Cache native CI dependencies while rebuilding current Server outputs

.github/workflows/server-parity.yml

@@ -472,6 +472,17 @@ jobs:
             -v "$PWD/mysql-tls:/tls" --entrypoint openssl "$image" req -x509 -newkey rsa:2048 \
             -nodes -sha256 -days 1 -keyout /tls/untrusted.key -out /tls/untrusted.crt -subj /CN=untrusted-development-ca \
             >> parity-evidence/tls-certificate-generation.txt 2>&1
+      # Exact dependency keys include the pinned compiler, build flags and
+      # vendored crates. Server outputs are discarded before rebuilding.
+      - name: Restore native Cargo dependencies from trusted main
+        id: native_cargo
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            cargo-home/registry
+            cargo-home/git
+            rust-target
+          key: native-cargo-deps-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('rust/Cargo.lock', 'rust/Cargo.toml', 'rust/vendor/**', 'rust/.cargo/**', '.github/workflows/server-parity.yml') }}
       - name: Fetch locked Rust dependencies
         # A registry or network failure belongs to this step, not to the
         # offline native builds and tests that follow.
@@ -483,6 +494,14 @@ jobs:
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -w /source/rust \
             mirror.gcr.io/library/rust@sha256:ba81bc3eaa4422af576c0262515d96b0111a628a6ccc2c86557cf55c9a4bbee0 \
             cargo fetch --locked
+      - name: Discard restored native workspace outputs before rebuilding
+        run: |
+          set -euo pipefail
+          mkdir -p cargo-home rust-target
+          docker run --rm --init --user="$(id -u):$(id -g)" --network=none --cpus=2 --memory=2g --memory-swap=2g \
+            -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target \
+            -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" -w /source/rust \
+            mirror.gcr.io/library/rust@sha256:ba81bc3eaa4422af576c0262515d96b0111a628a6ccc2c86557cf55c9a4bbee0 cargo clean --locked --offline --package durable-workflow-server
       - name: Bootstrap independent published PHP and native MySQL databases
         run: |
           set -euo pipefail
@@ -1134,6 +1153,17 @@ jobs:
           name: corrected-marker-adapters
           path: corrected-marker-adapters
           digest-mismatch: error
+      # Exact dependency keys include the pinned compiler, build flags and
+      # vendored crates. Server outputs are discarded before rebuilding.
+      - name: Restore native Cargo dependencies from trusted main
+        id: native_cargo
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            cargo-home/registry
+            cargo-home/git
+            rust-target
+          key: native-cargo-deps-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('rust/Cargo.lock', 'rust/Cargo.toml', 'rust/vendor/**', 'rust/.cargo/**', '.github/workflows/server-parity.yml') }}
       - name: Fetch locked Rust dependencies
         # A registry or network failure belongs to this step, not to the
         # offline native builds and tests that follow.
@@ -1145,6 +1175,14 @@ jobs:
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -w /source/rust \
             mirror.gcr.io/library/rust@sha256:ba81bc3eaa4422af576c0262515d96b0111a628a6ccc2c86557cf55c9a4bbee0 \
             cargo fetch --locked
+      - name: Discard restored native workspace outputs before rebuilding
+        run: |
+          set -euo pipefail
+          mkdir -p cargo-home rust-target
+          docker run --rm --init --user="$(id -u):$(id -g)" --network=none --cpus=2 --memory=2g --memory-swap=2g \
+            -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target \
+            -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" -w /source/rust \
+            mirror.gcr.io/library/rust@sha256:ba81bc3eaa4422af576c0262515d96b0111a628a6ccc2c86557cf55c9a4bbee0 cargo clean --locked --offline --package durable-workflow-server
       - name: Bootstrap independent published PHP and native PostgreSQL databases
         env:
           POSTGRES_IMAGE: ${{ matrix.image }}
@@ -1834,6 +1872,17 @@ jobs:
           name: corrected-marker-adapters
           path: corrected-marker-adapters
           digest-mismatch: error
+      # Exact dependency keys include the pinned compiler, build flags and
+      # vendored crates. Server outputs are discarded before rebuilding.
+      - name: Restore native Cargo dependencies from trusted main
+        id: native_cargo
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            cargo-home/registry
+            cargo-home/git
+            rust-target
+          key: native-cargo-deps-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('rust/Cargo.lock', 'rust/Cargo.toml', 'rust/vendor/**', 'rust/.cargo/**', '.github/workflows/server-parity.yml') }}
       - name: Fetch locked Rust dependencies
         # A registry or network failure belongs to this step, not to the
         # offline native builds and tests that follow.
@@ -1845,6 +1894,14 @@ jobs:
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -w /source/rust \
             mirror.gcr.io/library/rust@sha256:ba81bc3eaa4422af576c0262515d96b0111a628a6ccc2c86557cf55c9a4bbee0 \
             cargo fetch --locked
+      - name: Discard restored native workspace outputs before rebuilding
+        run: |
+          set -euo pipefail
+          mkdir -p cargo-home rust-target
+          docker run --rm --init --user="$(id -u):$(id -g)" --network=none --cpus=2 --memory=2g --memory-swap=2g \
+            -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target \
+            -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" -w /source/rust \
+            mirror.gcr.io/library/rust@sha256:ba81bc3eaa4422af576c0262515d96b0111a628a6ccc2c86557cf55c9a4bbee0 cargo clean --locked --offline --package durable-workflow-server
       - name: Build the native server
         if: ${{ matrix.part != 'native-tests' }}
         run: |
@@ -2405,6 +2462,25 @@ jobs:
           path: parity-summary
           retention-days: 1
           if-no-files-found: error
+      - name: Remove current workspace outputs before caching dependencies
+        if: ${{ success() && github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.part == 'native-tests' && steps.native_cargo.outputs.cache-hit != 'true' }}
+        run: |
+          set -euo pipefail
+          mkdir -p cargo-home rust-target
+          docker run --rm --init --user="$(id -u):$(id -g)" --network=none --cpus=2 --memory=2g --memory-swap=2g \
+            -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target \
+            -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" -w /source/rust \
+            mirror.gcr.io/library/rust@sha256:ba81bc3eaa4422af576c0262515d96b0111a628a6ccc2c86557cf55c9a4bbee0 cargo clean --locked --offline --package durable-workflow-server
+      - name: Save native Cargo dependencies from successful main native tests
+        if: ${{ success() && github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.part == 'native-tests' && steps.native_cargo.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            cargo-home/registry
+            cargo-home/git
+            rust-target
+          key: native-cargo-deps-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('rust/Cargo.lock', 'rust/Cargo.toml', 'rust/vendor/**', 'rust/.cargo/**', '.github/workflows/server-parity.yml') }}
+
 
   # The one Shared Server fixtures result. It always runs, including after a
   # failure or cancellation, and passes only when every fixture job passed, or

tests/Unit/ServerParityAdapterCacheTest.mjs

@@ -19,8 +19,8 @@ function job(name) {
 
 const steps = block => block.split(/\n {6}(?=- (?:name|uses):)/).slice(1);
 
-test('only the adapter job caches, and only public registry data and the build tree', () => {
-  const uses = workflow.match(/uses: actions\/cache[^\s]*/g) ?? [];
+test('the adapter job caches only public registry data and the build tree', () => {
+  const uses = job('published-sdk-adapters').match(/uses: actions\/cache[^\s]*/g) ?? [];
   assert.deepEqual(uses, [
     'uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9',
     'uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9',

tests/Unit/ServerParityPartsTest.mjs

@@ -12,6 +12,7 @@ const workflow = readFileSync('.github/workflows/server-parity.yml', 'utf8');
 const PARTS = ['native-tests', 'corpus', 'restarts', 'cohorts', 'sdk-directions', 'corrected-markers'];
 const SHARED_NODES = 'Start the published PHP and native nodes the corpus parts share';
 const EVERY_PART = [/^actions\/checkout@/, /^Pull the pinned images, retrying registry errors$/, /^Fetch /,
+  /^Restore native Cargo dependencies from trusted main$/, /^Discard restored native workspace outputs before rebuilding$/,
   /^Create TLS fixture certificates$/, /^Bootstrap independent /, /^Collect /, /^Summarize /, /^Retain /];
 
 function job(name) {