ci: restore rust-cache

.github/workflows/perf-pr.yml

@@ -27,6 +27,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  MBX_DISABLE: "1"
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: "0"
   TAK_RUNNER: jdx-perf-v1-ubuntu24.04-x64-usage-rust1.97.1-img5263c143
@@ -71,10 +72,6 @@ jobs:
           echo "pr_number=$PR_NUMBER" >&3
 
   measure:
-    env:
-      # Job-local appliance volume; no remote backend is configured.
-      MBX_CACHE_DIR: /var/cache/mbx
-      MBX_REMOTE_URL: ""
     name: Compare instruction counts
     needs: authorize
     if: needs.authorize.outputs.authorized == 'true'
@@ -85,8 +82,7 @@ jobs:
     runs-on: [self-hosted, jdx-perf-v1]
     container:
       image: ghcr.io/jdx/perf-runner@sha256:5263c143b12ce2234e7b0b21d3d6501c2ed05837b42937d0eaeaa191cd5c8e68
-      # Anonymous by design; perf-runner#10 prunes it after this container stops.
-      options: --cpuset-cpus 0-7 --mount type=volume,dst=/var/cache/mbx
+      options: --cpuset-cpus 0-7
     timeout-minutes: 40
     permissions:
       # Read only. This job builds and runs code from the pull request, so it
@@ -96,8 +92,6 @@ jobs:
       run:
         shell: bash
     steps:
-      - name: Initialize isolated build cache
-        run: sudo chown "$(id -u):$(id -g)" "$MBX_CACHE_DIR"
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The branch commit, not the merge commit actions/checkout defaults to
@@ -111,8 +105,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      # Compile inside the pinned job container. mise's cache remains disabled:
-      # mbx uses the appliance-local content-addressed store mounted above.
+      # Compile inside the pinned job container. Restoring target/ could relabel
+      # a binary built on another runner class as a jdx-perf-v1 measurement.
       - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           cache: false
@@ -138,8 +132,6 @@ jobs:
             uname -a
             lscpu
             mise --version
-            mbx --version
-            mbx cache dir
             rustc --version
             cargo --version
             valgrind --version
@@ -178,7 +170,7 @@ jobs:
           trap 'git worktree remove --force "$base_worktree"' EXIT
           (
             cd "$base_worktree"
-            mbx build --release
+            cargo build --release
             taskset -c 0-3 tak run --record
           )
 

.github/workflows/perf.yml

@@ -25,24 +25,21 @@ concurrency:
   cancel-in-progress: false
 
 env:
+  MBX_DISABLE: "1"
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: "0"
   TAK_RUNNER: jdx-perf-v1-ubuntu24.04-x64-usage-rust1.97.1-img5263c143
 
 jobs:
   measure:
-    env:
-      # Persistent appliance-local store; no remote backend is configured.
-      MBX_CACHE_DIR: /var/cache/mbx
-      MBX_REMOTE_URL: ""
     name: Measure
     # Pinned to one runner class on purpose. Absolute instruction counts shift
     # between machine types by more than a real regression does, so a series
     # that wanders between runners is unreadable.
     runs-on: [self-hosted, jdx-perf-v1]
     container:
       image: ghcr.io/jdx/perf-runner@sha256:5263c143b12ce2234e7b0b21d3d6501c2ed05837b42937d0eaeaa191cd5c8e68
-      options: --cpuset-cpus 0-7 --mount type=bind,src=/var/cache/jdx-perf/mbx,dst=/var/cache/mbx
+      options: --cpuset-cpus 0-7
     timeout-minutes: 30
     permissions:
       contents: read
@@ -51,8 +48,8 @@ jobs:
         with:
           persist-credentials: false
 
-      # Compile inside the pinned job container. mise's cache remains disabled:
-      # mbx uses the appliance-local content-addressed store mounted above.
+      # Compile inside the pinned job container. Restoring target/ could relabel
+      # a binary built on another runner class as a jdx-perf-v1 measurement.
       - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           cache: false
@@ -82,8 +79,6 @@ jobs:
             uname -a
             lscpu
             mise --version
-            mbx --version
-            mbx cache dir
             rustc --version
             cargo --version
             valgrind --version

.github/workflows/release-plz.yml

@@ -13,6 +13,7 @@ on:
       - release-plz
 
 env:
+  MBX_DISABLE: "1"
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   NPM_CONFIG_FUND: false
 

.github/workflows/test-impl.yml

@@ -11,6 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  MBX_DISABLE: "1"
   MISE_EXPERIMENTAL: 1
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -25,9 +26,10 @@ jobs:
           submodules: recursive
           persist-credentials: false
       - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - uses: ./.github/actions/mbx
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # zizmor: ignore[cache-poisoning]
         with:
-          backend: ${{ inputs.trusted && 'local' || 'server' }}
+          shared-key: test
+          save-if: ${{ inputs.trusted && github.ref == 'refs/heads/main' }}
       # Retries and a longer wait, rather than being allowed to fail. `cli`'s completion
       # tests refuse to skip a missing shell when `CI` is set — see
       # `skip_if_shell_missing` — which is a deliberate policy this step exists to keep:
@@ -140,9 +142,10 @@ jobs:
           submodules: recursive
           persist-credentials: false
       - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - uses: ./.github/actions/mbx
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # zizmor: ignore[cache-poisoning]
         with:
-          backend: server
+          shared-key: test-windows
+          save-if: ${{ inputs.trusted && github.ref == 'refs/heads/main' }}
       - run: mise r build
       # `usage bash` runs whatever Windows resolves `bash` to, and `CreateProcess` searches the
       # system directory before `PATH`. On this runner that is `C:\Windows\System32\bash.exe` —
@@ -242,14 +245,14 @@ jobs:
       - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           cache: false
-          install_args: mr-boxington
-      - uses: ./.github/actions/mbx
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # zizmor: ignore[cache-poisoning]
         with:
-          backend: ${{ inputs.trusted && 'local' || 'server' }}
+          shared-key: msrv-${{ matrix.version }}
+          save-if: ${{ inputs.trusted && github.ref == 'refs/heads/main' }}
       - name: they build at the version they claim
         run: |
           for crate in ${{ matrix.crates }}; do
-            mbx +${{ matrix.version }} check --locked -p "$crate" --all-features
+            cargo +${{ matrix.version }} check --locked -p "$crate" --all-features
           done
 
   # Single fan-in gate, so branch protection can require one stable check

.github/workflows/test.yml

@@ -12,7 +12,6 @@ jobs:
     if: ${{ github.actor == 'jdx' && (github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login == 'jdx')) }}
     permissions:
       contents: read
-      id-token: write
     uses: ./.github/workflows/test-impl.yml
     with:
       trusted: true