Repository navigation
Conversation
release.yml had no Rust cache at all, so every release compiled all 799 crates from scratch on six platforms. Of the Linux leg's 568 seconds inside tauri-action, 408 were cargo; on windows-latest it was roughly 600 of 694. test.yml has cached since it was written - the build matrix simply never got one. Each leg now carries a rust-cache keyed by a new `cache_key` matrix field, because rust-cache keys on the job, the runner's os and arch, rustc and the lockfile, and on none of the matrix values: the two macOS legs would otherwise share one key and restore each other's architecture. Both caches save only from `main`. A run may restore caches scoped to its own ref or to the default branch, which here is `main`, so a cache written from `develop` is invisible to a release and one written from a pull request is invisible to everything. Twelve rust entries had accumulated that way - four of them scoped to a merged PR and unreadable by anything - filling 8.6 GB of GitHub's 10 GB budget, at which point the cache evicts itself and nothing stays warm. Three entries now, refreshed once per release. The Free Disk Space steps blocked for 91 seconds in a test job whose cargo test takes 24, and 50 in a build leg. Almost all of it is /usr/local/lib/android, nine gigabytes of small files. They run in the background now: the disk has to be free before cargo needs it, not before the next step starts. $AGENT_TOOLSDIRECTORY is no longer deleted, which is what forced the step to run ahead of setup-node and is the one path a backgrounded rm could have raced. Also: the ubuntu frontend leg ran the same fourteen test files twice, once plain and once under coverage; clippy and fmt ran on three operating systems for a platform-independent, advisory result; npm ci took 123 seconds on windows-11-arm with an audit and a funding lookup it has no use for; and no job in test.yml had a timeout, so one run sat thirteen minutes in a runner queue with nothing to bound it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P4Pn5YzK5yErCEZkV47WmN
Dependency graph and Dependabot alerts are repository settings and were already on; what was missing is the config file that turns on scheduled version updates, and a scanner. Dependabot aims at the default branch unless told otherwise, and the default branch here is main - where a merge is the release decision. Every ecosystem therefore sets target-branch: develop. A dependency pull request merged to main would not in fact release (the tag for the current version exists, so prepare stops at should_release=false) but it would run the whole suite to work that out, and it is the wrong branch for how this repository is meant to move. Updates are grouped and monthly because of the Rust cache. Its key hashes Cargo.lock, so any crate bump is a miss and the pull request compiles all 799 crates cold on three operating systems. One grouped pull request a month pays that once. Majors stay individual - those are the ones worth reading. The github-actions ecosystem is included because it is what would have flagged actions-rs/toolchain being archived, which test.yml had to notice by hand, and cargo git sources like `drag` stay manual because Dependabot does not update them. CodeQL analyses all three languages without a build - Rust's buildless extractor went generally available in October 2025 - so it reads src-tauri without compiling any of it. It runs on pull requests and on a weekly schedule, never from test.yml or release.yml, and it must not be added to the required status checks: a scanner whose query pack updates on its own schedule is not a reason to refuse to ship a binary, which is the argument the advisory clippy and fmt steps already make. Worth knowing before reading a clean result: CodeQL's JavaScript extractor does not parse .svelte files, so src/lib/**/*.ts is covered and the script blocks inside components are not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P4Pn5YzK5yErCEZkV47WmN
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.