From 413b177f812fb5b8e01ce114720baccb8e261b51 Mon Sep 17 00:00:00 2001
From: Lucas Nogueira <lucas@tauri.app>
Date: Tue, 22 Sep 2026 12:42:20 -0300
Subject: [PATCH] feat(ci): improve cache usage

---
 .github/workflows/audit-javascript.yml      |  8 +---
 .github/workflows/check-generated-files.yml |  8 +---
 .github/workflows/fmt.yml                   |  8 +---
 .github/workflows/integration-tests.yml     | 14 +++++-
 .github/workflows/lint-javascript.yml       |  8 +---
 .github/workflows/lint-rust.yml             | 22 ++++++++++
 .github/workflows/sync.yml                  |  9 +---
 .github/workflows/test-android.yml          |  7 ++-
 .github/workflows/test-rust.yml             | 48 ++++++++++++++++++++-
 9 files changed, 89 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/audit-javascript.yml b/.github/workflows/audit-javascript.yml
index 83c388777..151d913a2 100644
--- a/.github/workflows/audit-javascript.yml
+++ b/.github/workflows/audit-javascript.yml
@@ -38,18 +38,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - name: Cache pnpm modules
-        uses: actions/cache@v6
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-
       - uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
       - uses: pnpm/action-setup@v6
         with:
           run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
       - name: audit
         run: pnpm audit
diff --git a/.github/workflows/check-generated-files.yml b/.github/workflows/check-generated-files.yml
index 0ea70c49b..11f40d1b1 100644
--- a/.github/workflows/check-generated-files.yml
+++ b/.github/workflows/check-generated-files.yml
@@ -158,19 +158,13 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Cache pnpm modules
-        uses: actions/cache@v6
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-
       - uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
       - uses: pnpm/action-setup@v6
         with:
           run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
 
       - name: build api
         working-directory: plugins/${{ matrix.package }}
diff --git a/.github/workflows/fmt.yml b/.github/workflows/fmt.yml
index b6023261f..bc23cdcef 100644
--- a/.github/workflows/fmt.yml
+++ b/.github/workflows/fmt.yml
@@ -29,19 +29,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - name: Cache pnpm modules
-        uses: actions/cache@v6
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-
       - uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
       - uses: pnpm/action-setup@v6
         with:
           run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
       - run: pnpm format:check
 
   taplo:
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index ff1373220..292172cab 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -24,6 +24,9 @@ on:
 permissions:
   contents: read
 
+env:
+  CARGO_PROFILE_DEV_DEBUG: 0 # no debuginfo: faster builds and a much smaller target dir to cache
+
 jobs:
   run-integration-tests:
     runs-on: ${{ matrix.platform }}
@@ -48,9 +51,18 @@ jobs:
           sudo apt-get install -y webkit2gtk-4.0 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev libfuse2
 
       - uses: Swatinem/rust-cache@v2
+        with:
+          # Only `v2`/`v3` write to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts an entry
+          # that other runs would have hit (10 GB repository limit, LRU eviction).
+          save-if: ${{ github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3' }}
 
       - name: install Tauri CLI
-        run: cargo install tauri-cli --git https://github.com/tauri-apps/tauri --branch dev
+        # `--debug --target-dir target`: a dev-profile build in the workspace target dir reuses
+        # the cached dependencies (shared with the test build below) instead of a from-scratch
+        # release build in a temporary dir. `--locked` keeps the dependency versions stable
+        # between runs, so the cached artifacts stay valid.
+        run: cargo install tauri-cli --git https://github.com/tauri-apps/tauri --branch dev --locked --debug --target-dir target
 
       - name: run integration tests
         run: cargo test --test '*' -- --ignored
diff --git a/.github/workflows/lint-javascript.yml b/.github/workflows/lint-javascript.yml
index b5f05298f..c3fce74c1 100644
--- a/.github/workflows/lint-javascript.yml
+++ b/.github/workflows/lint-javascript.yml
@@ -40,18 +40,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - name: Cache pnpm modules
-        uses: actions/cache@v6
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-
       - uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
       - uses: pnpm/action-setup@v6
         with:
           run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
       - name: eslint
         run: pnpm lint
diff --git a/.github/workflows/lint-rust.yml b/.github/workflows/lint-rust.yml
index 26dacde74..ede7bf60a 100644
--- a/.github/workflows/lint-rust.yml
+++ b/.github/workflows/lint-rust.yml
@@ -38,6 +38,7 @@ jobs:
       pull-requests: read
     outputs:
       packages: ${{ steps.filter.outputs.changes }}
+      saver: ${{ steps.saver.outputs.saver }}
     steps:
       - uses: actions/checkout@v7
       - uses: dorny/paths-filter@v2
@@ -129,6 +130,22 @@ jobs:
               - .github/workflows/lint-rust.yml
               - plugins/window-state/**
 
+      # Every package job for a platform restores the same rust-cache entry, and exactly one
+      # of them saves it (see the `save-if` of the rust-cache step). Prefer the packages whose
+      # dependency tree covers most of the other plugins' dependencies, so the entry is as
+      # useful as possible for the packages that did not save it.
+      - name: pick the package that saves the cache
+        id: saver
+        env:
+          PACKAGES: ${{ steps.filter.outputs.changes }}
+        run: |
+          saver="$(jq -rn --argjson packages "${PACKAGES:-[]}" '
+            ["tauri-plugin-upload", "tauri-plugin-sql", "tauri-plugin-updater", "tauri-plugin-single-instance"]
+            | map(select(. as $p | $packages | index($p) != null))
+            | first // $packages[0] // empty
+          ')"
+          echo "saver=$saver" >> "$GITHUB_OUTPUT"
+
   clippy:
     needs: changes
     if: ${{ needs.changes.outputs.packages != '[]' && needs.changes.outputs.packages != '' }}
@@ -152,6 +169,11 @@ jobs:
           components: clippy
 
       - uses: Swatinem/rust-cache@v2
+        with:
+          # One entry shared by every package job (the default key is per job, not per
+          # matrix entry), only written from `v2`/`v3` and by a single package job; see
+          # test-rust.yml for the reasoning.
+          save-if: ${{ (github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3') && matrix.package == needs.changes.outputs.saver }}
 
       - name: clippy ${{ matrix.package }}
         run: cargo clippy --package ${{ matrix.package }} --all-targets -- -D warnings
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 1b9e98413..002f5bdd4 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -27,14 +27,6 @@ jobs:
       - name: Fetch git tags
         run: git fetch origin 'refs/tags/*:refs/tags/*'
 
-      - name: Cache pnpm modules
-        uses: actions/cache@v6
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-
-
       - uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
@@ -42,6 +34,7 @@ jobs:
       - uses: pnpm/action-setup@v6
         with:
           run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
 
       - name: Build packages
         run: pnpm build
diff --git a/.github/workflows/test-android.yml b/.github/workflows/test-android.yml
index 85cbd9a45..45fdc085c 100644
--- a/.github/workflows/test-android.yml
+++ b/.github/workflows/test-android.yml
@@ -27,6 +27,9 @@ jobs:
       matrix:
         platform: [ubuntu-latest, macos-latest, windows-latest]
 
+    # No caches on purpose: this workflow only runs on pull requests, so anything it saved
+    # would live on the merge ref where no other run can restore it, while still counting
+    # against the repository's 10 GB cache limit and evicting entries that `v2`/`v3` saved.
     steps:
       - uses: actions/checkout@v7
 
@@ -44,14 +47,12 @@ jobs:
         with:
           distribution: temurin
           java-version: 21
-          cache: gradle
 
       - name: Setup NDK
         uses: nttld/setup-ndk@v1
         id: setup-ndk
         with:
           ndk-version: r25
-          local-cache: true
 
       # TODO check after https://github.com/nttld/setup-ndk/issues/518 is fixed
       - name: Restore Android Symlinks
@@ -67,8 +68,6 @@ jobs:
               echo "Changed $(basename "$link") from $current_target to $new_target"
           done
 
-      - uses: Swatinem/rust-cache@v2
-
       - name: build API
         run: pnpm build
 
diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml
index a9e5ae26b..bfd84bf0d 100644
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@@ -26,6 +26,10 @@ on:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
 
+env:
+  CARGO_PROFILE_DEV_DEBUG: 0 # no debuginfo: faster builds and a much smaller target dir to cache
+  CROSS_REV: 51f46f296253d8122c927c5bb933e3c4f27cc317
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -40,6 +44,7 @@ jobs:
       pull-requests: read
     outputs:
       packages: ${{ steps.filter.outputs.changes }}
+      saver: ${{ steps.saver.outputs.saver }}
     steps:
       - uses: actions/checkout@v7
       - uses: dorny/paths-filter@v2
@@ -186,6 +191,22 @@ jobs:
               - Cargo.lock
               - plugins/window-state/**
 
+      # Every package job for a platform restores the same rust-cache entry, and exactly one
+      # of them saves it (see the `save-if` of the rust-cache step). Prefer the packages whose
+      # dependency tree covers most of the other plugins' dependencies, so the entry is as
+      # useful as possible for the packages that did not save it.
+      - name: pick the package that saves the cache
+        id: saver
+        env:
+          PACKAGES: ${{ steps.filter.outputs.changes }}
+        run: |
+          saver="$(jq -rn --argjson packages "${PACKAGES:-[]}" '
+            ["tauri-plugin-upload", "tauri-plugin-sql", "tauri-plugin-updater", "tauri-plugin-single-instance"]
+            | map(select(. as $p | $packages | index($p) != null))
+            | first // $packages[0] // empty
+          ')"
+          echo "saver=$saver" >> "$GITHUB_OUTPUT"
+
   test:
     needs: changes
     if: ${{ needs.changes.outputs.packages != '[]' && needs.changes.outputs.packages != '' }}
@@ -242,11 +263,34 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2
         with:
-          key: cache-${{ matrix.package }}-${{ matrix.platform.target }}
+          # One entry per platform, shared by every package job: the plugins share most of
+          # their dependency tree (tauri, wry, tao...), and an entry per package and platform
+          # (26 × 5 entries of 500-800 MB each) never fits the repository's 10 GB cache limit.
+          key: ${{ matrix.platform.target }}
+          # Only `v2`/`v3` write to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts an entry
+          # that other runs would have hit (10 GB repository limit, LRU eviction).
+          # A single package job saves the shared entry, so the jobs don't race for the key.
+          save-if: ${{ (github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3') && matrix.package == needs.changes.outputs.saver }}
+
+      # `cross` is built from a pinned git revision (its latest release predates the Android
+      # targets we need). Keep the binary in its own small cache entry (accessed by every run,
+      # so it stays hot) instead of rebuilding it from source on every run.
+      - name: restore cross
+        if: ${{ matrix.platform.runner == 'cross' }}
+        id: cross-cache
+        uses: actions/cache@v6
+        with:
+          path: ${{ runner.tool_cache }}/cross
+          key: cross-${{ runner.os }}-${{ env.CROSS_REV }}
 
       - name: install cross
+        if: ${{ matrix.platform.runner == 'cross' && steps.cross-cache.outputs.cache-hit != 'true' }}
+        run: cargo +stable install cross --git https://github.com/cross-rs/cross --rev ${{ env.CROSS_REV }} --locked --root ${{ runner.tool_cache }}/cross
+
+      - name: add cross to PATH
         if: ${{ matrix.platform.runner == 'cross' }}
-        run: cargo +stable install cross --git https://github.com/cross-rs/cross
+        run: echo "${{ runner.tool_cache }}/cross/bin" >> $GITHUB_PATH
 
       - name: test ${{ matrix.package }}
         if: ${{ matrix.package != 'tauri-plugin-http' && matrix.package != 'tauri-plugin-dialog' }}