (its own role) and GHCR. No compile — runs on ubuntu-latest. Env config is injected at runtime in ECS, so the image is identical across envs. build-publish.yml is left in place for any direct callers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ci: Swatinem caching + opt-in mold + build-once release image
cargo-deny-action@v2 bundles cargo-deny 0.20.2, which dropped the
singular `license` alias for the check subcommand. The Licenses job
invoked `cargo deny check license`, which now fails to parse before
deny.toml is ever read:
error: invalid value 'license' for '[WHICH]...'
Use the plural `licenses` value that 0.20.x expects. Unblocks every PR
whose CI schedules the Licenses job (e.g. WalletConnect/pay-core).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fix(ci): use plural `check licenses` for cargo-deny
This reverts commit aa7ad63.
chris13524
approved these changes
Jul 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Consolidates the
fix/dont_block_on_trivyintegration branch ontomainwith Trivy IaC scanning left blocking. That branch has been serving two purposes at once: it carries several real CI improvements and a temporaryexit-code: '0'hack that made the Trivy IaC scan non-blocking. Consumers (e.g.WalletConnect/pay-core) pin to it to get the improvements and inherit the non-blocking scan as a side effect.This PR lands the improvements on
mainand drops only the non-blocking hack, somainends up with everything and Trivy stays enforced (ci-check-infra.ymlexit-code: '1', unchanged frommain).What's included (net diff vs
main)ci-check-app.ymlSwatinem/rust-cache; opt-inmoldlinker for test jobs8e45e9e6,5721318brelease-app.yml88181667ci.ymlci-check-infra.ymlexit-code 1→0commit (aa7ad636) is reverted here, so Trivy stays blockingaa7ad636Also incorporates already-merged fixes that were on the branch: cargo-deny plural
check licenses(f8aafb94).Coordordination
WalletConnect/pay-corePR #1126, which adds a repo-root.trivyignoresuppressing the 7 HIGH IaC findings (all dev-only / documented false positives) so pay-core'sterraform/passes the now-blocking scan. Verified locally:trivy config terraform --severity HIGH,CRITICAL --skip-dirs .terraform --exit-code 1→ exit 0.@fix/dont_block_on_trivy/@ci/swatinem-rust-cacheto@main).ci/deploy-freshness-guard) is stacked onfix/dont_block_on_trivy; after this lands onmain, retarget it tomain. Once consumers are offfix/dont_block_on_trivy, that branch can be deleted.Draft pending review of the bundled improvements and confirmation of the merge order with pay-core #1126.