CI Caching Strategies

Relevant source files

The following files were used as context for generating this wiki page:

• tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md
• tasks/plan.md
• README.md
• mise.toml
• Cargo.toml
• rustfmt.toml

Introduction

The guiltty project employs a multi-layered Continuous Integration (CI) caching strategy designed to harden the build environment, ensure reproducibility, and reduce job latency. The primary goal is to optimize the "quality" job, which enforces strict gates including formatting checks, linting with Clippy, and code coverage minimums.

This strategy centers on pinning GitHub Actions to specific commit SHAs to prevent supply-chain attacks and utilizing specialized Rust caching actions to accelerate dependency resolution and compilation. The CI pipeline is strictly coupled with the project's toolchain configuration, ensuring that the environment used in GitHub Actions matches the local development environment.

Sources: tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md:1-5, README.md:32-37

Architecture and Components

Build Acceleration via Caching

The project utilizes Swatinem/rust-cache to maintain a persistent cache of the Cargo registry and build artifacts. This is specifically integrated into the quality job. The architecture prioritizes "fail-fast" logic by placing cheap operations before the cache restoration step.

The following diagram illustrates the execution flow of the CI quality job and where caching is applied:

The diagram shows that cargo fmt is executed before cache restoration because it is computationally "cheap" and does not require cached artifacts to validate code style.
Sources: tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md:32-38

Action Pinning and Reproducibility

To ensure a secure and reproducible environment, all external GitHub Actions are pinned to specific commit SHAs rather than mutable version tags. Furthermore, the runner environment is pinned to a specific Ubuntu version (ubuntu-24.04) to prevent drifting behavior.

Action / Component	Version/SHA Pin	Purpose
actions/checkout	11d5960a326750d5838078e36cf38b85af677262	Repository checkout (# v4.4.0)
jdx/mise-action	9e7f7633ff6f6d6048a9418a68d48f288f50eb14	Toolchain management (# v4.2.3)
Swatinem/rust-cache	23869a5bd66c73db3c0ac40331f3206eb23791dc	Cargo/Build caching (# v2.9.1)
Runner OS	ubuntu-24.04	Reproducible execution environment

Sources: tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md:13-35

Logic and Configuration

Toolchain Consistency

Caching efficiency relies on toolchain stability. The project uses mise to pin the Rust toolchain version. This version is mirrored in the Cargo.toml workspace configuration as the Minimum Supported Rust Version (MSRV).

# mise.toml
[tools]
rust = { version = "1.96.0", components = "clippy,rustfmt" }

# Cargo.toml (Workspace)
[workspace.package]
rust-version = "1.96.0"

Sources: mise.toml:1-2, Cargo.toml:11-12

Cache Validation Logic

The CI system validates the cache effectiveness through the following logic:

1. Cache Restoration: The system attempts to restore the cache based on the Cargo.lock file.
2. Hit Detection: A cache hit is confirmed if a second CI run on the same branch (with no Cargo.lock changes) shows a "Cache restored" log line.
3. Execution Integrity: Caching is configured to only impact duration; it must not change the outcome of fmt, clippy, or llvm-cov checks.

Sources: tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md:39-43

Dependency Update Strategy

To maintain the security of the pinned SHAs, the project uses Dependabot. The configuration is set to monitor the github-actions ecosystem on a weekly schedule. This ensures that while the builds are pinned for stability, they do not fall behind on critical security updates for CI components.

Sources: tasks/issue-8-chore-ci-hardening-follow-ups-caching-sha-pinned.md:52-58

Conclusion

CI Caching in the guiltty project is a strategic implementation that balances security (via SHA pinning) and developer velocity (via rust-cache). By decoupling style checks from the cache-heavy compilation steps and pinning the underlying OS and toolchain, the project achieves a high degree of build determinism and efficiency.