faster, cheaper (pick two): improve CI workflow and switch to free github runner (#5702)

Co-authored-by: Douwe Osinga <douwe@block.xyz>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

.github/workflows/build-cli.yml

@@ -78,29 +78,17 @@ jobs:
         if: matrix.use-cross
         run: source ./bin/activate-hermit && cargo install cross --git https://github.com/cross-rs/cross
 
-      # Cache Cargo registry and git dependencies for Windows builds
+      - name: Cache Cargo artifacts (Linux/macOS)
-      - name: Cache Cargo registry (Windows)
+        if: matrix.use-cross
-        if: matrix.use-docker
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f
         with:
-          path: |
+          key: ${{ matrix.architecture }}-${{ matrix.target-suffix }}
-            ~/.cargo/registry/index
-            ~/.cargo/registry/cache
-            ~/.cargo/git/db
-          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-registry-
 
-      # Cache compiled dependencies (target/release/deps) for Windows builds
+      - name: Cache Cargo artifacts (Windows)
-      - name: Cache Cargo build (Windows)
         if: matrix.use-docker
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
         with:
-          path: target
+          key: ${{ matrix.architecture }}-${{ matrix.target-suffix }}
-          key: ${{ runner.os }}-cargo-build-release-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('rust-toolchain.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-build-release-${{ hashFiles('Cargo.lock') }}-
-            ${{ runner.os }}-cargo-build-release-
 
       - name: Build CLI (Linux/macOS)
         if: matrix.use-cross

.github/workflows/bundle-desktop-intel.yml

@@ -63,29 +63,10 @@ jobs:
           cd ui/desktop
           npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
 
-      - name: Cache Cargo registry
+      - name: Cache Rust dependencies
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
         with:
-          path: ~/.cargo/registry
+          key: intel
-          key: ${{ runner.os }}-intel-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-intel-cargo-registry-
-
-      - name: Cache Cargo index
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
-        with:
-          path: ~/.cargo/index
-          key: ${{ runner.os }}-intel-cargo-index
-          restore-keys: |
-            ${{ runner.os }}-intel-cargo-index
-
-      - name: Cache Cargo build
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
-        with:
-          path: target
-          key: ${{ runner.os }}-intel-cargo-build-release-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-intel-cargo-build-release-
 
 
       - name: Build goose-server for Intel macOS (x86_64)

.github/workflows/bundle-desktop-linux.yml

@@ -87,17 +87,10 @@ jobs:
       - name: Install cross
         run: source ./bin/activate-hermit && cargo install cross --git https://github.com/cross-rs/cross
 
-      - name: Cache Cargo artifacts
+      - name: Cache Rust dependencies
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
         with:
-          path: |
+          key: linux
-            ${{ env.CARGO_HOME }}/bin/
-            ${{ env.CARGO_HOME }}/registry/index/
-            ${{ env.CARGO_HOME }}/registry/cache/
-            ${{ env.CARGO_HOME }}/git/db/
-          key: ${{ runner.os }}-cargo-release-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-release-
 
       - name: Build goosed binary
         env:
@@ -164,21 +157,21 @@ jobs:
           find ui/desktop/out/ -name "*.deb" -o -name "*.rpm" -exec ls -lh {} \;
 
       - name: Upload .deb package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: Goose-linux-x64-deb
           path: ui/desktop/out/make/deb/x64/*.deb
           if-no-files-found: error
 
       - name: Upload .rpm package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: Goose-linux-x64-rpm
           path: ui/desktop/out/make/rpm/x64/*.rpm
           if-no-files-found: error
 
       - name: Upload combined Linux packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: Goose-linux-x64
           path: |

.github/workflows/bundle-desktop-windows.yml

@@ -41,15 +41,12 @@ jobs:
     runs-on: ubuntu-latest  # Use Ubuntu for cross-compilation
 
     steps:
-      # 1) Check out source
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
         with:
-          # Only pass ref if it's explicitly set, otherwise let checkout action use its default behavior
           ref: ${{ inputs.ref != '' && inputs.ref || '' }}
           fetch-depth: 0
 
-      # 2) Configure AWS credentials for code signing
       - name: Configure AWS credentials
         if: inputs.signing && inputs.signing == true
         uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # ratchet:aws-actions/configure-aws-credentials@v4
@@ -57,13 +54,11 @@ jobs:
           role-to-assume: ${{ github.ref == 'refs/heads/main' && secrets.WINDOW_SIGNING_ROLE || secrets.WINDOW_SIGNING_ROLE_TAG }}
           aws-region: us-west-2
 
-      # 2) Set up Node.js
       - name: Set up Node.js
         uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # pin@v3
         with:
           node-version: 22
 
-      # 3) Cache dependencies
       - name: Cache node_modules
         uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
         with:
@@ -75,29 +70,11 @@ jobs:
           restore-keys: |
             windows-npm-cache-v1-${{ runner.os }}-node22-
 
-      # Cache Cargo registry and git dependencies
+      - name: Cache Rust dependencies
-      - name: Cache Cargo registry
+        uses: Swatinem/rust-cache@v2
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f
         with:
-          path: |
+          key: windows
-            ~/.cargo/registry/index
-            ~/.cargo/registry/cache
-            ~/.cargo/git/db
-          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-registry-
 
-      # Cache compiled dependencies (target/release/deps)
-      - name: Cache Cargo build
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f
-        with:
-          path: target
-          key: ${{ runner.os }}-cargo-build-release-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('rust-toolchain.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-build-release-${{ hashFiles('Cargo.lock') }}-
-            ${{ runner.os }}-cargo-build-release-
-
-      # 4) Build Rust for Windows using Docker (cross-compilation with enhanced caching)
       - name: Build Windows executable using Docker cross-compilation with enhanced caching
         run: |
           echo "🚀 Building Windows executable with enhanced GitHub Actions caching..."
@@ -198,7 +175,6 @@ jobs:
           ls -la ./target/x86_64-pc-windows-gnu/release/goosed.exe
           ls -la ./target/x86_64-pc-windows-gnu/release/*.dll
 
-      # 5) Prepare Windows binary and DLLs
       - name: Prepare Windows binary and DLLs
         run: |
           if [ ! -f "./target/x86_64-pc-windows-gnu/release/goosed.exe" ]; then
@@ -230,7 +206,6 @@ jobs:
             echo "Windows-specific files copied successfully"
           fi
 
-      # 6) Install & build UI desktop
       - name: Build desktop UI with npm
         run: |
           cd ui/desktop
@@ -238,7 +213,6 @@ jobs:
           npm install
           npm run bundle:windows
 
-      # 7) Copy exe/dll to final out folder and prepare flat distribution
       - name: Copy exe/dll to final out folder and prepare flat distribution
         run: |
           cd ui/desktop
@@ -255,7 +229,6 @@ jobs:
           echo "📋 Binary files in resources/bin:"
           ls -la ./dist-windows/resources/bin/
 
-      # 8) Sign Windows executables with jsign + AWS KMS
       - name: Sign Windows executables with jsign + AWS KMS
         if: inputs.signing && inputs.signing == true
         run: |
@@ -323,7 +296,6 @@ jobs:
           # Clean up certificate file
           rm -f ${GITHUB_WORKSPACE}/block-codesign-cert.pem
 
-      # 9) Verify signed executables are in final distribution
       - name: Verify signed executables are in final distribution
         if: inputs.signing && inputs.signing == true
         run: |
@@ -338,7 +310,6 @@ jobs:
           osslsigncode verify ui/desktop/dist-windows/resources/bin/goosed.exe
           echo "✅ Backend executable signature verification passed"
 
-      # 10) Create Windows zip package
       - name: Create Windows zip package
         run: |
           cd ui/desktop
@@ -354,7 +325,6 @@ jobs:
           mkdir -p out/Goose-win32-x64/
           cp Goose-win32-x64.zip out/Goose-win32-x64/
 
-      # 11) Upload the final Windows build
       - name: Upload Windows build artifacts
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # pin@v4
         with:

.github/workflows/bundle-desktop.yml

@@ -108,29 +108,8 @@ jobs:
           cd ui/desktop
           npm version "${VERSION}" --no-git-tag-version --allow-same-version
 
-      - name: Cache Cargo registry
+      - name: Cache Rust dependencies
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
+        uses: Swatinem/rust-cache@v2
-        with:
-          path: ~/.cargo/registry
-          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-registry-
-
-      - name: Cache Cargo index
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
-        with:
-          path: ~/.cargo/index
-          key: ${{ runner.os }}-cargo-index
-          restore-keys: |
-            ${{ runner.os }}-cargo-index
-
-      - name: Cache Cargo build
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
-        with:
-          path: target
-          key: ${{ runner.os }}-cargo-build-release-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-build-release-
 
       # Build the project
       - name: Build goosed

.github/workflows/ci.yml

@@ -1,3 +1,5 @@
+name: CI
+
 on:
   push:
     branches:
@@ -10,8 +12,6 @@ on:
       - main
   workflow_dispatch:
 
-name: CI
-
 jobs:
   changes:
     runs-on: ubuntu-latest
@@ -41,23 +41,21 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
 
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
       - name: Run cargo fmt
-        run: source ./bin/activate-hermit && cargo fmt --check
+        run: cargo fmt --check
 
   rust-build-and-test:
     name: Build and Test Rust Project
-    runs-on: goose
+    runs-on: ubuntu-latest
     needs: changes
     if: needs.changes.outputs.code == 'true' || github.event_name != 'pull_request'
     steps:
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
 
-      - name: Activate hermit and set CARGO_HOME
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
-        run: |
-          source bin/activate-hermit
-          echo "CARGO_HOME=$CARGO_HOME" >> $GITHUB_ENV
-          echo "RUSTUP_HOME=$RUSTUP_HOME" >> $GITHUB_ENV
 
       - name: Install Dependencies
         run: |
@@ -65,32 +63,52 @@ jobs:
           sudo apt install -y libdbus-1-dev gnome-keyring libxcb1-dev
 
       - name: Cache Cargo artifacts
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
+        uses: Swatinem/rust-cache@v2
-        with:
-          path: |
-            ${{ env.CARGO_HOME }}/bin/
-            ${{ env.CARGO_HOME }}/registry/index/
-            ${{ env.CARGO_HOME }}/registry/cache/
-            ${{ env.CARGO_HOME }}/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-debug-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-debug-
 
       - name: Build and Test
         run: |
           gnome-keyring-daemon --components=secrets --daemonize --unlock <<< 'foobar'
-          source ../bin/activate-hermit
           export CARGO_INCREMENTAL=0
-          cargo test --jobs 2
+          cargo test -- --skip scenario_tests::scenarios::tests
+          cargo test --jobs 1 scenario_tests::scenarios::tests
         working-directory: crates
 
+
+  rust-lint:
+    name: Lint Rust Code
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.code == 'true' || github.event_name != 'pull_request'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
+      - uses: Swatinem/rust-cache@v2
+
       - name: Lint
         run: |
           source ./bin/activate-hermit
+          # use the non-hermit rust toolchain because the rust-cache action does not
+          # play nicely with hermit-managed rust
+          hermit uninstall rustup
           export CARGO_INCREMENTAL=0
           ./scripts/clippy-lint.sh
 
+  openapi-schema-check:
+    name: Check OpenAPI Schema is Up-to-Date
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.code == 'true' || github.event_name != 'pull_request'
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
+      - name: Cache Cargo artifacts
+        uses: Swatinem/rust-cache@v2
+
       - name: Install Node.js Dependencies for OpenAPI Check
         run: source ../../bin/activate-hermit && npm ci
         working-directory: ui/desktop
@@ -98,6 +116,7 @@ jobs:
       - name: Check OpenAPI Schema is Up-to-Date
         run: |
           source ./bin/activate-hermit
+          hermit uninstall rustup
           just check-openapi-schema
 
   desktop-lint:
@@ -130,5 +149,3 @@ jobs:
       - name: Run Tests
         run: source ../../bin/activate-hermit && npm run test:run
         working-directory: ui/desktop
-
-

.github/workflows/pr-smoke-test.yml

@@ -55,33 +55,18 @@ jobs:
         with:
           ref: ${{ github.event.inputs.branch || github.ref }}
 
-      - name: Activate hermit and set CARGO_HOME
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
-        run: |
-          source bin/activate-hermit
-          echo "CARGO_HOME=$CARGO_HOME" >> $GITHUB_ENV
-          echo "RUSTUP_HOME=$RUSTUP_HOME" >> $GITHUB_ENV
 
       - name: Install Dependencies
         run: |
           sudo apt update -y
           sudo apt install -y libdbus-1-dev gnome-keyring libxcb1-dev
 
-      - name: Cache Cargo artifacts
+      - name: Cache Rust dependencies
-        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
+        uses: Swatinem/rust-cache@v2
-        with:
-          path: |
-            ${{ env.CARGO_HOME }}/bin/
-            ${{ env.CARGO_HOME }}/registry/index/
-            ${{ env.CARGO_HOME }}/registry/cache/
-            ${{ env.CARGO_HOME }}/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-release-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-release-
 
       - name: Build Release Binary for Smoke Tests
         run: |
-          source ./bin/activate-hermit
           cargo build --release
 
       - name: Upload Binary for Smoke Tests

scripts/clippy-baseline.sh

@@ -127,7 +127,7 @@ check_all_baseline_rules() {
     done
 
     local temp_json=$(mktemp)
-    cargo clippy --jobs 2 --message-format=json -- $clippy_flags > "$temp_json"
+    cargo clippy --jobs 2 --message-format=json -- $clippy_flags | tee "$temp_json"
 
     local failed_rules=()