From 718929cb2c84f47c190c6f59b4c8325a4f78ed2c Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Thu, 8 Jan 2026 11:05:37 -0600
Subject: [PATCH 01/15] Concurrency test

---
 tools/ci/src/main.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/ci/src/main.rs b/tools/ci/src/main.rs
index 036e8993033..98c8fa03e10 100644
--- a/tools/ci/src/main.rs
+++ b/tools/ci/src/main.rs
@@ -127,7 +127,12 @@ fn main() -> Result<()> {
         Some(CiCmd::Test) => {
             // TODO: This doesn't work on at least user Linux machines, because something here apparently uses `sudo`?
 
-            cmd!("cargo", "test", "--all", "--", "--skip", "unreal").run()?;
+            // cmd!("cargo", "test", "--all", "--", "--skip", "unreal").run()?;
+            cmd!("cargo", "test", "-j", "2", "--all", "--", "--test-threads=1", "--skip", "unreal")
+                .env("CARGO_INCREMENTAL", "0")
+                .env("RUST_TEST_THREADS", "4") // redundant with --test-threads, but harmless and helpful for spawned test bins
+                .env("CARGO_BUILD_JOBS", "2")  // redundant with -j, but keeps behavior consistent if command changes
+                .run()?;
             // TODO: This should check for a diff at the start. If there is one, we should alert the user
             // that we're disabling diff checks because they have a dirty git repo, and to re-run in a clean one
             // if they want those checks.

From 3b6160bf684d746db081609c809b611e317649dd Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Thu, 8 Jan 2026 14:31:18 -0600
Subject: [PATCH 02/15] Cargo fmt

---
 tools/ci/src/main.rs | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/tools/ci/src/main.rs b/tools/ci/src/main.rs
index 98c8fa03e10..f1f55f7d4cd 100644
--- a/tools/ci/src/main.rs
+++ b/tools/ci/src/main.rs
@@ -128,11 +128,21 @@ fn main() -> Result<()> {
             // TODO: This doesn't work on at least user Linux machines, because something here apparently uses `sudo`?
 
             // cmd!("cargo", "test", "--all", "--", "--skip", "unreal").run()?;
-            cmd!("cargo", "test", "-j", "2", "--all", "--", "--test-threads=1", "--skip", "unreal")
-                .env("CARGO_INCREMENTAL", "0")
-                .env("RUST_TEST_THREADS", "4") // redundant with --test-threads, but harmless and helpful for spawned test bins
-                .env("CARGO_BUILD_JOBS", "2")  // redundant with -j, but keeps behavior consistent if command changes
-                .run()?;
+            cmd!(
+                "cargo",
+                "test",
+                "-j",
+                "2",
+                "--all",
+                "--",
+                "--test-threads=1",
+                "--skip",
+                "unreal"
+            )
+            .env("CARGO_INCREMENTAL", "0")
+            .env("RUST_TEST_THREADS", "4") // redundant with --test-threads, but harmless and helpful for spawned test bins
+            .env("CARGO_BUILD_JOBS", "2") // redundant with -j, but keeps behavior consistent if command changes
+            .run()?;
             // TODO: This should check for a diff at the start. If there is one, we should alert the user
             // that we're disabling diff checks because they have a dirty git repo, and to re-run in a clean one
             // if they want those checks.

From 11cd39ddce88cac5142e61f437934d1e2dfe65e0 Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Tue, 20 Jan 2026 17:14:58 -0600
Subject: [PATCH 03/15] Update main.rs

Signed-off-by: John Detter <4099508+jdetter@users.noreply.github.com>
---
 tools/ci/src/main.rs | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/tools/ci/src/main.rs b/tools/ci/src/main.rs
index f1f55f7d4cd..2f1c6bf2061 100644
--- a/tools/ci/src/main.rs
+++ b/tools/ci/src/main.rs
@@ -131,17 +131,12 @@ fn main() -> Result<()> {
             cmd!(
                 "cargo",
                 "test",
-                "-j",
-                "2",
                 "--all",
                 "--",
-                "--test-threads=1",
+                "--test-threads=10",
                 "--skip",
                 "unreal"
             )
-            .env("CARGO_INCREMENTAL", "0")
-            .env("RUST_TEST_THREADS", "4") // redundant with --test-threads, but harmless and helpful for spawned test bins
-            .env("CARGO_BUILD_JOBS", "2") // redundant with -j, but keeps behavior consistent if command changes
             .run()?;
             // TODO: This should check for a diff at the start. If there is one, we should alert the user
             // that we're disabling diff checks because they have a dirty git repo, and to re-run in a clean one

From a621e2c7de742aa5a127bed5372729042bf5f25d Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Tue, 20 Jan 2026 17:16:52 -0600
Subject: [PATCH 04/15] Update main.rs

Signed-off-by: John Detter <4099508+jdetter@users.noreply.github.com>
---
 tools/ci/src/main.rs | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/tools/ci/src/main.rs b/tools/ci/src/main.rs
index 2f1c6bf2061..d723d9427cc 100644
--- a/tools/ci/src/main.rs
+++ b/tools/ci/src/main.rs
@@ -128,16 +128,7 @@ fn main() -> Result<()> {
             // TODO: This doesn't work on at least user Linux machines, because something here apparently uses `sudo`?
 
             // cmd!("cargo", "test", "--all", "--", "--skip", "unreal").run()?;
-            cmd!(
-                "cargo",
-                "test",
-                "--all",
-                "--",
-                "--test-threads=10",
-                "--skip",
-                "unreal"
-            )
-            .run()?;
+            cmd!("cargo", "test", "--all", "--", "--test-threads=10", "--skip", "unreal").run()?;
             // TODO: This should check for a diff at the start. If there is one, we should alert the user
             // that we're disabling diff checks because they have a dirty git repo, and to re-run in a clean one
             // if they want those checks.

From 7d5b5debd7d90de0d92bc6009c452d651ac4f3ba Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Thu, 22 Jan 2026 14:44:35 -0600
Subject: [PATCH 05/15] Apply suggestions from code review

Signed-off-by: John Detter <4099508+jdetter@users.noreply.github.com>
---
 tools/ci/src/main.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/ci/src/main.rs b/tools/ci/src/main.rs
index d723d9427cc..bcefdb7bf66 100644
--- a/tools/ci/src/main.rs
+++ b/tools/ci/src/main.rs
@@ -128,7 +128,7 @@ fn main() -> Result<()> {
             // TODO: This doesn't work on at least user Linux machines, because something here apparently uses `sudo`?
 
             // cmd!("cargo", "test", "--all", "--", "--skip", "unreal").run()?;
-            cmd!("cargo", "test", "--all", "--", "--test-threads=10", "--skip", "unreal").run()?;
+            cmd!("cargo", "test", "--all", "--", "--test-threads=2", "--skip", "unreal").run()?;
             // TODO: This should check for a diff at the start. If there is one, we should alert the user
             // that we're disabling diff checks because they have a dirty git repo, and to re-run in a clean one
             // if they want those checks.

From a9c5b4820f7948f0dc96e4d14582524c83eddb2a Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Fri, 23 Jan 2026 02:16:40 -0600
Subject: [PATCH 06/15] Containerless workflow

---
 .github/workflows/ci.yml | 88 +++++++++-------------------------------
 1 file changed, 19 insertions(+), 69 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 349624688f2..ac81887ceaa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,17 +19,14 @@ concurrency:
 
 jobs:
   docker_smoketests:
-    needs: [lints]
+    needs: [lints, llm_ci_check]
     name: Smoketests
     strategy:
       matrix:
-        runner: [spacetimedb-new-runner, windows-latest]
+        runner: [spacetimedb-new-runner-2, windows-latest]
         include:
-          - runner: spacetimedb-new-runner
+          - runner: spacetimedb-new-runner-2
             smoketest_args: --docker
-            container:
-              image: localhost:5000/spacetimedb-ci:latest
-              options: --privileged
           - runner: windows-latest
             smoketest_args: --no-build-cli
             container: null
@@ -86,10 +83,6 @@ jobs:
         shell: powershell
       - name: Build crates
         run: cargo build -p spacetimedb-cli -p spacetimedb-standalone -p spacetimedb-update
-      - name: Start Docker daemon
-        if: runner.os == 'Linux'
-        run: /usr/local/bin/start-docker.sh
-
       - name: Build and start database (Linux)
         if: runner.os == 'Linux'
         run: |
@@ -121,13 +114,11 @@ jobs:
         run: docker compose -f .github/docker-compose.yml down
 
   test:
-    needs: [lints]
+    needs: [lints, llm_ci_check]
     name: Test Suite
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
+    # TODO: Migrate to spacetimedb-new-runner2 when flakes are fixed
+    runs-on: ubuntu-latest
+
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
@@ -180,11 +171,7 @@ jobs:
 
   lints:
     name: Lints
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
+    runs-on: spacetimedb-new-runner-2
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
@@ -212,11 +199,7 @@ jobs:
 
   wasm_bindings:
     name: Build and test wasm bindings
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
+    runs-on: spacetimedb-new-runner-2
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
@@ -239,11 +222,7 @@ jobs:
 
   publish_checks:
     name: Check that packages are publishable
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
+    runs-on: ubuntu-latest
     permissions: read-all
     steps:
       - uses: actions/checkout@v3
@@ -272,11 +251,8 @@ jobs:
     strategy:
       matrix:
         include:
-          - runner: spacetimedb-new-runner
+          - runner: spacetimedb-new-runner-2
             target: x86_64-unknown-linux-gnu
-            container:
-              image: localhost:5000/spacetimedb-ci:latest
-              options: --privileged
           - { target: aarch64-unknown-linux-gnu, runner: arm-runner }
           - { target: aarch64-apple-darwin, runner: macos-latest }
           - { target: x86_64-pc-windows-msvc, runner: windows-latest }
@@ -324,7 +300,7 @@ jobs:
     name: Unreal Engine Tests
     # This can't go on e.g. ubuntu-latest because that runner runs out of disk space. ChatGPT suggested that the general solution tends to be to use
     # a custom runner.
-    runs-on: spacetimedb-new-runner
+    runs-on: spacetimedb-new-runner-2
     # Disable the tests because they are very flaky at the moment.
     # TODO: Remove this line and re-enable the `if` line just below here.
     if: false
@@ -439,11 +415,7 @@ jobs:
   cli_docs:
     name: Check CLI docs
     permissions: read-all
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
+    runs-on: spacetimedb-new-runner-2
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
@@ -508,33 +480,16 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      # Build the tool from master to ensure consistent hash computation
-      # with the llm-benchmark-update workflow (which also uses master's tool).
-      - name: Checkout master (build tool from trusted code)
-        uses: actions/checkout@v4
-        with:
-          ref: master
-          fetch-depth: 1
+      - uses: actions/checkout@v4
 
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
 
-      - name: Install llm-benchmark tool from master
-        run: |
-          cargo install --path tools/xtask-llm-benchmark --locked
-          command -v llm_benchmark
-
-      # Now checkout the PR branch to verify its benchmark files
-      - name: Checkout PR branch
-        uses: actions/checkout@v4
-        with:
-          clean: false
-
       - name: Run hash check (both langs)
-        run: llm_benchmark ci-check
+        run: cargo llm ci-check
 
   unity-testsuite:
-    needs: [lints]
+    needs: [lints, llm_ci_check]
     # Skip if this is an external contribution.
     # The license secrets will be empty, so the step would fail anyway.
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
@@ -657,13 +612,8 @@ jobs:
           UNITY_SERIAL: ${{ secrets.UNITY_SERIAL }}
 
   csharp-testsuite:
-    needs: [lints]
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
-        --cgroupns=host
+    needs: [lints, llm_ci_check]
+    runs-on: spacetimedb-new-runner-2
     timeout-minutes: 30
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
@@ -767,7 +717,7 @@ jobs:
 
   internal-tests:
     name: Internal Tests
-    needs: [lints]
+    needs: [lints, llm_ci_check]
     # Skip if not a PR or a push to master
     # Skip if this is an external contribution. GitHub secrets will be empty, so the step would fail anyway.
     if: ${{ (github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master'))

From 84a663b509d1f8457f985286f87999a6a382d89f Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Fri, 23 Jan 2026 02:21:58 -0600
Subject: [PATCH 07/15] Up to date with master

---
 .github/workflows/ci.yml | 38 +++++++++++++++++++++++++++-----------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac81887ceaa..3da6b1bac1b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   docker_smoketests:
-    needs: [lints, llm_ci_check]
+    needs: [lints]
     name: Smoketests
     strategy:
       matrix:
@@ -114,10 +114,9 @@ jobs:
         run: docker compose -f .github/docker-compose.yml down
 
   test:
-    needs: [lints, llm_ci_check]
+    needs: [lints]
     name: Test Suite
-    # TODO: Migrate to spacetimedb-new-runner2 when flakes are fixed
-    runs-on: ubuntu-latest
+    runs-on: spacetimedb-new-runner-2
 
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
@@ -222,7 +221,7 @@ jobs:
 
   publish_checks:
     name: Check that packages are publishable
-    runs-on: ubuntu-latest
+    runs-on: spacetimedb-new-runner-2
     permissions: read-all
     steps:
       - uses: actions/checkout@v3
@@ -387,7 +386,7 @@ jobs:
 
   ci_command_docs:
     name: Check CI command docs
-    runs-on: ubuntu-latest
+    runs-on: spacetimedb-new-runner-2
     steps:
       - name: Find Git ref
         env:
@@ -480,16 +479,33 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # Build the tool from master to ensure consistent hash computation
+      # with the llm-benchmark-update workflow (which also uses master's tool).
+      - name: Checkout master (build tool from trusted code)
+        uses: actions/checkout@v4
+        with:
+          ref: master
+          fetch-depth: 1
 
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
 
+      - name: Install llm-benchmark tool from master
+        run: |
+          cargo install --path tools/xtask-llm-benchmark --locked
+          command -v llm_benchmark
+
+      # Now checkout the PR branch to verify its benchmark files
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          clean: false
+
       - name: Run hash check (both langs)
-        run: cargo llm ci-check
+        run: llm_benchmark ci-check
 
   unity-testsuite:
-    needs: [lints, llm_ci_check]
+    needs: [lints]
     # Skip if this is an external contribution.
     # The license secrets will be empty, so the step would fail anyway.
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
@@ -612,7 +628,7 @@ jobs:
           UNITY_SERIAL: ${{ secrets.UNITY_SERIAL }}
 
   csharp-testsuite:
-    needs: [lints, llm_ci_check]
+    needs: [lints]
     runs-on: spacetimedb-new-runner-2
     timeout-minutes: 30
     env:
@@ -717,7 +733,7 @@ jobs:
 
   internal-tests:
     name: Internal Tests
-    needs: [lints, llm_ci_check]
+    needs: [lints]
     # Skip if not a PR or a push to master
     # Skip if this is an external contribution. GitHub secrets will be empty, so the step would fail anyway.
     if: ${{ (github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master'))

From 6bf5cbb6146d6b7576c8152681ede08840e994fe Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Wed, 28 Jan 2026 00:39:01 -0600
Subject: [PATCH 08/15] Address review

Signed-off-by: John Detter <4099508+jdetter@users.noreply.github.com>
---
 .github/workflows/ci.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02ea520d103..0ec78da8b31 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,19 +19,17 @@ concurrency:
 
 jobs:
   docker_smoketests:
-    needs: [lints]
-    name: Smoketests
+    name: Smoketests (${{ matrix.name }})
     strategy:
       matrix:
-        runner: [spacetimedb-new-runner-2, windows-latest]
         include:
-          - runner: spacetimedb-new-runner-2
+          - name: Linux
+            runner: spacetimedb-new-runner-2
             smoketest_args: --docker
-          - runner: windows-latest
+          - name: Windows
+            runner: windows-latest
             smoketest_args: --no-build-cli
-            container: null
     runs-on: ${{ matrix.runner }}
-    container: ${{ matrix.container }}
     timeout-minutes: 120
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target

From 21dbbc6fe5db5ba82367030de4551d203c5bad88 Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Wed, 28 Jan 2026 00:40:01 -0600
Subject: [PATCH 09/15] Smoketests needs lints

Signed-off-by: John Detter <4099508+jdetter@users.noreply.github.com>
---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0ec78da8b31..1a517ab9570 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,7 @@ concurrency:
 
 jobs:
   docker_smoketests:
+    needs: [lints]
     name: Smoketests (${{ matrix.name }})
     strategy:
       matrix:

From a4f89ea4258f071769ba56ff2ed9fd8e5a3cf129 Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Sat, 31 Jan 2026 16:33:01 -0600
Subject: [PATCH 10/15] CI test


From 01007fc3de0bed4850be583edfbdb139590b0ac7 Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Sat, 31 Jan 2026 18:49:51 -0600
Subject: [PATCH 11/15] Migrate fully off of containers

---
 .github/workflows/attach-artifacts.yml      |  6 +-----
 .github/workflows/ci.yml                    |  4 +---
 .github/workflows/docs-publish.yaml         |  6 +-----
 .github/workflows/docs-test.yaml            |  6 +-----
 .github/workflows/package.yml               | 15 +--------------
 .github/workflows/typescript-lint.yml       |  7 +------
 .github/workflows/typescript-test.yml       |  8 +-------
 .github/workflows/upgrade-version-check.yml |  5 +----
 8 files changed, 8 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/attach-artifacts.yml b/.github/workflows/attach-artifacts.yml
index d79ef4bcc53..23ad34343de 100644
--- a/.github/workflows/attach-artifacts.yml
+++ b/.github/workflows/attach-artifacts.yml
@@ -9,11 +9,7 @@ on:
 
 jobs:
   upload-assets:
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
+    runs-on: spacetimedb-new-runner-2
     permissions:
       contents: write  # needed to modify releases
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1a517ab9570..32ec9ceb340 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -257,13 +257,11 @@ jobs:
     strategy:
       matrix:
         include:
-          - runner: spacetimedb-new-runner-2
-            target: x86_64-unknown-linux-gnu
+          - { target: x86_64-unknown-linux-gnu, runner: spacetimedb-new-runner-2 }
           - { target: aarch64-unknown-linux-gnu, runner: arm-runner }
           - { target: aarch64-apple-darwin, runner: macos-latest }
           - { target: x86_64-pc-windows-msvc, runner: windows-latest }
     runs-on: ${{ matrix.runner }}
-    container: ${{ matrix.container }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3
diff --git a/.github/workflows/docs-publish.yaml b/.github/workflows/docs-publish.yaml
index 0f27c09f919..4b068d00bc3 100644
--- a/.github/workflows/docs-publish.yaml
+++ b/.github/workflows/docs-publish.yaml
@@ -10,11 +10,7 @@ on:
 
 jobs:
   build:
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
+    runs-on: spacetimedb-new-runner-2
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
diff --git a/.github/workflows/docs-test.yaml b/.github/workflows/docs-test.yaml
index 111ca49f62a..b7233aad847 100644
--- a/.github/workflows/docs-test.yaml
+++ b/.github/workflows/docs-test.yaml
@@ -7,11 +7,7 @@ on:
 
 jobs:
   build:
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: >-
-        --privileged
+    runs-on: spacetimedb-new-runner-2
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index e9ccf1d8bec..09ecff1e394 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -14,13 +14,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - name: x86_64 Linux
-            target: x86_64-unknown-linux-gnu
-            runner: spacetimedb-new-runner
-            container:
-              image: localhost:5000/spacetimedb-ci:latest
-              options: >-
-                --privileged
+          - { name: x86_64 Linux, target: x86_64-unknown-linux-gnu, runner: spacetimedb-new-runner-2 }
           - { name: aarch64 Linux, target: aarch64-unknown-linux-gnu, runner: arm-runner }
           # Disabled because musl builds weren't working and we didn't want to investigate. See https://github.com/clockworklabs/SpacetimeDB/pull/2964.
           # - { name: x86_64 Linux musl, target: x86_64-unknown-linux-musl, runner: bare-metal, container: alpine }
@@ -32,7 +26,6 @@ jobs:
 
     name: Build CLI for ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
-    container: ${{ matrix.container || '' }}
 
     steps:
       - name: Checkout
@@ -41,12 +34,6 @@ jobs:
       - name: Show arch
         run: uname -a
 
-      - name: Install ubuntu dependencies
-        if: matrix.container == 'debian:bookworm'
-        run: |
-          apt-get update -y
-          apt-get install -y gcc g++ bash curl perl git make
-
       - name: Install musl dependencies
         # TODO: Should we use `matrix.container == 'alpine'` instead of the `endsWith` check?
         if: endsWith(matrix.target, '-musl')
diff --git a/.github/workflows/typescript-lint.yml b/.github/workflows/typescript-lint.yml
index fee7aa442a0..8eca0cac19b 100644
--- a/.github/workflows/typescript-lint.yml
+++ b/.github/workflows/typescript-lint.yml
@@ -9,12 +9,7 @@ on:
 
 jobs:
   build:
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: --privileged
-
-
+    runs-on: spacetimedb-new-runner-2
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
diff --git a/.github/workflows/typescript-test.yml b/.github/workflows/typescript-test.yml
index fbd3816a8fd..d7614707d14 100644
--- a/.github/workflows/typescript-test.yml
+++ b/.github/workflows/typescript-test.yml
@@ -13,13 +13,7 @@ concurrency:
 
 jobs:
   build-and-test:
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: --privileged
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
-
+    runs-on: spacetimedb-new-runner-2
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
diff --git a/.github/workflows/upgrade-version-check.yml b/.github/workflows/upgrade-version-check.yml
index f6abff297e5..cb0c41620ce 100644
--- a/.github/workflows/upgrade-version-check.yml
+++ b/.github/workflows/upgrade-version-check.yml
@@ -8,10 +8,7 @@ permissions: read-all
 
 jobs:
   version_upgrade_check:
-    runs-on: spacetimedb-new-runner
-    container:
-      image: localhost:5000/spacetimedb-ci:latest
-      options: --privileged
+    runs-on: spacetimedb-new-runner-2
     steps:
       - name: Checkout
         uses: actions/checkout@v3

From 90b366aeb8615920be83e769983c18e7d8fae1f6 Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Sat, 31 Jan 2026 21:09:50 -0600
Subject: [PATCH 12/15] Use VM cache

---
 .github/workflows/ci.yml | 214 ++++++++++++++++++++++++++++-----------
 1 file changed, 155 insertions(+), 59 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 32ec9ceb340..4622f547959 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,16 +51,29 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ env.GIT_REF }}
-      - uses: dsherret/rust-toolchain-file@v1
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          cache-on-failure: false
-          cache-all-crates: true
-          cache-workspace-crates: true
-          prefix-key: v1
+
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+            # Enable sccache for Rust
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+            # Prefer cached cargo-home/bin if you bootstrap shims there
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            # Still enable sccache even without the cache disk if you want local speedups:
+            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "Cache disk not present; using default cargo locations."
+          fi
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -145,15 +158,28 @@ jobs:
         with:
           ref: ${{ env.GIT_REF }}
 
-      - uses: dsherret/rust-toolchain-file@v1
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          # Let the smoketests job save the cache since it builds the most things
-          save-if: false
-          prefix-key: v1
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+            # Enable sccache for Rust
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+            # Prefer cached cargo-home/bin if you bootstrap shims there
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            # Still enable sccache even without the cache disk if you want local speedups:
+            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "Cache disk not present; using default cargo locations."
+          fi
 
       - uses: actions/setup-dotnet@v3
         with:
@@ -187,14 +213,28 @@ jobs:
       - uses: dsherret/rust-toolchain-file@v1
       - run: echo ::add-matcher::.github/workflows/rust_matcher.json
 
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          # Let the smoketests job save the cache since it builds the most things
-          save-if: false
-          prefix-key: v1
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+            # Enable sccache for Rust
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+            # Prefer cached cargo-home/bin if you bootstrap shims there
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            # Still enable sccache even without the cache disk if you want local speedups:
+            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "Cache disk not present; using default cargo locations."
+          fi
 
       - uses: actions/setup-dotnet@v3
         with:
@@ -214,14 +254,28 @@ jobs:
       - uses: dsherret/rust-toolchain-file@v1
       - run: echo ::add-matcher::.github/workflows/rust_matcher.json
 
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          # Let the smoketests job save the cache since it builds the most things
-          save-if: false
-          prefix-key: v1
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+            # Enable sccache for Rust
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+            # Prefer cached cargo-home/bin if you bootstrap shims there
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            # Still enable sccache even without the cache disk if you want local speedups:
+            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "Cache disk not present; using default cargo locations."
+          fi
 
       - name: Run bindgen tests
         run: cargo ci wasm-bindings
@@ -465,14 +519,28 @@ jobs:
 
       - uses: dsherret/rust-toolchain-file@v1
 
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          # Let the smoketests job save the cache since it builds the most things
-          save-if: false
-          prefix-key: v1
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+            # Enable sccache for Rust     
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+            # Prefer cached cargo-home/bin if you bootstrap shims there
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            # Still enable sccache even without the cache disk if you want local speedups:
+            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "Cache disk not present; using default cargo locations."
+          fi
 
       - name: Check for docs change
         run: |
@@ -561,14 +629,28 @@ jobs:
       - name: Install Rust toolchain
         uses: dsherret/rust-toolchain-file@v1
 
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          # Let the main CI job save the cache since it builds the most things
-          save-if: false
-          prefix-key: v1
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+            # Enable sccache for Rust
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+            # Prefer cached cargo-home/bin if you bootstrap shims there
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            # Still enable sccache even without the cache disk if you want local speedups:
+            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "Cache disk not present; using default cargo locations."
+          fi
 
       - name: Install SpacetimeDB CLI from the local checkout
         run: |
@@ -683,14 +765,28 @@ jobs:
       - name: Install Rust toolchain
         uses: dsherret/rust-toolchain-file@v1
 
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          # Let the main CI job save the cache since it builds the most things
-          save-if: false
-          prefix-key: v1
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+            # Enable sccache for Rust     
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+            # Prefer cached cargo-home/bin if you bootstrap shims there
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            # Still enable sccache even without the cache disk if you want local speedups:
+            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "Cache disk not present; using default cargo locations."
+          fi
 
       - name: Install SpacetimeDB CLI from the local checkout
         run: |

From b56598c2ef5ca4867b1dfcb5f8bac2b2ac1af20d Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Sat, 31 Jan 2026 22:19:33 -0600
Subject: [PATCH 13/15] Update workflow

---
 .github/workflows/ci.yml | 394 +++++++++++++++------------------------
 1 file changed, 149 insertions(+), 245 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4622f547959..750aa2d3295 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,73 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.pr_number || format('sha-{0}', github.sha) }}
   cancel-in-progress: true
 
+# -------------------------------------------------------------------
+# Shared steps for self-hosted Linux runner cache disk + Rust toolchain
+# -------------------------------------------------------------------
+x-cache-disk-step: &cache_disk_step
+  name: Enable cache disk + sccache (if present)
+  shell: bash
+  run: |
+    set -euo pipefail
+    CACHE_MNT="/mnt/runner-cache"
+    if mountpoint -q "$CACHE_MNT"; then
+      echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
+      echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+      echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+      echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+      echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+      # Enable sccache for Rust (assumes sccache is installed on the runner image)
+      echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+
+      # Prefer cached cargo-home/bin if you bootstrap shims there
+      echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+    else
+      echo "Cache disk not present; using default cargo locations."
+    fi
+
+x-install-rust-step: &install_rust_step
+  name: Install Rust toolchain from repo + components
+  shell: bash
+  run: |
+    set -euo pipefail
+
+    # Detect toolchain from rust-toolchain(.toml)
+    tc="stable"
+    if [[ -f rust-toolchain.toml ]]; then
+      tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+    elif [[ -f rust-toolchain ]]; then
+      tc="$(awk -F'"' '
+        /^[[:space:]]*#/ {next}
+        /^[[:space:]]*$/ {next}
+        /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+        {print $0; exit}
+      ' rust-toolchain | tr -d "\r")"
+    fi
+
+    echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
+
+    rustup toolchain install "$tc" --profile minimal
+    rustup component add rustfmt --toolchain "$tc"
+    rustup component add clippy  --toolchain "$tc"
+
+    # IMPORTANT: your cargo-ci tool runs plain `cargo ...` internally.
+    # This ensures all those invocations use the pinned toolchain.
+    rustup override set "$tc"
+
+x-config-target-dir-step: &config_target_dir_step
+  name: Configure CARGO_TARGET_DIR (cache disk if present)
+  shell: bash
+  run: |
+    set -euo pipefail
+    target="${GITHUB_WORKSPACE}/target"
+    if [[ -n "${CACHE_MNT:-}" ]]; then
+      # No concurrent jobs share this cache disk, so use a stable per-toolchain target dir
+      target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN}"
+    fi
+    echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
+    echo "Using CARGO_TARGET_DIR=$target"
+
 jobs:
   docker_smoketests:
     needs: [lints]
@@ -32,8 +99,6 @@ jobs:
             smoketest_args: --no-build-cli
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 120
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - name: Find Git ref
         env:
@@ -47,33 +112,20 @@ jobs:
             GIT_REF="${{ github.ref }}"
           fi
           echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
+
       - name: Checkout sources
         uses: actions/checkout@v4
         with:
           ref: ${{ env.GIT_REF }}
 
-      - name: Enable cache disk + sccache (if present)
-        shell: bash
-        run: |
-          set -euo pipefail
-          CACHE_MNT="/mnt/runner-cache"
-          if mountpoint -q "$CACHE_MNT"; then
-            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
-            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
-            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
-            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
-            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+      - <<: *cache_disk_step
+        if: runner.os == 'Linux'
 
-            # Enable sccache for Rust
-            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+      - <<: *install_rust_step
+        if: runner.os == 'Linux'
 
-            # Prefer cached cargo-home/bin if you bootstrap shims there
-            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
-          else
-            # Still enable sccache even without the cache disk if you want local speedups:
-            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-            echo "Cache disk not present; using default cargo locations."
-          fi
+      - <<: *config_target_dir_step
+        if: runner.os == 'Linux'
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -101,14 +153,17 @@ jobs:
         if: runner.os == 'Windows'
         run: choco install psql -y --no-progress
         shell: powershell
+
       - name: Build crates
         run: cargo build -p spacetimedb-cli -p spacetimedb-standalone -p spacetimedb-update
+
       - name: Build and start database (Linux)
         if: runner.os == 'Linux'
         run: |
           # Our .dockerignore omits `target`, which our CI Dockerfile needs.
           rm .dockerignore
           docker compose -f .github/docker-compose.yml up -d
+
       - name: Build and start database (Windows)
         if: runner.os == 'Windows'
         run: |
@@ -121,14 +176,18 @@ jobs:
           # the sdk-manifests on windows-latest are messed up, so we need to update them
           dotnet workload config --update-mode manifests
           dotnet workload update
+
       - uses: actions/setup-python@v5
         with: { python-version: "3.12" }
         if: runner.os == 'Windows'
+
       - name: Install python deps
         run: python -m pip install -r smoketests/requirements.txt
+
       - name: Run smoketests
         # Note: clear_database and replication only work in private
         run: cargo ci smoketests -- ${{ matrix.smoketest_args }} -x clear_database replication teams
+
       - name: Stop containers (Linux)
         if: always() && runner.os == 'Linux'
         run: docker compose -f .github/docker-compose.yml down
@@ -138,8 +197,6 @@ jobs:
     name: Test Suite
     runs-on: spacetimedb-new-runner-2
 
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - name: Find Git ref
         env:
@@ -158,28 +215,9 @@ jobs:
         with:
           ref: ${{ env.GIT_REF }}
 
-      - name: Enable cache disk + sccache (if present)
-        shell: bash
-        run: |
-          set -euo pipefail
-          CACHE_MNT="/mnt/runner-cache"
-          if mountpoint -q "$CACHE_MNT"; then
-            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
-            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
-            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
-            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
-            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
-
-            # Enable sccache for Rust
-            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-
-            # Prefer cached cargo-home/bin if you bootstrap shims there
-            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
-          else
-            # Still enable sccache even without the cache disk if you want local speedups:
-            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-            echo "Cache disk not present; using default cargo locations."
-          fi
+      - <<: *cache_disk_step
+      - <<: *install_rust_step
+      - <<: *config_target_dir_step
 
       - uses: actions/setup-dotnet@v3
         with:
@@ -204,37 +242,15 @@ jobs:
   lints:
     name: Lints
     runs-on: spacetimedb-new-runner-2
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - name: Checkout sources
         uses: actions/checkout@v3
 
-      - uses: dsherret/rust-toolchain-file@v1
       - run: echo ::add-matcher::.github/workflows/rust_matcher.json
 
-      - name: Enable cache disk + sccache (if present)
-        shell: bash
-        run: |
-          set -euo pipefail
-          CACHE_MNT="/mnt/runner-cache"
-          if mountpoint -q "$CACHE_MNT"; then
-            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
-            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
-            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
-            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
-            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
-
-            # Enable sccache for Rust
-            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-
-            # Prefer cached cargo-home/bin if you bootstrap shims there
-            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
-          else
-            # Still enable sccache even without the cache disk if you want local speedups:
-            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-            echo "Cache disk not present; using default cargo locations."
-          fi
+      - <<: *cache_disk_step
+      - <<: *install_rust_step
+      - <<: *config_target_dir_step
 
       - uses: actions/setup-dotnet@v3
         with:
@@ -246,36 +262,14 @@ jobs:
   wasm_bindings:
     name: Build and test wasm bindings
     runs-on: spacetimedb-new-runner-2
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - uses: actions/checkout@v3
 
-      - uses: dsherret/rust-toolchain-file@v1
       - run: echo ::add-matcher::.github/workflows/rust_matcher.json
 
-      - name: Enable cache disk + sccache (if present)
-        shell: bash
-        run: |
-          set -euo pipefail
-          CACHE_MNT="/mnt/runner-cache"
-          if mountpoint -q "$CACHE_MNT"; then
-            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
-            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
-            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
-            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
-            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
-
-            # Enable sccache for Rust
-            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-
-            # Prefer cached cargo-home/bin if you bootstrap shims there
-            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
-          else
-            # Still enable sccache even without the cache disk if you want local speedups:
-            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-            echo "Cache disk not present; using default cargo locations."
-          fi
+      - <<: *cache_disk_step
+      - <<: *install_rust_step
+      - <<: *config_target_dir_step
 
       - name: Run bindgen tests
         run: cargo ci wasm-bindings
@@ -341,9 +335,6 @@ jobs:
         shell: bash
         run: |
           ROOT_DIR="$(mktemp -d)"
-          # NOTE(bfops): We need the `github-token-auth` feature because we otherwise tend to get ratelimited when we try to fetch `/releases/latest`.
-          # My best guess is that, on the GitHub runners, the "anonymous" ratelimit is shared by *all* users of that runner (I think this because it
-          # happens very frequently on the `macos-runner`, but we haven't seen it on any others).
           cargo run --features github-token-auth --target ${{ matrix.target }} -p spacetimedb-update -- self-install --root-dir="${ROOT_DIR}" --yes
           "${ROOT_DIR}"/spacetime --root-dir="${ROOT_DIR}" help
         if: runner.os == 'Windows'
@@ -356,41 +347,15 @@ jobs:
 
   unreal_engine_tests:
     name: Unreal Engine Tests
-    # This can't go on e.g. ubuntu-latest because that runner runs out of disk space. ChatGPT suggested that the general solution tends to be to use
-    # a custom runner.
     runs-on: spacetimedb-new-runner-2
-    # Disable the tests because they are very flaky at the moment.
-    # TODO: Remove this line and re-enable the `if` line just below here.
     if: false
-    # Skip if this is an external contribution. GitHub secrets will be empty, so the step would fail anyway.
-    # if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
     container:
       image: ghcr.io/epicgames/unreal-engine:dev-5.6
       credentials:
-        # Note(bfops): I don't think that `github.actor` needs to match the user that the token is for, because I'm using a token for my account and
-        # it seems to be totally happy.
-        # However, the token needs to be for a user that has access to the EpicGames org (see
-        # https://dev.epicgames.com/documentation/en-us/unreal-engine/downloading-source-code-in-unreal-engine?application_version=5.6)
         username: ${{ github.actor }}
         password: ${{ secrets.GHCR_TOKEN }}
-      # Run as root because otherwise we get permission denied for various directories inside the container. I tried doing dances to allow it to run
-      # without this (reassigning env vars and stuff), but was unable to get it to work and it felt like an uphill battle.
       options: --user 0:0
     steps:
-      # Uncomment this before merging so that it will run properly if run manually through the GH actions flow. It was playing weird with rolled back
-      # commits though.
-      #      - name: Find Git ref
-      #        env:
-      #          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      #        shell: bash
-      #        run: |
-      #          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
-      #          if test -n "${PR_NUMBER}"; then
-      #            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
-      #          else
-      #            GIT_REF="${{ github.ref }}"
-      #          fi
-      #          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
       - name: Checkout sources
         uses: actions/checkout@v4
         with:
@@ -406,23 +371,19 @@ jobs:
           apt-get install -y acl curl ca-certificates
 
           REPO="$GITHUB_WORKSPACE"
-          # Let ue4 read/write the workspace & tool caches without changing ownership
           for p in "$REPO" "${RUNNER_TEMP:-/__t}" "${RUNNER_TOOL_CACHE:-/__t}"; do
             [ -d "$p" ] && setfacl -R -m u:ue4:rwX -m d:u:ue4:rwX "$p" || true
           done
 
-          # Rust tool caches live under the runner tool cache so they persist
           export CARGO_HOME="${RUNNER_TOOL_CACHE:-/__t}/cargo"
           export RUSTUP_HOME="${RUNNER_TOOL_CACHE:-/__t}/rustup"
           mkdir -p "$CARGO_HOME" "$RUSTUP_HOME"
           chown -R ue4:ue4 "$CARGO_HOME" "$RUSTUP_HOME"
 
-          # Make sure the UE build script is executable (and parents traversable)
           UE_DIR="${UE_ROOT_PATH:-/home/ue4/UnrealEngine}"
           chmod a+rx "$UE_DIR" "$UE_DIR/Engine" "$UE_DIR/Engine/Build" "$UE_DIR/Engine/Build/BatchFiles/Linux" || true
           chmod a+rx "$UE_DIR/Engine/Build/BatchFiles/Linux/Build.sh" || true
 
-          # Run the build & tests as ue4 (who owns the UE tree)
           sudo -E -H -u ue4 env \
             HOME=/home/ue4 \
             XDG_CONFIG_HOME=/home/ue4/.config \
@@ -431,7 +392,6 @@ jobs:
             PATH="$CARGO_HOME/bin:$PATH" \
             bash -lc '
               set -euxo pipefail
-              # Install rustup for ue4 if needed (uses the shared caches)
               if ! command -v cargo >/dev/null 2>&1; then
                 curl -sSf https://sh.rustup.rs | sh -s -- -y
               fi
@@ -474,8 +434,6 @@ jobs:
     name: Check CLI docs
     permissions: read-all
     runs-on: spacetimedb-new-runner-2
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - name: Find Git ref
         env:
@@ -519,32 +477,12 @@ jobs:
 
       - uses: dsherret/rust-toolchain-file@v1
 
-      - name: Enable cache disk + sccache (if present)
-        shell: bash
-        run: |
-          set -euo pipefail
-          CACHE_MNT="/mnt/runner-cache"
-          if mountpoint -q "$CACHE_MNT"; then
-            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
-            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
-            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
-            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
-            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
-
-            # Enable sccache for Rust     
-            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-
-            # Prefer cached cargo-home/bin if you bootstrap shims there
-            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
-          else
-            # Still enable sccache even without the cache disk if you want local speedups:
-            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-            echo "Cache disk not present; using default cargo locations."
-          fi
+      - <<: *cache_disk_step
+      - <<: *install_rust_step
+      - <<: *config_target_dir_step
 
       - name: Check for docs change
-        run: |
-          cargo ci cli-docs
+        run: cargo ci cli-docs
 
   llm_ci_check:
     name: Verify LLM benchmark is up to date
@@ -552,8 +490,6 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      # Build the tool from master to ensure consistent hash computation
-      # with the llm-benchmark-update workflow (which also uses master's tool).
       - name: Checkout master (build tool from trusted code)
         uses: actions/checkout@v4
         with:
@@ -568,7 +504,6 @@ jobs:
           cargo install --path tools/xtask-llm-benchmark --locked
           command -v llm_benchmark
 
-      # Now checkout the PR branch to verify its benchmark files
       - name: Checkout PR branch
         uses: actions/checkout@v4
         with:
@@ -579,23 +514,17 @@ jobs:
 
   unity-testsuite:
     needs: [lints]
-    # Skip if this is an external contribution.
-    # The license secrets will be empty, so the step would fail anyway.
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
     permissions:
       contents: read
       checks: write
     runs-on: spacetimedb-unity-runner
     timeout-minutes: 30
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - name: Checkout repository
         id: checkout-stdb
         uses: actions/checkout@v4
 
-      # Run cheap .NET tests first. If those fail, no need to run expensive Unity tests.
-
       - name: Setup dotnet
         uses: actions/setup-dotnet@v3
         with:
@@ -605,13 +534,6 @@ jobs:
         run: |
           dotnet pack crates/bindings-csharp/BSATN.Runtime
           dotnet pack crates/bindings-csharp/Runtime
-
-          # Write out the nuget config file to `nuget.config`. This causes the spacetimedb-csharp-sdk repository
-          # to be aware of the local versions of the `bindings-csharp` packages in SpacetimeDB, and use them if
-          # available. Otherwise, `spacetimedb-csharp-sdk` will use the NuGet versions of the packages.
-          # This means that (if version numbers match) we will test the local versions of the C# packages, even
-          # if they're not pushed to NuGet.
-          # See https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file for more info on the config file.
           cd sdks/csharp
           ./tools~/write-nuget-config.sh ../..
 
@@ -619,7 +541,6 @@ jobs:
         working-directory: sdks/csharp
         run: dotnet restore --configfile NuGet.Config SpacetimeDB.ClientSDK.sln
 
-      # Now, setup the Unity tests.
       - name: Patch spacetimedb dependency in Cargo.toml
         working-directory: demo/Blackholio/server-rust
         run: |
@@ -629,6 +550,7 @@ jobs:
       - name: Install Rust toolchain
         uses: dsherret/rust-toolchain-file@v1
 
+      # Keep your existing runner-local cache disk behavior here as-is, since this is a special runner.
       - name: Enable cache disk + sccache (if present)
         shell: bash
         run: |
@@ -638,25 +560,50 @@ jobs:
             echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
             echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
             echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
-            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
             echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
-
-            # Enable sccache for Rust
             echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-
-            # Prefer cached cargo-home/bin if you bootstrap shims there
             echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
           else
-            # Still enable sccache even without the cache disk if you want local speedups:
-            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
             echo "Cache disk not present; using default cargo locations."
           fi
 
+      - name: Install Rust toolchain from repo + components
+        shell: bash
+        run: |
+          set -euo pipefail
+          tc="stable"
+          if [[ -f rust-toolchain.toml ]]; then
+            tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+          elif [[ -f rust-toolchain ]]; then
+            tc="$(awk -F'"' '
+              /^[[:space:]]*#/ {next}
+              /^[[:space:]]*$/ {next}
+              /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+              {print $0; exit}
+            ' rust-toolchain | tr -d "\r")"
+          fi
+          echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
+          rustup toolchain install "$tc" --profile minimal
+          rustup component add rustfmt --toolchain "$tc"
+          rustup component add clippy  --toolchain "$tc"
+          rustup override set "$tc"
+
+      - name: Configure CARGO_TARGET_DIR (cache disk if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          target="${GITHUB_WORKSPACE}/target"
+          if [[ -n "${CACHE_MNT:-}" ]]; then
+            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN}"
+          fi
+          echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
+          echo "Using CARGO_TARGET_DIR=$target"
+
       - name: Install SpacetimeDB CLI from the local checkout
         run: |
           cargo install --force --path crates/cli --locked --message-format=short
           cargo install --force --path crates/standalone --locked --message-format=short
-          # Add a handy alias using the old binary name, so that we don't have to rewrite all scripts (incl. in submodules).
           ln -sf $CARGO_HOME/bin/spacetimedb-cli $CARGO_HOME/bin/spacetime
 
       - name: Generate client bindings
@@ -707,8 +654,8 @@ jobs:
       - name: Run Unity tests
         uses: game-ci/unity-test-runner@v4
         with:
-          unityVersion: 2022.3.32f1 # Adjust Unity version to a valid tag
-          projectPath: demo/Blackholio/client-unity # Path to the Unity project subdirectory
+          unityVersion: 2022.3.32f1
+          projectPath: demo/Blackholio/client-unity
           githubToken: ${{ secrets.GITHUB_TOKEN }}
           testMode: playmode
           useHostNetwork: true
@@ -722,15 +669,11 @@ jobs:
     needs: [lints]
     runs-on: spacetimedb-new-runner-2
     timeout-minutes: 30
-    env:
-      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - name: Checkout repository
         id: checkout-stdb
         uses: actions/checkout@v4
 
-      # Run cheap .NET tests first. If those fail, no need to run expensive Unity tests.
-
       - name: Setup dotnet
         uses: actions/setup-dotnet@v3
         with:
@@ -740,13 +683,6 @@ jobs:
         run: |
           dotnet pack crates/bindings-csharp/BSATN.Runtime
           dotnet pack crates/bindings-csharp/Runtime
-
-          # Write out the nuget config file to `nuget.config`. This causes the spacetimedb-csharp-sdk repository
-          # to be aware of the local versions of the `bindings-csharp` packages in SpacetimeDB, and use them if
-          # available. Otherwise, `spacetimedb-csharp-sdk` will use the NuGet versions of the packages.
-          # This means that (if version numbers match) we will test the local versions of the C# packages, even
-          # if they're not pushed to NuGet.
-          # See https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file for more info on the config file.
           cd sdks/csharp
           ./tools~/write-nuget-config.sh ../..
 
@@ -762,44 +698,16 @@ jobs:
         working-directory: sdks/csharp
         run: dotnet format --no-restore --verify-no-changes SpacetimeDB.ClientSDK.sln
 
-      - name: Install Rust toolchain
-        uses: dsherret/rust-toolchain-file@v1
-
-      - name: Enable cache disk + sccache (if present)
-        shell: bash
-        run: |
-          set -euo pipefail
-          CACHE_MNT="/mnt/runner-cache"
-          if mountpoint -q "$CACHE_MNT"; then
-            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
-            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
-            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
-            echo "CARGO_TARGET_DIR=$CACHE_MNT/cargo-target/SpacetimeDB" >> "$GITHUB_ENV"
-            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
-
-            # Enable sccache for Rust     
-            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-
-            # Prefer cached cargo-home/bin if you bootstrap shims there
-            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
-          else
-            # Still enable sccache even without the cache disk if you want local speedups:
-            # echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-            echo "Cache disk not present; using default cargo locations."
-          fi
+      - <<: *cache_disk_step
+      - <<: *install_rust_step
+      - <<: *config_target_dir_step
 
       - name: Install SpacetimeDB CLI from the local checkout
         run: |
           cargo install --force --path crates/cli --locked --message-format=short
           cargo install --force --path crates/standalone --locked --message-format=short
-          # Add a handy alias using the old binary name, so that we don't have to rewrite all scripts (incl. in submodules).
           ln -sf $CARGO_HOME/bin/spacetimedb-cli $CARGO_HOME/bin/spacetime
 
-      # This step shouldn't be needed, but somehow we end up with caches that are missing librusty_v8.a.
-      # ChatGPT suspects that this could be due to different build invocations using the same target dir,
-      # and this makes sense to me because we only see it in this job where we mix `cargo build -p` with
-      # `cargo build --manifest-path` (which apparently build different dependency trees).
-      # However, we've been unable to fix it so... /shrug
       - name: Check v8 outputs
         run: |
           find "${CARGO_TARGET_DIR}"/ -type f | grep '[/_]v8' || true
@@ -843,8 +751,6 @@ jobs:
   internal-tests:
     name: Internal Tests
     needs: [lints]
-    # Skip if not a PR or a push to master
-    # Skip if this is an external contribution. GitHub secrets will be empty, so the step would fail anyway.
     if: ${{ (github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master'))
       && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) }}
     permissions:
@@ -864,11 +770,9 @@ jobs:
             const targetRef = 'master';
             const targetOwner = process.env.TARGET_OWNER;
             const targetRepo = process.env.TARGET_REPO;
-            // Use the ref for pull requests because the head sha is brittle (github does some extra dance where it merges in master).
             const publicRef = (context.eventName === 'pull_request') ? context.payload.pull_request.head.ref : context.sha;
             const preDispatch = new Date().toISOString();
-  
-            // Dispatch the workflow in the target repository
+
             await github.rest.actions.createWorkflowDispatch({
               owner: targetOwner,
               repo: targetRepo,
@@ -876,12 +780,11 @@ jobs:
               ref: targetRef,
               inputs: { public_ref: publicRef }
             });
-  
+
             const sleep = (ms) => new Promise(r => setTimeout(r, ms));
-  
-            // Find the dispatched run by name
+
             let runId = null;
-            for (let attempt = 0; attempt < 20 && !runId; attempt++) { // up to ~10 minutes to locate the run
+            for (let attempt = 0; attempt < 20 && !runId; attempt++) {
               await sleep(5000);
               const runsResp = await github.rest.actions.listWorkflowRuns({
                 owner: targetOwner,
@@ -891,28 +794,28 @@ jobs:
                 branch: targetRef,
                 per_page: 50,
               });
-  
+
               const expectedName = `CI [public_ref=${publicRef}]`;
               const candidates = runsResp.data.workflow_runs
                 .filter(r => r.name === expectedName && new Date(r.created_at) >= new Date(preDispatch))
                 .sort((a, b) => new Date(b.created_at) - new Date(a.created_at));
-  
+
               if (candidates.length > 0) {
                 runId = candidates[0].id;
                 break;
               }
             }
-  
+
             if (!runId) {
               core.setFailed('Failed to locate dispatched run in the private repository.');
               return;
             }
-  
+
             const runUrl = `https://github.com/${targetOwner}/${targetRepo}/actions/runs/${runId}`;
             core.info(`View run: ${runUrl}`);
             core.setOutput('run_id', String(runId));
             core.setOutput('run_url', runUrl);
-  
+
       - name: Wait for Internal Tests to complete
         uses: actions/github-script@v7
         with:
@@ -923,11 +826,11 @@ jobs:
             const runId = Number(`${{ steps.dispatch.outputs.run_id }}`);
             const runUrl = `${{ steps.dispatch.outputs.run_url }}`;
             const sleep = (ms) => new Promise(r => setTimeout(r, ms));
-  
+
             core.info(`Waiting for workflow result... ${runUrl}`);
-  
+
             let conclusion = null;
-            for (let attempt = 0; attempt < 240; attempt++) { // up to ~2 hours
+            for (let attempt = 0; attempt < 240; attempt++) {
               const runResp = await github.rest.actions.getWorkflowRun({
                 owner: targetOwner,
                 repo: targetRepo,
@@ -940,16 +843,16 @@ jobs:
               }
               await sleep(30000);
             }
-  
+
             if (!conclusion) {
               core.setFailed('Timed out waiting for private workflow to complete.');
               return;
             }
-  
+
             if (conclusion !== 'success') {
               core.setFailed(`Private workflow failed with conclusion: ${conclusion}`);
             }
-  
+
       - name: Cancel invoked run if workflow cancelled
         if: ${{ cancelled() }}
         uses: actions/github-script@v7
@@ -965,3 +868,4 @@ jobs:
               repo: targetRepo,
               run_id: runId,
             });
+

From efaa6e2586d252a16318172b4eaefde3273f208a Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Sun, 1 Feb 2026 00:47:16 -0600
Subject: [PATCH 14/15] Test CI


From 369834372f7bd7cd53a63848d84769cf667936b3 Mon Sep 17 00:00:00 2001
From: John Detter <4099508+jdetter@users.noreply.github.com>
Date: Sun, 1 Feb 2026 01:00:00 -0600
Subject: [PATCH 15/15] This is a long shot

---
 .github/workflows/ci.yml | 417 ++++++++++++++++++++++++++++-----------
 1 file changed, 306 insertions(+), 111 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 750aa2d3295..012d1c3b85c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,73 +17,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.pr_number || format('sha-{0}', github.sha) }}
   cancel-in-progress: true
 
-# -------------------------------------------------------------------
-# Shared steps for self-hosted Linux runner cache disk + Rust toolchain
-# -------------------------------------------------------------------
-x-cache-disk-step: &cache_disk_step
-  name: Enable cache disk + sccache (if present)
-  shell: bash
-  run: |
-    set -euo pipefail
-    CACHE_MNT="/mnt/runner-cache"
-    if mountpoint -q "$CACHE_MNT"; then
-      echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
-      echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
-      echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
-      echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
-      echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
-
-      # Enable sccache for Rust (assumes sccache is installed on the runner image)
-      echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
-
-      # Prefer cached cargo-home/bin if you bootstrap shims there
-      echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
-    else
-      echo "Cache disk not present; using default cargo locations."
-    fi
-
-x-install-rust-step: &install_rust_step
-  name: Install Rust toolchain from repo + components
-  shell: bash
-  run: |
-    set -euo pipefail
-
-    # Detect toolchain from rust-toolchain(.toml)
-    tc="stable"
-    if [[ -f rust-toolchain.toml ]]; then
-      tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
-    elif [[ -f rust-toolchain ]]; then
-      tc="$(awk -F'"' '
-        /^[[:space:]]*#/ {next}
-        /^[[:space:]]*$/ {next}
-        /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
-        {print $0; exit}
-      ' rust-toolchain | tr -d "\r")"
-    fi
-
-    echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
-
-    rustup toolchain install "$tc" --profile minimal
-    rustup component add rustfmt --toolchain "$tc"
-    rustup component add clippy  --toolchain "$tc"
-
-    # IMPORTANT: your cargo-ci tool runs plain `cargo ...` internally.
-    # This ensures all those invocations use the pinned toolchain.
-    rustup override set "$tc"
-
-x-config-target-dir-step: &config_target_dir_step
-  name: Configure CARGO_TARGET_DIR (cache disk if present)
-  shell: bash
-  run: |
-    set -euo pipefail
-    target="${GITHUB_WORKSPACE}/target"
-    if [[ -n "${CACHE_MNT:-}" ]]; then
-      # No concurrent jobs share this cache disk, so use a stable per-toolchain target dir
-      target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN}"
-    fi
-    echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
-    echo "Using CARGO_TARGET_DIR=$target"
-
 jobs:
   docker_smoketests:
     needs: [lints]
@@ -118,14 +51,61 @@ jobs:
         with:
           ref: ${{ env.GIT_REF }}
 
-      - <<: *cache_disk_step
+      - name: Enable cache disk + sccache (if present)
         if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            echo "Cache disk not present; using default cargo locations."
+          fi
 
-      - <<: *install_rust_step
+      - name: Install Rust toolchain from repo + components
         if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
 
-      - <<: *config_target_dir_step
+          tc="stable"
+          if [[ -f rust-toolchain.toml ]]; then
+            tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+          elif [[ -f rust-toolchain ]]; then
+            tc="$(awk -F'"' '
+              /^[[:space:]]*#/ {next}
+              /^[[:space:]]*$/ {next}
+              /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+              {print $0; exit}
+            ' rust-toolchain | tr -d "\r")"
+          fi
+          echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
+
+          rustup toolchain install "$tc" --profile minimal
+          rustup component add rustfmt --toolchain "$tc"
+          rustup component add clippy  --toolchain "$tc"
+
+          # Ensure all nested "cargo" calls inside tools/ci use the pinned toolchain
+          rustup override set "$tc"
+
+      - name: Configure CARGO_TARGET_DIR (cache disk if present)
         if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          target="${GITHUB_WORKSPACE}/target"
+          if [[ -n "${CACHE_MNT:-}" ]]; then
+            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN:-unknown}"
+          fi
+          echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
+          echo "Using CARGO_TARGET_DIR=$target"
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -139,7 +119,6 @@ jobs:
           cd sdks/csharp
           ./tools~/write-nuget-config.sh ../..
 
-      # nodejs and pnpm are required for the typescript quickstart smoketest
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
@@ -160,20 +139,17 @@ jobs:
       - name: Build and start database (Linux)
         if: runner.os == 'Linux'
         run: |
-          # Our .dockerignore omits `target`, which our CI Dockerfile needs.
           rm .dockerignore
           docker compose -f .github/docker-compose.yml up -d
 
       - name: Build and start database (Windows)
         if: runner.os == 'Windows'
         run: |
-          # Fail properly if any individual command fails
           $ErrorActionPreference = 'Stop'
           $PSNativeCommandUseErrorActionPreference = $true
 
           Start-Process target/debug/spacetimedb-cli.exe -ArgumentList 'start --pg-port 5432'
           cd modules
-          # the sdk-manifests on windows-latest are messed up, so we need to update them
           dotnet workload config --update-mode manifests
           dotnet workload update
 
@@ -185,7 +161,6 @@ jobs:
         run: python -m pip install -r smoketests/requirements.txt
 
       - name: Run smoketests
-        # Note: clear_database and replication only work in private
         run: cargo ci smoketests -- ${{ matrix.smoketest_args }} -x clear_database replication teams
 
       - name: Stop containers (Linux)
@@ -196,11 +171,11 @@ jobs:
     needs: [lints]
     name: Test Suite
     runs-on: spacetimedb-new-runner-2
-
     steps:
       - name: Find Git ref
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
         run: |
           PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
           if test -n "${PR_NUMBER}"; then
@@ -215,9 +190,54 @@ jobs:
         with:
           ref: ${{ env.GIT_REF }}
 
-      - <<: *cache_disk_step
-      - <<: *install_rust_step
-      - <<: *config_target_dir_step
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            echo "Cache disk not present; using default cargo locations."
+          fi
+
+      - name: Install Rust toolchain from repo + components
+        shell: bash
+        run: |
+          set -euo pipefail
+          tc="stable"
+          if [[ -f rust-toolchain.toml ]]; then
+            tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+          elif [[ -f rust-toolchain ]]; then
+            tc="$(awk -F'"' '
+              /^[[:space:]]*#/ {next}
+              /^[[:space:]]*$/ {next}
+              /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+              {print $0; exit}
+            ' rust-toolchain | tr -d "\r")"
+          fi
+          echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
+          rustup toolchain install "$tc" --profile minimal
+          rustup component add rustfmt --toolchain "$tc"
+          rustup component add clippy  --toolchain "$tc"
+          rustup override set "$tc"
+
+      - name: Configure CARGO_TARGET_DIR (cache disk if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          target="${GITHUB_WORKSPACE}/target"
+          if [[ -n "${CACHE_MNT:-}" ]]; then
+            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN:-unknown}"
+          fi
+          echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
+          echo "Using CARGO_TARGET_DIR=$target"
 
       - uses: actions/setup-dotnet@v3
         with:
@@ -248,9 +268,54 @@ jobs:
 
       - run: echo ::add-matcher::.github/workflows/rust_matcher.json
 
-      - <<: *cache_disk_step
-      - <<: *install_rust_step
-      - <<: *config_target_dir_step
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            echo "Cache disk not present; using default cargo locations."
+          fi
+
+      - name: Install Rust toolchain from repo + components
+        shell: bash
+        run: |
+          set -euo pipefail
+          tc="stable"
+          if [[ -f rust-toolchain.toml ]]; then
+            tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+          elif [[ -f rust-toolchain ]]; then
+            tc="$(awk -F'"' '
+              /^[[:space:]]*#/ {next}
+              /^[[:space:]]*$/ {next}
+              /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+              {print $0; exit}
+            ' rust-toolchain | tr -d "\r")"
+          fi
+          echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
+          rustup toolchain install "$tc" --profile minimal
+          rustup component add rustfmt --toolchain "$tc"
+          rustup component add clippy  --toolchain "$tc"
+          rustup override set "$tc"
+
+      - name: Configure CARGO_TARGET_DIR (cache disk if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          target="${GITHUB_WORKSPACE}/target"
+          if [[ -n "${CACHE_MNT:-}" ]]; then
+            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN:-unknown}"
+          fi
+          echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
+          echo "Using CARGO_TARGET_DIR=$target"
 
       - uses: actions/setup-dotnet@v3
         with:
@@ -267,9 +332,54 @@ jobs:
 
       - run: echo ::add-matcher::.github/workflows/rust_matcher.json
 
-      - <<: *cache_disk_step
-      - <<: *install_rust_step
-      - <<: *config_target_dir_step
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            echo "Cache disk not present; using default cargo locations."
+          fi
+
+      - name: Install Rust toolchain from repo + components
+        shell: bash
+        run: |
+          set -euo pipefail
+          tc="stable"
+          if [[ -f rust-toolchain.toml ]]; then
+            tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+          elif [[ -f rust-toolchain ]]; then
+            tc="$(awk -F'"' '
+              /^[[:space:]]*#/ {next}
+              /^[[:space:]]*$/ {next}
+              /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+              {print $0; exit}
+            ' rust-toolchain | tr -d "\r")"
+          fi
+          echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
+          rustup toolchain install "$tc" --profile minimal
+          rustup component add rustfmt --toolchain "$tc"
+          rustup component add clippy  --toolchain "$tc"
+          rustup override set "$tc"
+
+      - name: Configure CARGO_TARGET_DIR (cache disk if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          target="${GITHUB_WORKSPACE}/target"
+          if [[ -n "${CACHE_MNT:-}" ]]; then
+            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN:-unknown}"
+          fi
+          echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
+          echo "Using CARGO_TARGET_DIR=$target"
 
       - name: Run bindgen tests
         run: cargo ci wasm-bindings
@@ -366,7 +476,6 @@ jobs:
         env:
           UE_ROOT_PATH: /home/ue4/UnrealEngine
         run: |
-
           apt-get update
           apt-get install -y acl curl ca-certificates
 
@@ -475,11 +584,54 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-pnpm-store-
 
-      - uses: dsherret/rust-toolchain-file@v1
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            echo "Cache disk not present; using default cargo locations."
+          fi
+
+      - name: Install Rust toolchain from repo + components
+        shell: bash
+        run: |
+          set -euo pipefail
+          tc="stable"
+          if [[ -f rust-toolchain.toml ]]; then
+            tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+          elif [[ -f rust-toolchain ]]; then
+            tc="$(awk -F'"' '
+              /^[[:space:]]*#/ {next}
+              /^[[:space:]]*$/ {next}
+              /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+              {print $0; exit}
+            ' rust-toolchain | tr -d "\r")"
+          fi
+          echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
+          rustup toolchain install "$tc" --profile minimal
+          rustup component add rustfmt --toolchain "$tc"
+          rustup component add clippy  --toolchain "$tc"
+          rustup override set "$tc"
 
-      - <<: *cache_disk_step
-      - <<: *install_rust_step
-      - <<: *config_target_dir_step
+      - name: Configure CARGO_TARGET_DIR (cache disk if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          target="${GITHUB_WORKSPACE}/target"
+          if [[ -n "${CACHE_MNT:-}" ]]; then
+            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN:-unknown}"
+          fi
+          echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
+          echo "Using CARGO_TARGET_DIR=$target"
 
       - name: Check for docs change
         run: cargo ci cli-docs
@@ -550,38 +702,40 @@ jobs:
       - name: Install Rust toolchain
         uses: dsherret/rust-toolchain-file@v1
 
-      # Keep your existing runner-local cache disk behavior here as-is, since this is a special runner.
       - name: Enable cache disk + sccache (if present)
         shell: bash
         run: |
           set -euo pipefail
           CACHE_MNT="/mnt/runner-cache"
           if mountpoint -q "$CACHE_MNT"; then
+            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
             echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
             echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
             echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
             echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
             echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
             echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
-            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
           else
             echo "Cache disk not present; using default cargo locations."
           fi
 
-      - name: Install Rust toolchain from repo + components
+      - name: Install Rust components + override + target dir
         shell: bash
         run: |
           set -euo pipefail
-          tc="stable"
-          if [[ -f rust-toolchain.toml ]]; then
-            tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
-          elif [[ -f rust-toolchain ]]; then
-            tc="$(awk -F'"' '
-              /^[[:space:]]*#/ {next}
-              /^[[:space:]]*$/ {next}
-              /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
-              {print $0; exit}
-            ' rust-toolchain | tr -d "\r")"
+          tc="${RUST_TOOLCHAIN:-}"
+          if [[ -z "$tc" ]]; then
+            tc="stable"
+            if [[ -f rust-toolchain.toml ]]; then
+              tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+            elif [[ -f rust-toolchain ]]; then
+              tc="$(awk -F'"' '
+                /^[[:space:]]*#/ {next}
+                /^[[:space:]]*$/ {next}
+                /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+                {print $0; exit}
+              ' rust-toolchain | tr -d "\r")"
+            fi
           fi
           echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
           rustup toolchain install "$tc" --profile minimal
@@ -589,13 +743,9 @@ jobs:
           rustup component add clippy  --toolchain "$tc"
           rustup override set "$tc"
 
-      - name: Configure CARGO_TARGET_DIR (cache disk if present)
-        shell: bash
-        run: |
-          set -euo pipefail
           target="${GITHUB_WORKSPACE}/target"
           if [[ -n "${CACHE_MNT:-}" ]]; then
-            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN}"
+            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${tc}"
           fi
           echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
           echo "Using CARGO_TARGET_DIR=$target"
@@ -698,9 +848,54 @@ jobs:
         working-directory: sdks/csharp
         run: dotnet format --no-restore --verify-no-changes SpacetimeDB.ClientSDK.sln
 
-      - <<: *cache_disk_step
-      - <<: *install_rust_step
-      - <<: *config_target_dir_step
+      - name: Enable cache disk + sccache (if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          CACHE_MNT="/mnt/runner-cache"
+          if mountpoint -q "$CACHE_MNT"; then
+            echo "CACHE_MNT=$CACHE_MNT" >> "$GITHUB_ENV"
+            echo "CARGO_HOME=$CACHE_MNT/cargo-home" >> "$GITHUB_ENV"
+            echo "RUSTUP_HOME=$CACHE_MNT/rustup" >> "$GITHUB_ENV"
+            echo "SCCACHE_DIR=$CACHE_MNT/sccache" >> "$GITHUB_ENV"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "$CACHE_MNT/cargo-home/bin" >> "$GITHUB_PATH"
+          else
+            echo "Cache disk not present; using default cargo locations."
+          fi
+
+      - name: Install Rust toolchain from repo + components
+        shell: bash
+        run: |
+          set -euo pipefail
+          tc="stable"
+          if [[ -f rust-toolchain.toml ]]; then
+            tc="$(awk -F'"' '/^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}' rust-toolchain.toml)"
+          elif [[ -f rust-toolchain ]]; then
+            tc="$(awk -F'"' '
+              /^[[:space:]]*#/ {next}
+              /^[[:space:]]*$/ {next}
+              /^[[:space:]]*channel[[:space:]]*=/ {print $2; exit}
+              {print $0; exit}
+            ' rust-toolchain | tr -d "\r")"
+          fi
+          echo "RUST_TOOLCHAIN=$tc" >> "$GITHUB_ENV"
+          rustup toolchain install "$tc" --profile minimal
+          rustup component add rustfmt --toolchain "$tc"
+          rustup component add clippy  --toolchain "$tc"
+          rustup override set "$tc"
+
+      - name: Configure CARGO_TARGET_DIR (cache disk if present)
+        shell: bash
+        run: |
+          set -euo pipefail
+          target="${GITHUB_WORKSPACE}/target"
+          if [[ -n "${CACHE_MNT:-}" ]]; then
+            target="${CACHE_MNT}/cargo-target/SpacetimeDB/${RUST_TOOLCHAIN:-unknown}"
+          fi
+          echo "CARGO_TARGET_DIR=$target" >> "$GITHUB_ENV"
+          echo "Using CARGO_TARGET_DIR=$target"
 
       - name: Install SpacetimeDB CLI from the local checkout
         run: |