ci: consolidate fix/dont_block_on_trivy onto main (Trivy stays blocking)

.github/workflows/ci-check-app.yml

@@ -36,9 +36,23 @@ on:
         type: boolean
         default: true
       use-sccache:
-        description: 'Run sccache-cache before running tests'
+        # DEPRECATED / no-op: sccache had no persistent backend configured here
+        # (its object store was never cached), so it provided no cross-run
+        # benefit and disabled incremental compilation, which fights the
+        # Swatinem/rust-cache target/ cache. The input is kept so existing
+        # callers (and ci.yml) don't break; it no longer wires anything.
+        description: '(deprecated, no-op) Run sccache-cache before running tests'
         type: boolean
         default: true
+      use-mold:
+        # Opt-in (default false): mold is a linker, so it only helps jobs that
+        # link a binary — i.e. tests / tests-suites, not clippy (check-only) or
+        # fmt (no compile). Keep this OFF for `cargo test --release` / LTO test
+        # builds: mold can't read ThinLTO bitcode objects without the LLVM
+        # plugin and the final link fails.
+        description: 'Use the mold linker (clang driver) for the test jobs. Only for non-LTO debug test builds.'
+        type: boolean
+        default: false
       use-postgresql:
         description: 'Run postgresql before running tests'
         type: boolean
@@ -83,47 +97,22 @@ jobs:
           toolchain: ${{ inputs.rust-toolchain }}
           components: clippy
 
-      - name: Restore Cargo cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
+      - name: Rust cache
+        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-clippy-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-clippy-
-
-      - name: Clean target if Cargo.lock changed
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        run: rm -rf target/
+          prefix-key: ${{ inputs.rust-cache-prefix }}
+          shared-key: clippy
+          save-if: ${{ inputs.rust-cache-save }}
 
       - name: Install Protoc
         if: ${{ inputs.install-protoc == true }}
         uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Run sccache-cache
-        if: ${{ inputs.use-sccache == true }}
-        uses: mozilla-actions/sccache-action@v0.0.4
-
       - name: Clippy
         run: cargo clippy --workspace --all-features --all-targets -- -D warnings
 
-      - name: Save Cargo cache
-        if: ${{ inputs.rust-cache-save }}
-        uses: actions/cache/save@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-clippy-${{ hashFiles('**/Cargo.lock') }}
-
   formatting:
     name: Formatting
     runs-on: ${{ inputs.run-label }}
@@ -139,41 +128,11 @@ jobs:
           toolchain: ${{ inputs.rust-toolchain-formatting }}
           components: rustfmt
 
-      - name: Restore Cargo cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-formatting-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-formatting-
-
-      - name: Clean target if Cargo.lock changed
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        run: rm -rf target/
-
-      - name: Run sccache-cache
-        if: ${{ inputs.use-sccache == true }}
-        uses: mozilla-actions/sccache-action@v0.0.4
-
+      # `cargo fmt -- --check` does not compile anything, so there is no target/
+      # or dependency cache to restore here.
       - name: Check Formatting
         run: cargo fmt -- --check
 
-      - name: Save Cargo cache
-        if: ${{ inputs.rust-cache-save }}
-        uses: actions/cache/save@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-formatting-${{ hashFiles('**/Cargo.lock') }}
-
   tests:
     name: Unit Tests
     runs-on: ${{ inputs.run-label }}
@@ -189,47 +148,30 @@ jobs:
         with:
           toolchain: ${{ inputs.rust-toolchain }}
 
-      - name: Restore Cargo cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-tests-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-tests-
+      # Before the cache step so RUSTFLAGS is part of the Swatinem cache key.
+      - name: Set up mold linker
+        if: ${{ inputs.use-mold }}
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends mold clang
+          echo "RUSTFLAGS=${RUSTFLAGS:+$RUSTFLAGS }-C linker=clang -C link-arg=-fuse-ld=mold" >> "$GITHUB_ENV"
 
-      - name: Clean target if Cargo.lock changed
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        run: rm -rf target/
+      - name: Rust cache
+        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
+        with:
+          prefix-key: ${{ inputs.rust-cache-prefix }}
+          shared-key: tests
+          save-if: ${{ inputs.rust-cache-save }}
 
       - name: Install Protoc
         if: ${{ inputs.install-protoc == true }}
         uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Run sccache-cache
-        if: ${{ inputs.use-sccache == true }}
-        uses: mozilla-actions/sccache-action@v0.0.4
-
       - name: Unit Tests
         run: cargo test ${{ inputs.test-args }}
 
-      - name: Save Cargo cache
-        if: ${{ inputs.rust-cache-save }}
-        uses: actions/cache/save@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-tests-${{ hashFiles('**/Cargo.lock') }}
-
   tests-suites:
     name: Tests Suite "${{ matrix.element }}"
     if: (inputs.test-suites != '') && (inputs.test-suites != '[]')
@@ -258,47 +200,30 @@ jobs:
         with:
           toolchain: ${{ inputs.rust-toolchain }}
 
-      - name: Restore Cargo cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-tests-suites-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-tests-suites-
+      # Before the cache step so RUSTFLAGS is part of the Swatinem cache key.
+      - name: Set up mold linker
+        if: ${{ inputs.use-mold }}
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends mold clang
+          echo "RUSTFLAGS=${RUSTFLAGS:+$RUSTFLAGS }-C linker=clang -C link-arg=-fuse-ld=mold" >> "$GITHUB_ENV"
 
-      - name: Clean target if Cargo.lock changed
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        run: rm -rf target/
+      - name: Rust cache
+        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
+        with:
+          prefix-key: ${{ inputs.rust-cache-prefix }}
+          shared-key: tests-suites
+          save-if: ${{ inputs.rust-cache-save }}
 
       - name: Install Protoc
         if: ${{ inputs.install-protoc == true }}
         uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Run sccache-cache
-        if: ${{ inputs.use-sccache == true }}
-        uses: mozilla-actions/sccache-action@v0.0.4
-
       - name: Test Suite
         run: cargo test --test ${{ matrix.element }}
 
-      - name: Save Cargo cache
-        if: ${{ inputs.rust-cache-save }}
-        uses: actions/cache/save@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-tests-suites-${{ hashFiles('**/Cargo.lock') }}
-
   unused-dependencies:
     name: Unused Dependencies
     runs-on: ${{ inputs.run-label }}
@@ -315,44 +240,19 @@ jobs:
         with:
           toolchain: ${{ inputs.rust-toolchain-udeps }}
 
-      - name: Restore Cargo cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
+      - name: Rust cache
+        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-unused-deps-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-unused-deps-
-
-      - name: Clean target if Cargo.lock changed
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        run: rm -rf target/
-
-      - name: Run sccache-cache
-        if: ${{ inputs.use-sccache == true }}
-        uses: mozilla-actions/sccache-action@v0.0.4
+          prefix-key: ${{ inputs.rust-cache-prefix }}
+          shared-key: unused-deps
+          save-if: ${{ inputs.rust-cache-save }}
 
       - name: Install cargo-udeps
         run: cargo install cargo-udeps@0.1.43 --locked
 
       - name: Check Dependencies
         run: cargo udeps --all-targets
 
-      - name: Save Cargo cache
-        if: ${{ inputs.rust-cache-save }}
-        uses: actions/cache/save@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-            target/
-          key: ${{ inputs.rust-cache-prefix }}-${{ runner.os }}-cargo-unused-deps-${{ hashFiles('**/Cargo.lock') }}
-
   license:
     name: Licenses
     runs-on: ${{ inputs.run-label }}
@@ -364,4 +264,4 @@ jobs:
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           rust-version: ${{ inputs.rust-toolchain }}
-          command: check license
+          command: check licenses

.github/workflows/ci.yml

@@ -47,6 +47,10 @@ on:
         description: 'Run `sccache-cache` before running rust tests'
         type: boolean
         default: true
+      rust-use-mold:
+        description: 'Use the mold linker for the rust test jobs (opt-in; non-LTO debug builds only)'
+        type: boolean
+        default: false
       rust-use-postgresql:
         description: 'Run postgresql before running rust tests'
         type: boolean
@@ -133,6 +137,7 @@ jobs:
       rust-backtrace: ${{ inputs.rust-backtrace }}
       install-protoc: ${{ inputs.rust-install-protoc }}
       use-sccache: ${{ inputs.rust-use-sccache }}
+      use-mold: ${{ inputs.rust-use-mold }}
       use-postgresql: ${{ inputs.rust-use-postgresql }}
       test-env-vars: ${{ inputs.rust-test-env-vars }}
       run-label: ${{ inputs.run-label }}