ci: cache Rust builds with Kache #556

Workflow file for this run

.github/workflows/windows-sandbox-w0.yml at 78bad00

	# Licensed to the Apache Software Foundation (ASF) under one
	# or more contributor license agreements. See the NOTICE file
	# distributed with this work for additional information
	# regarding copyright ownership. The ASF licenses this file
	# to you under the Apache License, Version 2.0 (the
	# "License"); you may not use this file except in compliance
	# with the License. You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing,
	# software distributed under the License is distributed on an
	# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
	# KIND, either express or implied. See the License for the
	# specific language governing permissions and limitations
	# under the License.

	name: Windows sandbox W0 evidence

	# The paths below are a pre-filter, not this lane's real input. The real input
	# is the import closure of the sandbox and filesystem-worker sources, which
	# reaches well past any list worth hand-maintaining. So they name the
	# directories that own the sandbox, which keeps a change there blocking before
	# merge, and the nightly run is what covers transitive edits once they land.
	on:
	pull_request:
	paths:
	- 'experiments/windows-sandbox/**'
	- 'packages/runtime/src/sandbox/**'
	- 'packages/runtime/src/filesystem-worker/**'
	- 'packages/runtime/src/__tests__/filesystem-worker-windows-smoke.test.ts'
	- '.github/workflows/windows-sandbox-w0.yml'
	schedule:
	# Offset from windows-baseline so the two Windows lanes do not overlap.
	- cron: '17 7 * * *'
	workflow_dispatch:

	permissions:
	contents: read

	# Pull request pushes supersede each other. Scheduled and manual runs each get
	# a unique group, so neither can discard the other while pending or running.
	concurrency:
	group: windows-sandbox-w0-${{ github.head_ref \|\| github.run_id }}
	cancel-in-progress: true

	jobs:
	protocol:
	name: windows_sandbox_w0_protocol
	runs-on: windows-2025
	timeout-minutes: 45
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
	with:
	node-version: '24'
	cache: npm
	- id: rustc
	name: Resolve Rust cache version
	shell: bash
	run: \|
	echo "version=$(rustc --version \| cut -d ' ' -f 2)" >> "$GITHUB_OUTPUT"
	{
	echo "KACHE_CACHE_DIR=${{ runner.temp }}/kache"
	echo "KACHE_RUNTIME_DIR=${{ runner.temp }}/kache-runtime"
	echo "RUSTC_WRAPPER=kache"
	} >> "$GITHUB_ENV"
	- name: Install Kache
	uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
	with:
	tool: kache@0.16.0
	- id: kache-cache
	name: Restore Rust build cache
	uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	path: ${{ runner.temp }}/kache
	key: kache-windows-sandbox-launcher-v0.16.0-${{ runner.os }}-${{ runner.arch }}-rust-${{ steps.rustc.outputs.version }}-${{ hashFiles('experiments/windows-sandbox/launcher/Cargo.lock') }}
	restore-keys: kache-windows-sandbox-launcher-v0.16.0-${{ runner.os }}-${{ runner.arch }}-rust-${{ steps.rustc.outputs.version }}-
	- name: Record atomic launcher capability
	shell: pwsh
	run: ./experiments/windows-sandbox/atomic-launch-capability.ps1

	- name: Build process-containment launcher
	working-directory: experiments/windows-sandbox/launcher
	run: cargo build --locked
	# Rust is the shipped protocol authority. Its tests consume the exact
	# manifest structs used by the broker instead of a parallel MJS parser.
	- name: Verify launcher protocol and broker authorization
	working-directory: experiments/windows-sandbox/launcher
	run: cargo test --locked
	- name: Report Rust build cache
	shell: bash
	run: kache report --format github --since 24h >> "$GITHUB_STEP_SUMMARY"
	- name: Save Rust build cache
	if: github.ref_name == github.event.repository.default_branch
	uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	path: ${{ runner.temp }}/kache
	key: ${{ steps.kache-cache.outputs.cache-primary-key }}
	- name: Verify secure broker pipe
	shell: pwsh
	run: ./experiments/windows-sandbox/broker-pipe-smoke.ps1
	- name: Verify broker client handoff
	shell: pwsh
	run: ./experiments/windows-sandbox/broker-client-smoke.ps1
	- name: Verify one-shot local broker lifecycle
	shell: pwsh
	run: ./experiments/windows-sandbox/broker-local-smoke.ps1
	- name: Verify AppContainer identity candidate
	shell: pwsh
	run: ./experiments/windows-sandbox/appcontainer-smoke.ps1
	- name: Verify production-identity readiness probe
	shell: pwsh
	run: ./experiments/windows-sandbox/readiness-probe-smoke.ps1
	- name: Verify filesystem-worker stdio relay
	shell: pwsh
	run: ./experiments/windows-sandbox/stdio-relay-smoke.ps1
	- name: Verify ACL grant recovery
	shell: pwsh
	run: ./experiments/windows-sandbox/acl-recovery-smoke.ps1
	- name: Probe atomic Job launch candidate
	shell: pwsh
	run: ./experiments/windows-sandbox/atomic-launch-smoke.ps1
	- name: Probe unprivileged restricted-token candidate
	shell: pwsh
	run: ./experiments/windows-sandbox/launcher-smoke.ps1

	- name: Install workspace dependencies
	run: npm ci
	# The runtime's tsc build resolves types from its workspace dependencies'
	# dist output, so each dependency builds first in topological order.
	- name: Build core workspace
	run: npm run build --workspace @maka/core
	- name: Build storage workspace
	run: npm run build --workspace @maka/storage
	- name: Build runtime workspace
	run: npm run build --workspace @maka/runtime
	- name: Run real filesystem-worker operations through the broker
	run: node --test packages/runtime/dist/__tests__/filesystem-worker-windows-smoke.test.js

Navigation Menu

Uh oh!

ci: cache Rust builds with Kache #556

Workflow file

ci: cache Rust builds with Kache #556

Uh oh!

Workflow file for this run