ci: run the Android Rust build once and cache Cargo

The rust job rebuilt the Android libraries that the android job already builds through Gradle. Drop it, cache Cargo for the rust, rust-ios and android jobs, widen the rust path filter to the fixtures the Rust tests read, default workflow tokens to contents: read, and delete the inert auto-tag workflow.

.github/workflows/auto-tag.yml

@@ -1,93 +0,0 @@
-name: Auto Tag on Version Change
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'pubspec.yaml'
-
-jobs:
-  check-version:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 2  # Need previous commit to compare
-
-      - name: Get current version
-        id: current
-        run: |
-          VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //' | cut -d'+' -f1)
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
-            echo "Invalid current version" >&2
-            exit 1
-          fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Current version: $VERSION"
-
-      - name: Get previous version
-        id: previous
-        run: |
-          git checkout HEAD~1 -- pubspec.yaml 2>/dev/null || echo "version: 0.0.0" > pubspec.yaml.old
-          if [ -f pubspec.yaml.old ]; then
-            VERSION=$(grep '^version:' pubspec.yaml.old | sed 's/version: //' | cut -d'+' -f1)
-          else
-            VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //' | cut -d'+' -f1)
-          fi
-          git checkout HEAD -- pubspec.yaml
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
-            echo "Invalid previous version" >&2
-            exit 1
-          fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Previous version: $VERSION"
-
-      - name: Check if version changed
-        id: check
-        env:
-          CURRENT: ${{ steps.current.outputs.version }}
-          PREVIOUS: ${{ steps.previous.outputs.version }}
-        run: |
-          if [[ ! "$CURRENT" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
-            echo "Invalid current version" >&2
-            exit 1
-          fi
-          if [ "$CURRENT" != "$PREVIOUS" ]; then
-            echo "Version changed from $PREVIOUS to $CURRENT"
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "Version unchanged: $CURRENT"
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Check if tag exists
-        id: tag_exists
-        if: steps.check.outputs.changed == 'true'
-        env:
-          CURRENT_VERSION: ${{ steps.current.outputs.version }}
-        run: |
-          TAG="v${CURRENT_VERSION}"
-          if git ls-remote --tags origin | grep -q "refs/tags/$TAG"; then
-            echo "Tag $TAG already exists"
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "Tag $TAG does not exist"
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Create and push tag
-        if: steps.check.outputs.changed == 'true' && steps.tag_exists.outputs.exists == 'false'
-        env:
-          CURRENT_VERSION: ${{ steps.current.outputs.version }}
-        run: |
-          TAG="v${CURRENT_VERSION}"
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "$TAG" -m "Release $TAG"
-          git push origin "$TAG"
-          echo "Created and pushed tag: $TAG"

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -15,6 +18,7 @@ jobs:
     name: Detect changed paths
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     outputs:
       dart: ${{ steps.filter.outputs.dart }}
@@ -46,6 +50,8 @@ jobs:
               - '.github/workflows/ci.yml'
             rust:
               - 'rust_backend/**'
+              - 'test/fixtures/**'
+              - 'android/app/src/test/resources/lyrics_usability_cases.tsv'
               - 'scripts/*rust*.sh'
               - 'android/gradlew'
               - 'android/gradle/wrapper/**'
@@ -144,30 +150,30 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Java for Android SDK tools
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
-        with:
-          distribution: "temurin"
-          java-version: "25"
-
       - name: Activate pinned Rust toolchain
         working-directory: rust_backend
         run: rustup show
 
+      - name: Cache Cargo registry and build output
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            rust_backend/target
+          key: cargo-${{ runner.os }}-rust-${{ hashFiles('rust_backend/rust-toolchain.toml') }}-${{ hashFiles('rust_backend/Cargo.lock') }}
+          restore-keys: cargo-${{ runner.os }}-rust-${{ hashFiles('rust_backend/rust-toolchain.toml') }}-
+
       - name: Install C binding generator dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y libclang-dev
 
+      # The Android libraries are built once, by Gradle in the android job.
       - name: Rust formatting, Clippy and unit tests
         run: bash scripts/check_rust_backend.sh
 
-      - name: Install Android NDK
-        run: '"$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "ndk;30.0.16248370"'
-
-      - name: Build Android ARM32 and ARM64 libraries
-        run: ANDROID_NDK_HOME="$ANDROID_HOME/ndk/30.0.16248370" bash scripts/build_rust_backend.sh android
-
   rust-ios:
     name: Rust iOS libraries & release application
     runs-on: macos-latest
@@ -184,6 +190,17 @@ jobs:
         working-directory: rust_backend
         run: rustup show
 
+      - name: Cache Cargo registry and build output
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            rust_backend/target
+          key: cargo-${{ runner.os }}-rust-ios-${{ hashFiles('rust_backend/rust-toolchain.toml') }}-${{ hashFiles('rust_backend/Cargo.lock') }}
+          restore-keys: cargo-${{ runner.os }}-rust-ios-${{ hashFiles('rust_backend/rust-toolchain.toml') }}-
+
       - name: Build iOS device and universal simulator XCFramework
         run: bash scripts/build_rust_backend.sh ios
 
@@ -289,6 +306,17 @@ jobs:
           ffmpeg -version
           echo "SPOTIFLAC_TEST_FFMPEG=$(command -v ffmpeg)" >> "$GITHUB_ENV"
 
+      - name: Cache Cargo registry and build output
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            rust_backend/target
+          key: cargo-${{ runner.os }}-android-${{ hashFiles('rust_backend/rust-toolchain.toml') }}-${{ hashFiles('rust_backend/Cargo.lock') }}
+          restore-keys: cargo-${{ runner.os }}-android-${{ hashFiles('rust_backend/rust-toolchain.toml') }}-
+
       - name: Package Rust application and run native unit tests
         run: gradle -p android :app:assembleDebug :app:testDebugUnitTest
 

.github/workflows/release.yml

@@ -11,6 +11,9 @@ on:
         required: true
         default: "v1.0.0"
 
+permissions:
+  contents: read
+
 jobs:
   # Get version first (quick job)
   get-version: