perf(ci): build and deploy pipeline optimizations

.github/workflows/ci.yml

@@ -3,8 +3,26 @@ name: CI
 on:
   pull_request:
 
+  # Do not remove this trigger as redundant with `pull_request`: it exists to
+  # seed the shared cache on the default branch after merges; the checks already
+  # ran for the change in the pull request workflow.
+  # GitHub scopes every cache entry to the ref that wrote it, and a run may
+  # only read entries from its own ref, its base ref, or the default branch.
+  # A `pull_request`-only workflow therefore writes every entry into a
+  # `refs/pull/N/merge` scope that no other pull request can ever read, so
+  # each one starts cold, rebuilds everything, and saves yet another private
+  # copy. That churn previously consumed the whole 10 GB repository cache
+  # quota and evicted entries faster than they could be reused.
+  #
+  # Running on pushes to the default branch writes the entries into a scope
+  # every pull request can read, so one post-merge run seeds them all.
+  push:
+    branches: [develop]
+
 concurrency:
-  cancel-in-progress: true
+  # Superseded pull request runs are worth cancelling, but a push to the
+  # default branch is what seeds the shared cache, so let it always finish.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
   group: ${{ github.workflow }}-${{ github.ref }}
 
 permissions:

.github/workflows/pr-title-lint.yml

@@ -27,15 +27,12 @@ jobs:
       - name: Checkout code (shallow)
         uses: actions/checkout@v7
 
-      - name: Cache Commitlint
-        id: cache-commitlint
-        uses: actions/cache@v6
-        with:
-          path: node_modules
-          key: v1-commitlint-${{ env.COMMITLINT_CLI_VERSION }}
-
+      # Deliberately not cached. This workflow only runs on `pull_request`, so
+      # every cache entry lands in a `refs/pull/N/merge` scope that no other
+      # pull request can read: each one paid the full install anyway and then
+      # wrote another ~12 MB private copy against the repository's 10 GB quota.
+      # Restoring the entry also costs about as long as the install it skips.
       - name: Install Commitlint
-        if: steps.cache-commitlint.outputs.cache-hit != 'true'
         run: npm i -D @commitlint/cli@${{ env.COMMITLINT_CLI_VERSION }} @commitlint/config-conventional @commitlint/types
 
       - name: Lint PR title (conventional commit)

Makefile

@@ -1,5 +1,11 @@
 SHELL := /bin/bash
 
+RUST_VERSION := $(shell sed -n 's/^[[:space:]]*channel[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' rust-toolchain.toml)
+ifeq ($(strip $(RUST_VERSION)),)
+$(error could not read the toolchain channel from rust-toolchain.toml)
+endif
+export RUST_VERSION
+
 GENERATED_PATHS := \
 	README.md \
 	docs \

crates/oapi-codegen/tests/integration/client/Dockerfile

@@ -4,7 +4,10 @@
 # start; pre-building with `--no-run` means startup goes straight to the tests.
 # The build context is the repository root (see docker-compose.yml).
 
-FROM rust:1.96-bookworm AS builder
+# Kept in sync with rust-toolchain.toml by the Makefile: a mismatch makes
+# rustup download a second toolchain inside the image on every build.
+ARG RUST_VERSION=1.97.1
+FROM rust:${RUST_VERSION}-bookworm AS builder
 WORKDIR /src
 COPY . .
 RUN cargo test --no-run --locked -p bookstore-example --features client --test e2e

crates/oapi-codegen/tests/integration/docker-compose.yml

@@ -14,6 +14,8 @@ services:
     build:
       context: ../../../..
       dockerfile: crates/oapi-codegen/tests/integration/server/Dockerfile
+      args:
+        RUST_VERSION: ${RUST_VERSION:-1.97.1}
     environment:
       BOOKSTORE_ADDR: 0.0.0.0:8080
     expose:
@@ -23,6 +25,8 @@ services:
     build:
       context: ../../../..
       dockerfile: crates/oapi-codegen/tests/integration/client/Dockerfile
+      args:
+        RUST_VERSION: ${RUST_VERSION:-1.97.1}
     depends_on:
       - server
     environment:

crates/oapi-codegen/tests/integration/server/Dockerfile

@@ -1,14 +1,17 @@
 # Build the bookstore server binary from the workspace, then run it from a slim
 # runtime image. The build context is the repository root (see docker-compose.yml).
 
-FROM rust:1.96-bookworm AS builder
+# Kept in sync with rust-toolchain.toml by the Makefile: a mismatch makes
+# rustup download a second toolchain inside the image on every build.
+ARG RUST_VERSION=1.97.1
+FROM rust:${RUST_VERSION}-bookworm AS builder
 WORKDIR /src
 COPY . .
-RUN cargo build --release --locked -p bookstore-example --bin bookstore-server
+RUN cargo build --locked -p bookstore-example --bin bookstore-server
 
 FROM debian:bookworm-slim AS runtime
 WORKDIR /app
-COPY --from=builder /src/target/release/bookstore-server /usr/local/bin/bookstore-server
+COPY --from=builder /src/target/debug/bookstore-server /usr/local/bin/bookstore-server
 ENV BOOKSTORE_ADDR=0.0.0.0:8080
 EXPOSE 8080
 CMD ["bookstore-server"]